isomorphic-dompurify 3.0.0 → 3.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +10 -6
  2. package/package.json +7 -7
package/README.md CHANGED
@@ -2,8 +2,8 @@
2
2
  [![npm version](https://badge.fury.io/js/isomorphic-dompurify.svg)](https://badge.fury.io/js/isomorphic-dompurify)
3
3
  [![Test Status](https://github.com/kkomelin/isomorphic-dompurify/actions/workflows/build_test.yml/badge.svg)](https://github.com/kkomelin/isomorphic-dompurify/actions/workflows/build_test.yml)
4
4
 
5
- The library makes it possible to seamlessly use [DOMPurify](https://github.com/cure53/DOMPurify) on server and client in the same way.
6
- It does nothing by itself except providing an isomorphic/universal wrapper around DOMPurify, so all credits go to DOMPurify authors and contributors.
5
+ The library makes it possible to seamlessly use [DOMPurify](https://github.com/cure53/DOMPurify) on both server and client in the same way.
6
+ It does nothing by itself except for providing an isomorphic/universal wrapper around DOMPurify, so all credits go to DOMPurify authors and contributors.
7
7
 
8
8
  > DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks.
9
9
  - [DOMPurify Demo](https://cure53.de/purify)
@@ -11,9 +11,9 @@ It does nothing by itself except providing an isomorphic/universal wrapper aroun
11
11
 
12
12
  ## Motivation
13
13
 
14
- DOMPurify needs a DOM tree to base on, which is not available in Node by default. To work on the server side, we need a fake DOM to be created and supplied to DOMPurify. It means that DOMPurify initialization logic on the server is not the same as on the client.
14
+ DOMPurify needs a DOM tree to work with, which is not available in Node by default. To work on the server side, we need a fake DOM to be created and supplied to DOMPurify. It means that DOMPurify initialization logic on the server is not the same as on the client.
15
15
 
16
- This project was born with the idea of encapsulating DOMPurify initialization details and providing an easy way to import the library on both, server and client, for example in Next.js apps.
16
+ This project was born with the idea of encapsulating DOMPurify initialization details and providing an easy way to import the library on both server and client, for example in Next.js apps.
17
17
 
18
18
  It was inspired by [Isomorphic Unfetch](https://github.com/developit/unfetch/tree/master/packages/isomorphic-unfetch).
19
19
 
@@ -37,7 +37,7 @@ $ npm i isomorphic-dompurify
37
37
 
38
38
  ## Updates
39
39
 
40
- Please note that DOMPurify library [doesn't follow Semantic Versioning](https://github.com/cure53/DOMPurify/issues/446#issuecomment-643761433), so we have to release every change as a minor version because we cannot be 100% sure whether new features are added to patch DOMPurify releases or not.
40
+ Please note that the DOMPurify library [doesn't follow Semantic Versioning](https://github.com/cure53/DOMPurify/issues/446#issuecomment-643761433), so we have to release every change as a minor version because we cannot be 100% sure whether new features are added to patch DOMPurify releases or not.
41
41
 
42
42
  ## Usage
43
43
 
@@ -47,7 +47,7 @@ import DOMPurify from "isomorphic-dompurify";
47
47
  const clean = DOMPurify.sanitize(dirtyString);
48
48
  ```
49
49
 
50
- You can pass [config](https://github.com/cure53/DOMPurify/blob/main/README.md) as a second argument:
50
+ You can pass the [config](https://github.com/cure53/DOMPurify/blob/main/README.md) as a second argument:
51
51
  ```javascript
52
52
  const clean = DOMPurify.sanitize(dirtyString, { USE_PROFILES: { html: true } });
53
53
  ```
@@ -86,6 +86,10 @@ however, `dompurify`, which it depends upon, [is not, at least not yet](https://
86
86
 
87
87
  Want to try `isomorphic-dompurify` with your favorite framework? Check out [isomorphic-dompurify-playgrounds](https://github.com/kkomelin/isomorphic-dompurify-playgrounds) — minimal setups for popular frameworks including Astro, Next.js, Nuxt, React and Svelte.
88
88
 
89
+ ## Known Issues
90
+
91
+ - **ERR_REQUIRE_ESM in CommonJS environments (v3.0.0+):** `jsdom@28` pulls in an ESM-only dependency that breaks `require()` in environments like Next.js on Vercel. Workaround: pin `jsdom` to `25.0.1` via package manager overrides. See [#394](https://github.com/kkomelin/isomorphic-dompurify/issues/394).
92
+
89
93
  ## License
90
94
 
91
95
  DOMPurify -
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "isomorphic-dompurify",
3
- "version": "3.0.0",
3
+ "version": "3.1.0",
4
4
  "description": "Makes it possible to use DOMPurify on server and client in the same way.",
5
5
  "keywords": [
6
6
  "security",
@@ -56,17 +56,17 @@
56
56
  }
57
57
  },
58
58
  "dependencies": {
59
- "dompurify": "^3.3.1",
60
- "jsdom": "^28.0.0"
59
+ "dompurify": "^3.3.2",
60
+ "jsdom": "^28.1.0"
61
61
  },
62
62
  "devDependencies": {
63
- "@biomejs/biome": "^2.4.2",
64
- "@types/jsdom": "^27.0.0",
63
+ "@biomejs/biome": "^2.4.6",
64
+ "@types/jsdom": "^28.0.0",
65
65
  "@types/trusted-types": "^2.0.7",
66
- "lefthook": "^2.1.1",
66
+ "lefthook": "^2.1.3",
67
67
  "tsup": "^8.5.1",
68
68
  "typescript": "^5.9.3",
69
- "vitest": "^4.0.16"
69
+ "vitest": "^4.0.18"
70
70
  },
71
71
  "engines": {
72
72
  "node": "^20.19.0 || ^22.12.0 || >=24.0.0"