Visitar URL original
release: 3.4.16 (#1636) · cure53/DOMPurify@b9b9d80 · GitHub
Skip to content

Commit b9b9d80

Browse files
authored
release: 3.4.16 (#1636)
1 parent 1d7460c commit b9b9d80

27 files changed

Lines changed: 9487 additions & 9849 deletions

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,14 +50,14 @@ jobs:
5050

5151
# Initializes the CodeQL tools for scanning.
5252
- name: Initialize CodeQL
53-
uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
53+
uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
5454
with:
5555
languages: ${{ matrix.language }}
5656

5757
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
5858
# If this step fails, then you should remove it and run the build manually (see below)
5959
- name: Autobuild
60-
uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
60+
uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
6161

6262
# ℹ️ Command-line programs to run using the OS shell.
6363
# 📚 https://git.io/JvXDl
@@ -71,4 +71,4 @@ jobs:
7171
# make release
7272

7373
- name: Perform CodeQL Analysis
74-
uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
74+
uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0

‎.github/workflows/scorecard.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,6 @@ jobs:
9090
# Upload the results to GitHub's code scanning dashboard (optional).
9191
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
9292
- name: "Upload to code-scanning"
93-
uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
93+
uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
9494
with:
9595
sarif_file: results.sarif

‎README.md‎

Lines changed: 26 additions & 6 deletions
Large diffs are not rendered by default.

‎config/rolldown.config.js‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
const fs = require('fs');
2+
const { DEFAULT_EXTENSIONS } = require('@babel/core');
3+
const babel = require('@rollup/plugin-babel').babel;
4+
const { dts } = require('rolldown-plugin-dts');
5+
const pkg = require('../package.json');
6+
7+
const env = process.env.NODE_ENV;
8+
const version = process.env.npm_package_version;
9+
const license = fs
10+
.readFileSync('./src/license_header', 'utf8')
11+
.replace(/VERSION/gi, version);
12+
13+
const experimental = { attachDebugInfo: 'none' };
14+
15+
const commonOutputConfig = {
16+
name: 'DOMPurify',
17+
sourcemap: true,
18+
banner: license,
19+
exports: 'default',
20+
sourcemapExcludeSources: true,
21+
};
22+
23+
// The source is ESM, so it has always executed in strict mode, and Rollup put
24+
// `'use strict'` inside the format wrapper of every non-ESM bundle to keep it
25+
// that way. Rolldown's `transform.target` equivalent here is `output.strict`,
26+
// but that hoists the directive *above* the UMD wrapper, making the whole
27+
// script strict and leaking that to anything concatenated after it. `intro`
28+
const useStrict = { intro: "'use strict';" };
29+
30+
const bundleOutputs = {
31+
umd: {
32+
...commonOutputConfig,
33+
...useStrict,
34+
file: pkg.browser,
35+
format: 'umd',
36+
},
37+
'umd-min': {
38+
...commonOutputConfig,
39+
...useStrict,
40+
file: pkg.production,
41+
format: 'umd',
42+
// Oxc's minifier defaults to `esnext` and would re-introduce `||=` / `?.`
43+
// into code Babel already down-levelled for the `.babelrc` browsers.
44+
minify: { compress: { target: 'es2015' } },
45+
},
46+
es: { ...commonOutputConfig, file: pkg.module, format: 'es' },
47+
cjs: { ...commonOutputConfig, ...useStrict, file: pkg.main, format: 'cjs' },
48+
};
49+
50+
const target = process.env.DOMPURIFY_BUILD_TARGET;
51+
52+
if (target && !bundleOutputs[target]) {
53+
throw new Error(`Unknown DOMPURIFY_BUILD_TARGET: ${target}`);
54+
}
55+
56+
const bundle = {
57+
input: 'src/purify.ts',
58+
external: [],
59+
experimental,
60+
plugins: [
61+
babel({
62+
babelHelpers: 'bundled',
63+
exclude: ['**/node_modules/**'],
64+
extensions: [...DEFAULT_EXTENSIONS, '.ts'],
65+
presets: ['@babel/preset-typescript'],
66+
}),
67+
],
68+
transform: {
69+
define: {
70+
'process.env.NODE_ENV': JSON.stringify(env) ?? 'undefined',
71+
VERSION: `'${version}'`,
72+
},
73+
},
74+
output: target ? [bundleOutputs[target]] : Object.values(bundleOutputs),
75+
};
76+
77+
const declarations = (file, plugins = []) => ({
78+
input: './dist/types/purify.d.ts',
79+
external: [/^[^.\/]/],
80+
experimental,
81+
output: [{ file, format: 'es', banner: license }],
82+
plugins: [...plugins, dts({ dtsInput: true })],
83+
});
84+
85+
module.exports = target
86+
? [bundle]
87+
: [
88+
bundle,
89+
// ESM type declarations
90+
declarations(pkg.module.replace(/\.mjs$/, '.d.mts')),
91+
// CJS type declarations with named export stripping
92+
declarations(pkg.main.replace(/\.js$/, '.d.ts')),
93+
];

‎config/rolldown.coverage.config.js‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
// Coverage-only rolldown config. Builds an istanbul-instrumented CJS bundle so
2+
// the jsdom test run records line/branch coverage mapped to the original
3+
// src/*.ts.
4+
//
5+
// Important: TypeScript stripping and istanbul instrumentation happen in a
6+
// SINGLE babel pass (via @babel/preset-typescript), not as two separate
7+
// transforms. A two-pass setup (a TypeScript transform then babel) makes
8+
// istanbul record positions against the already-transpiled JS, so the report
9+
// points at the wrong lines. With one pass, babel keeps the original source
10+
// positions and coverage maps exactly onto the .ts files. Rolldown's own oxc
11+
// pass only reprints what babel already instrumented, so the recorded
12+
// positions are unaffected.
13+
//
14+
// This config is not used by the normal build or any workflow; it is driven
15+
// only by the local `npm run coverage` script.
16+
const { DEFAULT_EXTENSIONS } = require('@babel/core');
17+
const babel = require('@rollup/plugin-babel').babel;
18+
19+
module.exports = {
20+
input: 'src/purify.ts',
21+
// Rolldown resolves the source's `.js` import specifiers (e.g. './tags.js')
22+
// to their real `.ts` files on its own, so no resolver plugin is needed here.
23+
transform: {
24+
define: {
25+
'process.env.NODE_ENV': JSON.stringify('test'),
26+
VERSION: "'coverage'",
27+
},
28+
},
29+
experimental: { attachDebugInfo: 'none' },
30+
output: {
31+
file: 'dist/purify.cov.cjs.js',
32+
format: 'cjs',
33+
name: 'DOMPurify',
34+
exports: 'default',
35+
sourcemap: true,
36+
},
37+
plugins: [
38+
babel({
39+
babelHelpers: 'bundled',
40+
babelrc: false,
41+
configFile: false,
42+
extensions: [...DEFAULT_EXTENSIONS, '.ts'],
43+
presets: [
44+
['@babel/preset-env', { targets: { node: 'current' }, modules: false }],
45+
'@babel/preset-typescript',
46+
],
47+
plugins: ['istanbul'],
48+
}),
49+
],
50+
};

‎config/rollup.config.js‎

Lines changed: 0 additions & 112 deletions
This file was deleted.

‎config/rollup.coverage.config.js‎

Lines changed: 0 additions & 67 deletions
This file was deleted.

0 commit comments

Comments
 (0)