[dependabot]

Bumps xss from 1.0.15 to 1.0.17.

Changelog

Sourced from xss's changelog.

v1.0.17 (2026-10-24)

• fix: use the default callback when escapeHtml, onTag, onTagAttr, onIgnoreTag, onIgnoreTagAttr or safeAttrValue is null, undefined, or not a function. An own function still overrides the default, and inherited properties are still ignored (#304).
• fix: filterXSSWithResult() copies only own option properties, so a polluted prototype can no longer supply callbacks.
• fix: treat null and undefined whiteList / allowList as unset. An explicit object, including {}, is still used. When whiteList is unset, allowList is used; otherwise the default whitelist is used.

v1.0.16 (2026-10-20)

• fix: reject unsafe URL schemes in action and formaction when allowed by a custom whitelist. Form destinations now allow only HTTP(S) and relative URLs; other schemes, including javascript:, data:, mailto:, tel: and FTP, are rejected. The default whitelist is unaffected.
• fix: ignore inherited properties when reading sanitizer options and whitelists to prevent prototype pollution from overriding filtering behavior
• feat: add filterXSSWithResult() to return sanitized HTML and records of ignored tags and attributes, with TypeScript declarations (#297, #299, #300).
• ci: update GitHub Actions and tested Node.js versions

Commits

• a76f7f0 chore: bump version to 1.0.17 and update changelog
• ea1e567 fix: treat nullish whiteList and allowList as unset
• 82899dc fix: ignore inherited properties when copying filterXSSWithResult options
• d2289e8 fix: restore default callbacks when an option is not a function
• 9c79c9a chore: bump version to 1.0.16 and update changelog
• e482f3c fix: filter unsafe form action URL schemes
• 9b42221 feat: 审查合并代码 (#300)
• 30c3ff8 feat: add filterXSSWithResult to return removed elements (#299)
• a8fe38d feat: add filterXSSWithResult() to track removed tags and attributes (fixes #...
• 49197ba fix: 修复 XSS 库中的原型污染漏洞 (#298)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6fb08f8d-a106-4d1f-9586-5e00f7b208b4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn