Update dependencies and refactor DOMPurify usage to default import #2606
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull Request Overview
This PR upgrades the DOMPurify dependency to address security vulnerabilities while refactoring the import style to use the new default import syntax, as well as updating ES targets and other dependencies to support modern features and CI improvements.
- Refactored DOMPurify imports and usage in multiple files
- Upgraded dependencies (DOMPurify, grunt-cli, grunt-env) and updated ES target from ES5 to ES2017
- Modified test configurations including Karma and GitHub Workflow adjustments
Reviewed Changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| src/ui/box/chrome.jsx | Refactored DOMPurify import and usage in React components |
| src/sanitizer.js | Updated addHook usage to use DOMPurify.default import |
| src/i18n.js | Replaced named import sanitize with DOMPurify.sanitize in HTML rendering |
| src/connection/database/actions.js | Updated sanitization call to use DOMPurify and improved safety with config |
| package.json | Upgraded dependencies and changed ES target for compatibility |
| karma.conf.js | Adjusted browser configurations for CI (added no-sandbox flag) |
| .github/workflows/test.yml | Added CI environment variable for running end-to-end tests |
…n CI configuration
gyaneshgouraw-okta
approved these changes
May 26, 2025
Merged
developerkunal
added a commit
that referenced
this pull request
Jun 2, 2025
**⚠️ BREAKING CHANGES** - Dropped support for Internet Explorer (IE). - Update dependencies and refactor DOMPurify usage to default import [\#2606](#2606) ([developerkunal](https://github.com/developerkunal)) **Added** - Add support for social connection Sign in with Shop [\#2602](#2602) ([reinisb](https://github.com/reinisb))
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
Upgraded
dompurifyfrom2.5.4to3.2.5to address known security vulnerabilities.DOMPurify v3 introduced breaking changes, including:
sanitizeRefactored all DOMPurify imports to use the new default import syntax (
import DOMPurify from 'dompurify').Updated all sanitization calls to use
DOMPurify.sanitize(...)for consistency and compatibility.Updated ES target from ES5 to ES2017 to enable modern features like async/await, improve compatibility, and drop IE11 support for cleaner, more performant code.
Modified the following files:
src/connection/database/actions.jssrc/i18n.jssrc/sanitizer.jssrc/ui/box/chrome.jsxAlso upgraded the following dependencies:
grunt-clifrom0.1.13to1.5.0grunt-envfrom0.4.4to1.0.1References
Testing
Verified that the DOMPurify import refactor works correctly in all affected files.
Ran the full test suite to confirm no regressions.
This change adds unit test coverage
This change adds integration test coverage
This change has been tested on the latest version of the platform/language
Checklist