Skip to content

[DEPENDABOT] Weekly npm updates(deps): Bump dompurify, tinacms and @tinacms/cli - #8

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-b4451d9708
Open

[DEPENDABOT] Weekly npm updates(deps): Bump dompurify, tinacms and @tinacms/cli#8
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-b4451d9708

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 7, 2026

Copy link
Copy Markdown

Bumps dompurify to 3.4.13 and updates ancestor dependencies dompurify, tinacms and @tinacms/cli. These dependencies need to be updated together.

Updates dompurify from 3.3.0 to 3.4.13

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

  • Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
  • Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
  • Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
  • Bumped several dependencies where possible

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.11

  • Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
  • Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
  • Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
  • Updated up the linting tool-chain and removed now-redundant lint directives
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.10

  • Refactored codebase for clarity: extracted the public type declarations into types.ts
  • Decomposed the three largest sanitizer functions into focused helpers
  • Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
  • Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
  • Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
  • Reduced CI cost by running the full three-engine browser suite once per PR
  • Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
  • Documented the bench and test:happydom scripts in the README
  • Completed the Attack Classes & Bypass History wiki page
  • Bumped several dependencies where possible

DOMPurify 3.4.9

  • Further improved the handling of Trusted Types config options, thanks @​offset
  • Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
  • Added more test coverage for IN_PLACE and Trusted Types related usage
  • Bumped several dependencies where possible
  • Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

  • Cleaned up the repository root, renamed some and removed unneeded files
  • Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
  • Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
  • Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
  • Bumped several dependencies where possible

DOMPurify 3.4.7

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates tinacms from 3.4.1 to 3.11.0

Release notes

Sourced from tinacms's releases.

tinacms@3.11.0

Minor Changes

  • #7235 908fe7d Thanks @​joshbermanssw! - Editorial-workflow saves (Save draft / Save to a new branch, and the media create-branch flow) now run a single branch-list lookup instead of two sequential ones, roughly halving the delay before the progress modal appears.

Patch Changes

  • #7194 711ba30 Thanks @​kulesy! - Button now renders the shared loading-dots indicator automatically when busy, so every busy button gets a consistent spinner instead of each call site wiring its own (and some, like the account password form, were missing it entirely). The dots inherit the button text color so they stay visible across variants.

  • #7161 566af78 Thanks @​ahfoysal! - Keep folder collection views open when they only contain one document.

  • #7251 b8df6ee Thanks @​kulesy! - Fix the rich-text link popover not appearing when adding or editing a link.

    Since the popover was moved into a portal on document.body, plate-floating's inline z-index: 50 overrode its z-[999999] class, so it rendered behind the form field wrappers (which use z-index up to 1000) and was invisible. It now sits above them, so clicking the link button shows the URL input as expected.

  • #7204 59efccc Thanks @​joshbermanssw! - Show a clear error when repo-based media is used with a self-hosted site, instead of a misleading "Bad Route" message.

  • #7213 056ffc2 Thanks @​wicksipedia! - Publish internal package references as ranges instead of exact versions.

    Internal dependencies were declared as workspace:*, which pnpm expands to an exact version when publishing ("tinacms": "3.10.0"), not a range. An exact pin cannot deduplicate against the version a consumer has already installed, so npm nests a second — and third — complete copy of tinacms and its dependency tree. In a stock Astro + TinaCMS blog this produced three copies of tinacms, three of mermaid (186 MB), five of date-fns (151 MB), and four of typescript (88 MB): about 320 MB of duplication.

    The same expansion applied to peerDependencies, so packages such as next-tinacms-cloudinary and tinacms-authjs published "tinacms": "3.10.0" as a peer — requiring consumers to have that exact version or hit an ERESOLVE conflict, and forcing a republish of every dependent on each tinacms release.

    Switching these to workspace:^ publishes them as caret ranges (^3.10.0), which deduplicate normally and let onlyUpdatePeerDependentsWhenOutOfRange do its job.

  • Updated dependencies [cdbf469, 056ffc2]:

    • @​tinacms/bridge@​0.3.1
    • @​tinacms/mdx@​2.1.11
    • @​tinacms/search@​1.2.23

tinacms@3.10.1

Patch Changes

  • Updated dependencies [4b4e139]:
    • @​tinacms/mdx@​2.1.10
    • @​tinacms/search@​1.2.22

tinacms@3.10.0

Minor Changes

Patch Changes

  • #7141 3a1b39a Thanks @​joshbermanssw! - Update @radix-ui/* dependencies to their latest patch/minor releases and remove the unused @radix-ui/react-checkbox dependency

  • #7140 de4a807 Thanks @​joshbermanssw! - Add a PostHog editorial-workflow-save event that records which save option was used in the "Save changes to new branch" modal (draft, ready for review, or publish), whether the save succeeded, and the failure reason when it didn't.

