[Snyk] Security upgrade dompurify from 2.0.7 to 2.2.3

[gmright2]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	611/1000 Why? Recently disclosed, Has a fix available, CVSS 6.5	Cross-site Scripting (XSS) SNYK-JS-DOMPURIFY-2863266	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: dompurify

The new version differs by 250 commits.

• e7086f7 chore: prepared 2.2.3 release
• 0c2edea fix: addressed an mXSS problem caused by nested headlines
• 2c0017c see Rename file logging from "ownCloud" to "file" nextcloud/server#490
• feeeaa9 docs: Changed granlem's URL
• 042dac1 docs: added a fellow sponsor to the README
• 89fee39 Fix [stable10] Use proper branding nextcloud/server#489
• 66de7be Merge branch 'main' of git@github.com:cure53/DOMPurify.git into main
• 185abbb Merge pull request [master] Use proper branding nextcloud/server#488 from jochenberger/patch-2
• 9dd85f4 Fix multi-license declaration
• 77d1281 Merge branch 'main' of git@github.com:cure53/DOMPurify.git into main
• 4aacbcd Merge pull request Use proper documentation links nextcloud/server#483 from yejiel/patch-1
• 25b269f Update license Header to match current Version
• b84f6ba fix: oh dear, reverted the code removal
• 4c8a84c chore: experimentally removed some possibly redundant mXSS check
• 7923e10 chore: Preparing 2.2.2 release
• 7719c5b test: Added test cases for reported bypasses
• e43de71 fix: squished another variation of the mXSS
• 0771f47 chore: Preparing 2.2.1 release
• ee33fae fix: Fixed a mXSS bypass reported in PostgreSQL: faulty database connection upon completing installation wizard nextcloud/server#482
• e95b0de see AppFramework default response for OCS is xml nextcloud/server#480
• 83b7acb See Implement brute force protection nextcloud/server#479
• 0e31dce chore: preparing 2.2.0 release
• 307c7d0 test: added tests to cover new RETURN_DOM_IMPORT default being true
• 5aab0bb fix: fixed a typo in the config option logic for DOM_RETURN_IMPORT

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)

[commit-lint]

Bug Fixes

• package.json & package-lock.json to reduce vulnerabilities (833867d)

Contributors

snyk-bot

Commit-Lint commands

You can trigger Commit-Lint actions by commenting on this PR:

• @Commit-Lint merge patch will merge dependabot PR on "patch" versions (X.X.Y - Y change)
• @Commit-Lint merge minor will merge dependabot PR on "minor" versions (X.Y.Y - Y change)
• @Commit-Lint merge major will merge dependabot PR on "major" versions (Y.Y.Y - Y change)
• @Commit-Lint merge disable will desactivate merge dependabot PR
• @Commit-Lint review will approve dependabot PR
• @Commit-Lint stop review will stop approve dependabot PR