Sandbox::https://github.com/cure53/DOMPurify/releases

@manus-pi

Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @manus-pi
Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @uttej-badwane
Fixed the SMIL attributeName guard in XHTML mode, thanks @Koukyosyumei
Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @Artiphishell
Added a purify-edge test runner as a compatibility check, thanks @anzal1
Clarified the IN_PLACE documentation in the README about possible risks
Updated several dependencies

@manus-pi

Fixed a problem with IN_PLACE node removal when working with hooks, thanks @manus-pi
Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @h-t-m
Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @ssi02014
Migrated from rollup to rolldown because performance, thanks @ssi02014
Bumped several dependencies where possible

@gnyselcuk

Added better clobbering hardening when XML content is involved, thanks @gnyselcuk
Added several smaller hardening and edge-case improvements, thanks @leechristensen
Bumped several dependencies where possible

@alirezarouhbakhsh

Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @alirezarouhbakhsh
Fixed a couple of edge cases with mixed document contexts, thanks @fishjojo1
Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @Jaybhade
Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
Updated the documentation in several spots, README, wiki, etc., thanks @Akokonunes
Updated several development dependencies and CI workflow actions

@koyokr

Fixed an issue with hook removal during IN_PLACE sanitization, thanks @koyokr
Fixed an issue with hooks potentially bypassing the clone guard, thanks @AkshayJainG
Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @AkshayJainG
Bumped several dependencies where possible

@Rikuxx0

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0
Hardened the handling of hooks removing elements, @mkrause-bee360
Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM
Hardened the handling of declarative partial updates
Updated the documentation is several spots, README, wiki, etc.
Bumped several dependencies where possible

@trace37labs

Fixed an issue with a leaky config for hooks via setConfig, thanks @trace37labs
Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
Updated up the linting tool-chain and removed now-redundant lint directives
Updated the documentation is several spots, README, wiki, etc.
Bumped several dependencies where possible

Refactored codebase for clarity: extracted the public type declarations into types.ts
Decomposed the three largest sanitizer functions into focused helpers
Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
Reduced CI cost by running the full three-engine browser suite once per PR
Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
Documented the bench and test:happydom scripts in the README
Completed the Attack Classes & Bypass History wiki page
Bumped several dependencies where possible

@offset

@fulstadev

Cleaned up the repository root, renamed some and removed unneeded files
Fixed an issue with handling of Trusted Types policies, thanks @fulstadev
Fixed the node iterator for better template scrubbing, thanks @IamLeandrooooo
Included formerly missing LICENSE-MPL in published npm package, thanks @asamuzaK
Bumped several dependencies where possible

Releases: cure53/DOMPurify