  • #7138 8497110 Thanks @​joshbermanssw! - Editorial workflow: replace the draft / ready-for-review toggle in the "Save changes to new branch" modal with a save-options dropdown (Save draft, Save (ready for review), Save and publish). The split button's main action reflects the editor's last choice (default Save draft, remembered via localStorage), and Save and publish is disabled with a tooltip on protected branches.

... (truncated)

Changelog

Sourced from tinacms's changelog.

3.11.0

Minor Changes

  • #7235 908fe7d Thanks @​joshbermanssw! - Editorial-workflow saves (Save draft / Save to a new branch, and the media create-branch flow) now run a single branch-list lookup instead of two sequential ones, roughly halving the delay before the progress modal appears.

Patch Changes

  • #7194 711ba30 Thanks @​kulesy! - Button now renders the shared loading-dots indicator automatically when busy, so every busy button gets a consistent spinner instead of each call site wiring its own (and some, like the account password form, were missing it entirely). The dots inherit the button text color so they stay visible across variants.

  • #7161 566af78 Thanks @​ahfoysal! - Keep folder collection views open when they only contain one document.

  • #7251 b8df6ee Thanks @​kulesy! - Fix the rich-text link popover not appearing when adding or editing a link.

    Since the popover was moved into a portal on document.body, plate-floating's inline z-index: 50 overrode its z-[999999] class, so it rendered behind the form field wrappers (which use z-index up to 1000) and was invisible. It now sits above them, so clicking the link button shows the URL input as expected.

  • #7204 59efccc Thanks @​joshbermanssw! - Show a clear error when repo-based media is used with a self-hosted site, instead of a misleading "Bad Route" message.

  • #7213 056ffc2 Thanks @​wicksipedia! - Publish internal package references as ranges instead of exact versions.

    Internal dependencies were declared as workspace:*, which pnpm expands to an exact version when publishing ("tinacms": "3.10.0"), not a range. An exact pin cannot deduplicate against the version a consumer has already installed, so npm nests a second — and third — complete copy of tinacms and its dependency tree. In a stock Astro + TinaCMS blog this produced three copies of tinacms, three of mermaid (186 MB), five of date-fns (151 MB), and four of typescript (88 MB): about 320 MB of duplication.

    The same expansion applied to peerDependencies, so packages such as next-tinacms-cloudinary and tinacms-authjs published "tinacms": "3.10.0" as a peer — requiring consumers to have that exact version or hit an ERESOLVE conflict, and forcing a republish of every dependent on each tinacms release.

    Switching these to workspace:^ publishes them as caret ranges (^3.10.0), which deduplicate normally and let onlyUpdatePeerDependentsWhenOutOfRange do its job.

  • Updated dependencies [cdbf469, 056ffc2]:

    • @​tinacms/bridge@​0.3.1
    • @​tinacms/mdx@​2.1.11
    • @​tinacms/search@​1.2.23

3.10.1

Patch Changes

  • Updated dependencies [4b4e139]:
    • @​tinacms/mdx@​2.1.10
    • @​tinacms/search@​1.2.22

3.10.0

Minor Changes

Patch Changes

  • #7141 3a1b39a Thanks @​joshbermanssw! - Update @radix-ui/* dependencies to their latest patch/minor releases and remove the unused @radix-ui/react-checkbox dependency

  • #7140 de4a807 Thanks @​joshbermanssw! - Add a PostHog editorial-workflow-save event that records which save option was used in the "Save changes to new branch" modal (draft, ready for review, or publish), whether the save succeeded, and the failure reason when it didn't.

... (truncated)

Commits
  • b636a22 Version Packages (#7205)
  • 566af78 Fix folder collection auto-open (#7161)
  • 908fe7d ⚡ Collapse editorial-workflow branch guard to a single branch-list fetch (#7235)
  • b8df6ee fix(tinacms): show the rich-text link popover above form fields (#7251)
  • 056ffc2 🐛 Publish internal package refs as ranges, not exact pins (~320 MB of duplica...
  • 59efccc 🐛 Show a clear error for repo-based media on self-hosted sites (#7204)
  • 711ba30 refactor(tinacms): render loading dots automatically on busy buttons (#7194)
  • adeafbc Version Packages (#7174)
  • a1ebeda Version Packages (#7130)
  • ff10e65 fix(tinacms): reject invalid folder names inline via shared relativePath allo...
  • Additional commits viewable in compare view

Updates @tinacms/cli from 2.1.5 to 2.5.6

Release notes

Sourced from @​tinacms/cli's releases.

