[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: dompurify and qs.

Updates dompurify from 3.4.16 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

• Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
• Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
• Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
• Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
• Added a purify-edge test runner as a compatibility check, thanks @​anzal1
• Clarified the IN_PLACE documentation in the README about possible risks
• Updated several dependencies

Commits

• a77a3e7 release: 3.4.17 (#1672)
• See full diff in compare view

Updates qs from 6.16.0 to 6.17.1

Changelog

Sourced from qs's changelog.

6.17.1

• [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as surrogate pairs (#640)
• [Fix] parse: respect plainObjects for [] with parseArrays: false (#639)
• [Fix] utils: merge: count the elements of a sparse array against arrayLimit, not its holes
• [Fix] parse: guard bracket-wrapped prototype keys at depth 0 (#638)
• [Refactor] parse: extract wrapping-bracket stripping helper
• [readme] document that depth: 0 and depth: false keep keys flat
• [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by allowPrototypes/plainObjects

6.17.0

• [New] stringify: add WHATWG format (#623)
• [Fix] stringify: do not sort the caller's filter array in place (#637)
• [Fix] parse: copy an own __proto__ key as data (#636)
• [Fix] parse: decode percent-encoded dots case-insensitively (#635)
• [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
• [Fix] parse: preserve comma arrays when interpreting numeric entities (#630)
• [Fix] parse: allow scalar fields with a zero array limit (#627)
• [Fix] parse: do not count an existing comma array toward arrayLimit when duplicates discards or replaces it
• [Fix] utils: encode: encode lone surrogates as U+FFFD instead of consuming the next code unit (#624)
• [eslint] fix indentation
• [readme] document the encoder's format argument
• [meta] add changelog acknowledgement
• [meta] fix changelog indents
• [Dev Deps] update eslint, evalmd, npmignore
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding
• [Tests] stringify: pin sort order for nested keys selected by an array filter
• [Tests] parse: cover interpretNumericEntities across value shapes, keys, and the charset sentinel
• [Tests] parse: cover more input that builds no array at a zero or negative arrayLimit
• [Tests] parse: cover comma with a zero or negative arrayLimit, and combining a full comma array
• [Tests] parse: pin the behavior of a zero or negative arrayLimit
• [Tests] utils/stringify: pin ~, *, and parens encoding in RFC3986 and RFC1738

6.16.2

• [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
• [meta] use double quotes for better OS support
• [Dev Deps] update evalmd, npmignore
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

6.16.1

• [Fix] parse: do not mutate an object input
• [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
• [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
• [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
• [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
• [Fix] stringify: ignore inherited array format names (#622)
• [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
• [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
• [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
• [Fix] parse: only treat [] as array syntax when it ends the key
• [Perf] decode: skip decoders when there is no percent sign (#583)

... (truncated)

Commits

• 43baea4 v6.17.1
• 54623b6 [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as...
• 7924b65 [Fix] parse: respect plainObjects for [] with parseArrays: false
• 7d4b440 [readme] document that depth: 0 and depth: false keep keys flat
• 101492a [Fix] utils: merge: count the elements of a sparse array against `arrayLi...
• 42eccf0 [Fix] parse: guard bracket-wrapped prototype keys at depth 0
• ae0b5c7 [Refactor] parse: extract wrapping-bracket stripping helper
• 6459f9f [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by `al...
• cb6855c Merge backport release tags v6.12.6–v6.16.2 into main
• 136912a v6.16.2
• Additional commits viewable in compare view