Skip to content

Bump the dependencies of #5983 and bundle sanitize-html for webpack 4 and Jest - #5987

Merged
Eugene (OEvgeny) merged 7 commits into
mainfrom
OEvgeny/fix-deps-oct
Oct 31, 2026
Merged

Bump the dependencies of #5983 and bundle sanitize-html for webpack 4 and Jest#5987
Eugene (OEvgeny) merged 7 commits into
mainfrom
OEvgeny/fix-deps-oct

Conversation

@OEvgeny

@OEvgeny Eugene (OEvgeny) commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Supersedes #5983 (Dependabot, 21 updates), which fails the webpack 4 bundler tests and the unit tests.

Changelog Entry

Changed

Description

sanitize-html@2.17.6 and later depend on htmlparser2@12, which is ESM-only and ships class fields, ?. and ?? (with domhandler, domutils, dom-serializer and entities): webpack 4 cannot parse them and Jest cannot require() them. This takes the 21 updates of #5983, bundles sanitize-html into the npm package (its CommonJS build is lowered to ES2019 like the rest of it), and adapts the embed tests to happy-dom@21.

Design

  • Bundled sanitize-html like shiki and uuid (noExternal), so webpack 4 and Jest apps need no new setup; in exchange, overrides of sanitize-html no longer reach our npm build (as already for webchat.js), so its security fixes ship in our releases; holding it at 2.17.5 would skip the fixes in 2.17.6–2.18.1, and adding 4 packages to the webpack 4 workarounds in HOSTING.md would break existing webpack 4 apps on upgrade.
  • Embed tests turn on enableIframePageLoading, which happy-dom@21 disabled by default, to keep the behavior of happy-dom@20.

Specific Changes

  • Dependabot's commit from Bump the npm_and_yarn group across 6 directories with 21 updates #5983, unchanged

  • packages/bundle/tsup.config.ts: sanitize-html in noExternal

  • packages/embed/src/setups/{aries,legacy,loadIFRAME,scorpio}.spec.js: enableIframePageLoading for happy-dom@21

  • I have added tests and executed them locally

  • I have added .changelog/<PR#>-<slug>.md

  • I have updated documentation

Review Checklist

This section is for contributors to review your work.

  • Accessibility reviewed (tab order, content readability, alt text, color contrast)
  • Browser and platform compatibilities reviewed
  • CSS styles reviewed (minimal rules, no z-index)
  • Documents reviewed (docs, samples, live demo)
  • Internationalization reviewed (strings, unit formatting)
  • package.json and package-lock.json reviewed
  • Security reviewed (no data URIs, check for nonce leak)
  • Tests reviewed (coverage, legitimacy)

dependabot Bot and others added 5 commits October 30, 2026 10:59
@dependabot Eugene Olonov
Bump the npm_and_yarn group across 6 directories with 21 updates
25758dc 
Bumps the npm_and_yarn group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` |
| [adm-zip](https://github.com/cthackers/adm-zip) | `0.5.17` | `0.6.1` |
| [katex](https://github.com/KaTeX/KaTeX) | `0.17.0` | `0.19.1` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.4` | `2.18.1` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.15` | `1.1.21` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.2` | `3.15.2` |
| [axios](https://github.com/axios/axios) | `1.16.1` | `1.21.0` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.9.10` | `2.11.34` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.29.5` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.9` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.16.0` | `1.16.2` |
| [happy-dom](https://github.com/capricorn86/happy-dom) | `20.9.0` | `21.0.4` |
| [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `7.1.0` | `7.1.7` |
| [proxy-addr](https://github.com/jshttp/proxy-addr) | `2.0.7` | `2.0.8` |
| [qs](https://github.com/ljharb/qs) | `6.15.2` | `6.17.1` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.4` | `1.12.0` |
| [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` |
| [zod](https://github.com/colinhacks/zod) | `4.2.1` | `4.6.7` |

Bumps the npm_and_yarn group with 2 updates in the /packages/bundle directory: [katex](https://github.com/KaTeX/KaTeX) and [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html).
Bumps the npm_and_yarn group with 1 update in the /packages/support/cldr-data-downloader directory: [adm-zip](https://github.com/cthackers/adm-zip).
Bumps the npm_and_yarn group with 4 updates in the /samples directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [source-map-js](https://github.com/7rulnik/source-map-js), [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) and [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core).
Bumps the npm_and_yarn group with 4 updates in the /samples/01.getting-started/k.direct-line-token/javascript/bot directory: [axios](https://github.com/axios/axios), [follow-redirects](https://github.com/follow-redirects/follow-redirects), [qs](https://github.com/ljharb/qs) and [csv-parse](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-parse).
Bumps the npm_and_yarn group with 3 updates in the /samples/01.getting-started/k.direct-line-token/javascript/web directory: [follow-redirects](https://github.com/follow-redirects/follow-redirects), [qs](https://github.com/ljharb/qs) and [csv-parse](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-parse).


