dependabot[bot] opened a new pull request, #45811: URL: https://github.com/apache/superset/pull/45811
Bumps [xss](https://github.com/leizongmin/js-xss) from 1.0.15 to 1.0.16. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/leizongmin/js-xss/blob/master/CHANGELOG.md";>xss's changelog</a>.</em></p> <blockquote> <h2>v1.0.16 (2026-10-20)</h2> <ul> <li>fix: reject unsafe URL schemes in <code>action</code> and <code>formaction</code> when allowed by a custom whitelist. Form destinations now allow only HTTP(S) and relative URLs; other schemes, including <code>javascript:</code>, <code>data:</code>, <code>mailto:</code>, <code>tel:</code> and FTP, are rejected. The default whitelist is unaffected.</li> <li><a href="https://redirect.github.com/leizongmin/js-xss/pull/298";>fix: ignore inherited properties when reading sanitizer options and whitelists to prevent prototype pollution from overriding filtering behavior</a></li> <li>feat: add <code>filterXSSWithResult()</code> to return sanitized HTML and records of ignored tags and attributes, with TypeScript declarations (<a href="https://redirect.github.com/leizongmin/js-xss/pull/297";>#297</a>, <a href="https://redirect.github.com/leizongmin/js-xss/pull/299";>#299</a>, <a href="https://redirect.github.com/leizongmin/js-xss/pull/300";>#300</a>).</li> <li><a href="https://redirect.github.com/leizongmin/js-xss/pull/296";>ci: update GitHub Actions and tested Node.js versions</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/leizongmin/js-xss/commit/9c79c9a2b8db323b791504281bee319731216f7e";><code>9c79c9a</code></a> chore: bump version to 1.0.16 and update changelog</li> <li><a href="https://github.com/leizongmin/js-xss/commit/e482f3ca337a2a3ac21159e8f0b929d5d73fb1d8";><code>e482f3c</code></a> fix: filter unsafe form action URL schemes</li> <li><a href="https://github.com/leizongmin/js-xss/commit/9b42221ebf1e0eef7783ae782e2d8262a482a373";><code>9b42221</code></a> feat: 审查合并代码 (<a href="https://redirect.github.com/leizongmin/js-xss/issues/300";>#300</a>)</li> <li><a href="https://github.com/leizongmin/js-xss/commit/30c3ff8a4a96e02cc3f9960e2ed2cc413f414d6c";><code>30c3ff8</code></a> feat: add filterXSSWithResult to return removed elements (<a href="https://redirect.github.com/leizongmin/js-xss/issues/299";>#299</a>)</li> <li><a href="https://github.com/leizongmin/js-xss/commit/a8fe38da38969245e6fe2549d6b6057c33d2659a";><code>a8fe38d</code></a> feat: add filterXSSWithResult() to track removed tags and attributes (fixes #...</li> <li><a href="https://github.com/leizongmin/js-xss/commit/49197bac72d7db5aa9d1850aafb11c9f9c10fd2d";><code>49197ba</code></a> fix: 修复 XSS 库中的原型污染漏洞 (<a href="https://redirect.github.com/leizongmin/js-xss/issues/298";>#298</a>)</li> <li><a href="https://github.com/leizongmin/js-xss/commit/a302de7ed4fb5285752e7575fb4be840873a68f6";><code>a302de7</code></a> ci: update actions and Node.js versions (<a href="https://redirect.github.com/leizongmin/js-xss/issues/296";>#296</a>)</li> <li><a href="https://github.com/leizongmin/js-xss/commit/66df7c48d5280de27b787169165afc4ea850cda4";><code>66df7c4</code></a> Update CHANGELOG.md</li> <li>See full diff in <a href="https://github.com/leizongmin/js-xss/compare/v1.0.15...v1.0.16";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
