Bump dompurify and ngx-markdown

[dependabot]

Bumps dompurify to 2.5.4 and updates ancestor dependency ngx-markdown. These dependencies need to be updated together.

Updates dompurify from 2.4.1 to 2.5.4

Release notes

Sourced from dompurify's releases.

DOMPurify 2.5.4

• Fixed a bug with latest isNaN checks affecting MSIE, thanks @​tulach
• Fixed the tests for MSIE and fixed related test-runner

DOMPurify 2.5.3

• Fixed several mXSS variations found by and thanks to @​kevin-mizu & @​Ry0taK
• Added better configurability for comment scrubbing default behavior
• Added better hardening against Prototype Pollution attacks, thanks @​kevin-mizu
• Fixed some smaller issues in README and other documentation

DOMPurify 2.5.2

• Addressed and fixed a mXSS variation found by @​kevin-mizu
• Addressed and fixed a mXSS variation found by Adam Kues of Assetnote
• Updated tests for older Safari and Chrome versions

DOMPurify 2.5.1

• Fixed an mXSS sanitizer bypass reported by @​icesfont
• Added new code to track element nesting depth
• Added new code to enforce a maximum nesting depth of 255
• Added coverage tests and necessary clobbering protections

Note that this is a security release and should be upgraded to immediately. Please also note that further releases may follow as the underlying vulnerability is apparently new and further variations may be discovered.

DOMPurify 2.5.0

• Added new setting SAFE_FOR_XML to enable better control over comment scrubbing
• Updated the LICENSE file to show the accurate year number
• Updated several build and test dependencies

DOMPurify 2.4.9

• Fixed another conditional bypass caused by Processing Instructions, thanks @​Ry0taK
• Fixed the regex for HTML Custom Element detection, thanks @​AlekseySolovey3T

DOMPurify 2.4.8

• Fixed two possible bypasses when sanitizing an XML document and later using it in HTML, thanks @​Slonser

DOMPurify 2.4.7

• Fixed a licensing issue spotted and reported by @​george-thomas-hill

DOMPurify 2.4.6

• Fixed a bypass in jsdom 22 in case the noframes element is permitted, thanks @​leeN

DOMPurify 2.4.5

• Fixed a problem with improper reset of custom HTML options, thanks @​ammaraskar

DOMPurify 2.4.4

• Added support for ALLOW_SELF_CLOSE_IN_ATTR flag, thanks @​edg2s @​AndreVirtimo
• Added better support for shadowrootmode, thanks @​mfreed7

DOMPurify 2.4.3

• Final release that is compatible with MSIE10 & MSIE 11

... (truncated)

Commits

• 10c1261 docs: Updated README ever so slightly
• 1c92880 test: Fixed two more tests for MSIE11 and Edge 18
• 1401208 test: Fixed more tests for MSIE and Edge 18
• 2c6410a test: Fixed several new tests for MSIE11 and Edge 18
• 2c9bca9 test: Changed github config to include MSIE tests for 2.x
• b188787 chore: Preparing 2.5.4 release
• 707b3d6 fix: Added a better for for the MSIE iNaN issue
• 62fe3be test: Attempting to get MSIE 11 back into the browser test array
• f3a9710 fix: Fixed an issue with MSIE and no support for Number.isNaN
• e1ddfc7 Merge branch '2.x' of github.com:cure53/DOMPurify into 2.x
• Additional commits viewable in compare view

Updates ngx-markdown from 16.0.0 to 18.1.0

Release notes

Sourced from ngx-markdown's releases.

v18.1.0

New features and enhancements

• Add support for emoji-toolkit version 9.0.0, Unicode 15.1 (#546) (39dfb63) @​jfcere
• Add support for mermaid version 11 (#547) (0c81a5f) @​hardikpatel043

Bug Fixes

• Fix globally imported CLIPBOARD_OPTIONS (#545) (1bcaa29) @​klofi, @​jfcere

Special Thanks

🥇 Thanks to @​klofi for his contribution in fixing globally imported CLIPBOARD_OPTIONS 🥇 Thanks to @​hardikpatel043 for his contribution in adding support for mermaid 11.0.0

v18.0.0

Update Angular 18

Library has been updated to support Angular 18.

It is recommended to stick with ngx-markdown v17.x.x if you are using Angular 17.

New features and enhancements

• Update to Angular 18
• Remove clipboard button inline opacity transition and add CSS classes

⚠️ Breaking changes

Clipboard Plugin

The clipboard button no longer has an opacity transition by default. Instead, CSS classes have been added to allow customization as documented in the README.md and the Plugins > Clipboard Plugin section of the demo site.

To keep the previous behavior, simply add the following CSS to your global styles.css/scss styling file.

.markdown-clipboard-toolbar {
  opacity: 0;
  transition: opacity 250ms ease-out;
}
.markdown-clipboard-toolbar.hover {
opacity: 1;
}

Special thanks

🥇 Thanks to @​pkurcx for his contribution to update Angular 18.

... (truncated)

Commits

• f14639d 18.1.0
• 0c81a5f Add support for mermaid 11.0.0 (#547)
• 39dfb63 Add support for emoji-toolkit 9.0.0 (#546)
• 1bcaa29 Fix globally imported CLIPBOARD_OPTIONS (#545)
• b2a4a44 Bump body-parser from 1.20.2 to 1.20.3 (#544)
• 0c652c8 Bump rollup from 4.18.0 to 4.22.4 (#542)
• 87e68d6 Bump express from 4.19.2 to 4.21.0 (#540)
• 28304c8 Bump axios from 1.7.2 to 1.7.7 (#539)
• bc1a72a Bump dompurify from 3.0.6 to 3.1.6 (#538)
• c8d157f Bump socket.io from 4.6.1 to 4.7.5 (#527)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[david4096]

Changed the target branch to point at release

[coverbeck]

This doesn't build for me locally. The ngx-markdown major version, 18, needs to match the Angular major version, which we currently have at 16.

I think we have to wait on this.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[denis-yuen]

Weird, dunno why dependabot picked this base branch