Updates `compression` from 1.8.1 to 1.8.2
- [Release notes](https://github.com/expressjs/compression/releases)
- [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md)
- [Commits](expressjs/compression@v1.8.1...v1.8.2)

Updates `adm-zip` from 0.5.17 to 0.6.1
- [Release notes](https://github.com/cthackers/adm-zip/releases)
- [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md)
- [Commits](cthackers/adm-zip@v0.5.17...v0.6.1)

Updates `katex` from 0.17.0 to 0.19.1
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.17.0...v0.19.1)

Updates `sanitize-html` from 2.17.4 to 2.18.1
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.18.1/packages/sanitize-html)

Updates `brace-expansion` from 1.1.15 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.21)

Updates `js-yaml` from 3.14.2 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.2...3.15.2)

Updates `axios` from 1.16.1 to 1.21.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.1...v1.21.0)

Updates `baseline-browser-mapping` from 2.9.10 to 2.11.34
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.9.10...v2.11.34)

Updates `browserslist` from 4.28.1 to 4.29.5
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.1...4.29.5)

Updates `fast-uri` from 3.1.2 to 3.1.9
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.9)

Updates `follow-redirects` from 1.16.0 to 1.16.2
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.16.0...v1.16.2)

Updates `happy-dom` from 20.9.0 to 21.0.4
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v20.9.0...v21.0.4)

Updates `postcss-selector-parser` from 7.1.0 to 7.1.7
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@v7.1.0...7.1.7)

Updates `proxy-addr` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/jshttp/proxy-addr/releases)
- [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md)
- [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8)

Updates `qs` from 6.15.2 to 6.17.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.2...v6.17.1)

Updates `shell-quote` from 1.8.4 to 1.12.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.12.0)

Updates `source-map-js` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2)

Updates `zod` from 4.2.1 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.2.1...v4.6.7)

Updates `katex` from 0.17.0 to 0.19.1
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.17.0...v0.19.1)

Updates `sanitize-html` from 2.17.4 to 2.18.1
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.18.1/packages/sanitize-html)

Updates `adm-zip` from 0.5.17 to 0.6.1
- [Release notes](https://github.com/cthackers/adm-zip/releases)
- [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md)
- [Commits](cthackers/adm-zip@v0.5.17...v0.6.1)

Updates `brace-expansion` from 1.1.15 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.21)

Updates `source-map-js` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2)

Updates `@angular/common` from 21.2.15 to 22.2.4
- [Release notes](https://github.com/angular/angular/releases)
- [Commits](https://github.com/angular/angular/commits/v22.2.4/packages/common)

Updates `@angular/core` from 21.2.15 to 22.2.4
- [Release notes](https://github.com/angular/angular/releases)
- [Commits](https://github.com/angular/angular/commits/v22.2.4/packages/core)

Updates `axios` from 1.16.1 to 1.21.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.1...v1.21.0)

Updates `follow-redirects` from 1.16.0 to 1.16.2
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.16.0...v1.16.2)

Updates `qs` from 6.15.2 to 6.17.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.2...v6.17.1)

Updates `csv-parse` from 6.1.0 to 7.0.3
- [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-parse/CHANGELOG.md)
- [Commits](https://github.com/adaltas/node-csv/commits/csv-parse@7.0.3/packages/csv-parse)

Updates `follow-redirects` from 1.16.0 to 1.16.2
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.16.0...v1.16.2)

Updates `qs` from 6.15.2 to 6.17.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.2...v6.17.1)

Updates `csv-parse` from 6.1.0 to 7.0.3
- [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-parse/CHANGELOG.md)
- [Commits](https://github.com/adaltas/node-csv/commits/csv-parse@7.0.3/packages/csv-parse)

---
updated-dependencies:
- dependency-name: compression
  dependency-version: 1.8.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: adm-zip
  dependency-version: 0.6.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: katex
  dependency-version: 0.19.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: sanitize-html
  dependency-version: 2.18.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.21.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.34
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: happy-dom
  dependency-version: 21.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: proxy-addr
  dependency-version: 2.0.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.17.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: shell-quote
  dependency-version: 1.12.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: katex
  dependency-version: 0.19.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: sanitize-html
  dependency-version: 2.18.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: adm-zip
  dependency-version: 0.6.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@angular/common"
  dependency-version: 22.2.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@angular/core"
  dependency-version: 22.2.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.21.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.17.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: csv-parse
  dependency-version: 7.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.17.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: csv-parse
  dependency-version: 7.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Eugene Olonov
Bundle sanitize-html into the npm package for webpack 4 and CommonJS …
629fae1 
…consumers

sanitize-html@2.17.6+ depends on htmlparser2@11+, which is ESM-only and ships class fields, ?. and ?? (also in domhandler, domutils, dom-serializer and entities): webpack 4 cannot parse them and Jest cannot require() them.
Eugene Olonov
Enable iframe page loading in embed tests for happy-dom 21
e12ae79 
happy-dom@21 disables iframe page loading by default and fires "error" on every <iframe>, which rejects loadIFRAME() before the tests fire "load".
Eugene Olonov
Fix htmlparser2 version in the sanitize-html comment
17b1f85
Eugene Olonov
Add the changelog fragment
fd2c0f6
@OEvgeny Eugene (OEvgeny) mentioned this pull request Oct 30, 2026
Closed
@OEvgeny
Eugene (OEvgeny) marked this pull request as ready for review October 30, 2026 23:14
Copilot AI balanced review requested due to automatic review settings October 30, 2026 23:14
Copilot AI reviewed Oct 30, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

@OEvgeny
Eugene (OEvgeny) merged commit 75b7cd9 into main Oct 31, 2026
45 checks passed
@OEvgeny
Eugene (OEvgeny) deleted the OEvgeny/fix-deps-oct branch October 31, 2026 01:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@compulim William Wong (compulim) compulim approved these changes
@cwhitten Chris Whitten (cwhitten) Awaiting requested review from cwhitten cwhitten is a code owner
@tdurnford Thomas Durnford (tdurnford) Awaiting requested review from tdurnford tdurnford is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@OEvgeny @compulim