@scratch/scratch-vm 11.2.0-feature-parity.2 → 11.2.0-svg-sanitization

package/dist/web/scratch-vm.js.LICENSE.txt

@@ -17,7 +17,7 @@ https://github.com/nodeca/pako/blob/main/LICENSE
  * @license  MIT
  */
 
-/*! @license DOMPurify 3.2.4 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.4/LICENSE */
+/*! @license DOMPurify 3.2.5 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.5/LICENSE */
 
 /*! @source http://purl.eligrey.com/github/canvas-toBlob.js/blob/master/canvas-toBlob.js */
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scratch/scratch-vm",
-  "version": "11.2.0-feature-parity.2",
+  "version": "11.2.0-svg-sanitization",
   "description": "Virtual Machine for Scratch 3.0",
   "author": "Massachusetts Institute of Technology",
   "license": "AGPL-3.0-only",
@@ -50,8 +50,8 @@
     "statements": 70
   },
   "dependencies": {
-    "@scratch/scratch-render": "11.2.0-feature-parity.2",
-    "@scratch/scratch-svg-renderer": "11.2.0-feature-parity.2",
+    "@scratch/scratch-render": "11.2.0-svg-sanitization",
+    "@scratch/scratch-svg-renderer": "11.2.0-svg-sanitization",
     "@vernier/godirect": "1.8.3",
     "arraybuffer-loader": "1.0.8",
     "atob": "2.1.2",
@@ -64,19 +64,19 @@
     "immutable": "3.8.2",
     "jszip": "3.10.1",
     "minilog": "3.1.0",
-    "scratch-audio": "2.0.135",
+    "scratch-audio": "2.0.147",
     "scratch-parser": "6.0.0",
-    "scratch-sb1-converter": "2.0.107",
-    "scratch-storage": "4.0.106",
+    "scratch-sb1-converter": "2.0.141",
+    "scratch-storage": "4.0.142",
     "scratch-translate-extension-languages": "1.0.7",
     "text-encoding": "0.7.0",
     "uuid": "8.3.2",
     "web-worker": "1.3.0"
   },
   "devDependencies": {
-    "@babel/core": "7.26.10",
-    "@babel/eslint-parser": "7.27.0",
-    "@babel/preset-env": "7.26.9",
+    "@babel/core": "7.27.1",
+    "@babel/eslint-parser": "7.27.1",
+    "@babel/preset-env": "7.27.2",
     "adm-zip": "0.4.11",
     "babel-loader": "9.2.1",
     "callsite": "1.0.0",
@@ -93,15 +93,15 @@
     "json": "^9.0.4",
     "pngjs": "3.4.0",
     "scratch-blocks": "1.1.210",
-    "scratch-l10n": "5.0.198",
-    "scratch-render-fonts": "1.0.182",
+    "scratch-l10n": "5.0.247",
+    "scratch-render-fonts": "1.0.195",
     "scratch-semantic-release-config": "3.0.0",
     "scratch-webpack-configuration": "3.0.0",
     "script-loader": "0.7.2",
     "semantic-release": "19.0.5",
     "stats.js": "0.17.0",
     "tap": "16.3.10",
-    "webpack": "5.98.0",
+    "webpack": "5.99.8",
     "webpack-cli": "4.10.0",
     "webpack-dev-server": "5.2.1"
   }

package/src/serialization/deserialize-assets.js

@@ -1,5 +1,6 @@
 const JSZip = require('jszip');
 const log = require('../util/log');
+const {sanitizeSvg} = require('@scratch/scratch-svg-renderer');
 
 /**
  * Deserializes sound from file into storage cache so that it can
@@ -156,6 +157,11 @@ const deserializeCostume = function (costume, runtime, zip, assetFileName, textL
 
     return Promise.all([textLayerFilePromise,
         costumeFile.async('uint8array')
+            .then(data =>
+                (costumeFormat === 'svg' ?
+                    sanitizeSvg.sanitizeByteStream(data) :
+                    data)
+            )
             .then(data => storage.createAsset(
                 assetType,
                 // TODO eventually we want to map non-png's to their actual file types?