@​tinacms/cli@​2.5.6

Patch Changes

  • #7176 5daa624 Thanks @​joshbermanssw! - Improve the error message when the CLI cannot resolve tinacms or a @tinacms/* package while building your Tina config or database. It now names the package that failed, reports the directory Tina searched from, and points at parent-directory package-manager files (package.json, node_modules, yarn.lock, .pnp.cjs) that can hijack module resolution. esbuild package resolution is also anchored at the project root.

  • #7213 056ffc2 Thanks @​wicksipedia! - Publish internal package references as ranges instead of exact versions.

    Internal dependencies were declared as workspace:*, which pnpm expands to an exact version when publishing ("tinacms": "3.10.0"), not a range. An exact pin cannot deduplicate against the version a consumer has already installed, so npm nests a second — and third — complete copy of tinacms and its dependency tree. In a stock Astro + TinaCMS blog this produced three copies of tinacms, three of mermaid (186 MB), five of date-fns (151 MB), and four of typescript (88 MB): about 320 MB of duplication.

    The same expansion applied to peerDependencies, so packages such as next-tinacms-cloudinary and tinacms-authjs published "tinacms": "3.10.0" as a peer — requiring consumers to have that exact version or hit an ERESOLVE conflict, and forcing a republish of every dependent on each tinacms release.

    Switching these to workspace:^ publishes them as caret ranges (^3.10.0), which deduplicate normally and let onlyUpdatePeerDependentsWhenOutOfRange do its job.

  • Updated dependencies [711ba30, 908fe7d, 566af78, b8df6ee, 59efccc, 056ffc2]:

    • tinacms@3.11.0
    • @​tinacms/app@​2.5.10
    • @​tinacms/graphql@​2.4.9
    • @​tinacms/search@​1.2.23

@​tinacms/cli@​2.5.5

Patch Changes

  • Updated dependencies []:
    • @​tinacms/app@​2.5.9
    • @​tinacms/graphql@​2.4.8
    • tinacms@3.10.1
    • @​tinacms/search@​1.2.22

@​tinacms/cli@​2.5.4

Patch Changes

  • #7168 0a927a4 Thanks @​Aibono1225! - Security fix: TinaCloud authorization is now scoped to the site's own configured clientID instead of a value read from the request. isAuthorized takes an optional expectedClientID (falling back to NEXT_PUBLIC_TINA_CLIENT_ID) and refuses when neither resolves. TinaCloudBackendAuthProvider, the next-tinacms-azure adapter, and the tinacms init template all pass the site clientID through.

    Action required (self-hosted). Authorization now fails closed when the site's clientID cannot be resolved at runtime. Ensure NEXT_PUBLIC_TINA_CLIENT_ID is present in the server runtime (not only inlined at build time), or pass the clientID explicitly to TinaCloudBackendAuthProvider(...) and to media-store authorized callbacks, e.g. isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID). If it cannot be resolved, backend and media authorization will return 401.

@​tinacms/cli@​2.5.3

Patch Changes

@​tinacms/cli@​2.5.2

Patch Changes

... (truncated)

Changelog

Sourced from @​tinacms/cli's changelog.

2.5.6

Patch Changes

  • #7176 5daa624 Thanks @​joshbermanssw! - Improve the error message when the CLI cannot resolve tinacms or a @tinacms/* package while building your Tina config or database. It now names the package that failed, reports the directory Tina searched from, and points at parent-directory package-manager files (package.json, node_modules, yarn.lock, .pnp.cjs) that can hijack module resolution. esbuild package resolution is also anchored at the project root.

  • #7213 056ffc2 Thanks @​wicksipedia! - Publish internal package references as ranges instead of exact versions.

    Internal dependencies were declared as workspace:*, which pnpm expands to an exact version when publishing ("tinacms": "3.10.0"), not a range. An exact pin cannot deduplicate against the version a consumer has already installed, so npm nests a second — and third — complete copy of tinacms and its dependency tree. In a stock Astro + TinaCMS blog this produced three copies of tinacms, three of mermaid (186 MB), five of date-fns (151 MB), and four of typescript (88 MB): about 320 MB of duplication.

    The same expansion applied to peerDependencies, so packages such as next-tinacms-cloudinary and tinacms-authjs published "tinacms": "3.10.0" as a peer — requiring consumers to have that exact version or hit an ERESOLVE conflict, and forcing a republish of every dependent on each tinacms release.

    Switching these to workspace:^ publishes them as caret ranges (^3.10.0), which deduplicate normally and let onlyUpdatePeerDependentsWhenOutOfRange do its job.

