Removed BC3 reference.

while keeping QUnit and SauceLabs.

- SAUCE_REGION support to configure region
- tunnelIdentifier in sauce:options - to connect through the tunnel
- Local QUnit/fixtures serving - to avoid CDN issues through tunnel
- hostname: '0.0.0.0' - to allow Sauce Connect to reach WTR

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Co-Authored-By: Claude Opus 4.5 <[email protected]>

WTR doesn't support per-test progress reporting, so let's use a
middleware endpoint as a callback to emit minitest-style test status.

In CI, though, we'll continue to use the default reporter because we
want to see per-browser results (via Sauce Labs) and don't care about
realtime progress.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

…-wtr

Replace Karma with `@web/test-runner`

The leak checker is causing issues unless we externally set RACK_ENV,
see rails/rails#56563

and remove Ruby 3.2 testing against Rails main

without which the regeneration check fails

ci: get green (2026-01-09 edition)

Neglected to include failure reporting in c20a85d 😅

Report web-test-runner test failures

…-element

Fix bullets merging with prior elements on Firefox when the first node is removed

Update README.md

…H1 #3581911)

Strip `data-trix-serialized-attributes` in the DOMPurify `uponSanitizeAttribute`
hook before the `data-trix-*` force-keep logic runs.

This attribute is unique among `data-trix-*` attributes: it is the only one whose
value is later treated as trusted instructions to create arbitrary DOM attributes
via `el.setAttribute(name, value)` in the serialization code. No other `data-trix-*`
attribute has this XSS-enabling property:

- `data-trix-attachment` content is re-sanitized when rendered in AttachmentView
- `data-trix-attributes` is reduced to caption/presentation for attachment pieces
- The remaining internal markers (data-trix-id, data-trix-store-key, etc.) are
  stripped or regenerated during serialization and never reach an executable sink

The fix is therefore narrowly scoped to `data-trix-serialized-attributes`. The
legitimate producer (PreviewableAttachmentView) sets this attribute at runtime on
live DOM elements and never goes through DOMPurify, so it is unaffected.

Fix stored XSS via data-trix-serialized-attributes bypass