  • Updated dependencies [711ba30, 908fe7d, 566af78, b8df6ee, 59efccc, 056ffc2]:

    • tinacms@3.11.0
    • @​tinacms/app@​2.5.10
    • @​tinacms/graphql@​2.4.9
    • @​tinacms/search@​1.2.23

2.5.5

Patch Changes

  • Updated dependencies []:
    • @​tinacms/app@​2.5.9
    • @​tinacms/graphql@​2.4.8
    • tinacms@3.10.1
    • @​tinacms/search@​1.2.22

2.5.4

Patch Changes

  • #7168 0a927a4 Thanks @​Aibono1225! - Security fix: TinaCloud authorization is now scoped to the site's own configured clientID instead of a value read from the request. isAuthorized takes an optional expectedClientID (falling back to NEXT_PUBLIC_TINA_CLIENT_ID) and refuses when neither resolves. TinaCloudBackendAuthProvider, the next-tinacms-azure adapter, and the tinacms init template all pass the site clientID through.

    Action required (self-hosted). Authorization now fails closed when the site's clientID cannot be resolved at runtime. Ensure NEXT_PUBLIC_TINA_CLIENT_ID is present in the server runtime (not only inlined at build time), or pass the clientID explicitly to TinaCloudBackendAuthProvider(...) and to media-store authorized callbacks, e.g. isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID). If it cannot be resolved, backend and media authorization will return 401.

2.5.3

Patch Changes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
[DEPENDABOT] Weekly npm updates(deps): Bump dompurify, tinacms and @t…
52e08b8 
…inacms/cli

Bumps [dompurify](https://github.com/cure53/DOMPurify) to 3.4.13 and updates ancestor dependencies [dompurify](https://github.com/cure53/DOMPurify), [tinacms](https://github.com/tinacms/tinacms/tree/HEAD/packages/tinacms) and [@tinacms/cli](https://github.com/tinacms/tinacms/tree/HEAD/packages/@tinacms/cli). These dependencies need to be updated together.


Updates `dompurify` from 3.3.0 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.0...3.4.13)

Updates `tinacms` from 3.4.1 to 3.11.0
- [Release notes](https://github.com/tinacms/tinacms/releases)
- [Changelog](https://github.com/tinacms/tinacms/blob/main/packages/tinacms/CHANGELOG.md)
- [Commits](https://github.com/tinacms/tinacms/commits/tinacms@3.11.0/packages/tinacms)

Updates `@tinacms/cli` from 2.1.5 to 2.5.6
- [Release notes](https://github.com/tinacms/tinacms/releases)
- [Changelog](https://github.com/tinacms/tinacms/blob/main/packages/@tinacms/cli/CHANGELOG.md)
- [Commits](https://github.com/tinacms/tinacms/commits/@tinacms/cli@2.5.6/packages/@tinacms/cli)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: indirect
- dependency-name: tinacms
  dependency-version: 3.11.0
  dependency-type: direct:production
- dependency-name: "@tinacms/cli"
  dependency-version: 2.5.6
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 7, 2026
@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown

🔍 PR Change Explainer

This automated summary helps you understand what this PR changes and how it affects filecoin.io.

📊 Quick Stats
Files changed 2
Lines added +1403
Lines removed -914

📝 What Changed (Plain Language)

This is a configuration change. It modifies build settings, dependencies, or project configuration.

📂 Detailed File Breakdown

Click to expand full file list

filecoin.io (filecoin-site)

Config:

  • apps/filecoin-site/package.json

Root / Config

  • package-lock.json

🚀 Preview & Next Steps

  1. Wait for the Vercel preview — a preview link will appear in this PR as a separate comment from the Vercel bot
  2. Click the preview link to see exactly how your changes look on the live site
  3. Test your changes:
  4. Check the status checks below — all checks should pass (green checkmarks) before merging
  5. When ready, request a review or merge the PR
📖 Glossary (click to expand)
Term What it means
PR (Pull Request) A proposed set of changes waiting to be merged into the main website
Preview deployment A temporary version of the website showing your changes (not public)
Merge Applying your changes to the main website — this triggers a production deploy
Build The process of converting code into a working website
Status checks Automated tests that verify your changes don't break anything
Content file (.md) A Markdown file containing text content (blog posts, case studies, etc.)
Component (.tsx) A reusable piece of the website's UI (buttons, cards, headers, etc.)
Frontmatter The metadata at the top of content files (title, date, description, etc.)
Shared package Code in packages/ used across the site — changes here can affect many pages

🤖 This comment was generated automatically to help explain PR changes. If something looks wrong, ask a developer for help.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants