Bump dom-serializer from 1.3.2 to 2.0.0

[dependabot]

Bumps dom-serializer from 1.3.2 to 2.0.0.

Release notes

Sourced from dom-serializer's releases.

v2.0.0

Features

• Added a encodeEntities option with utf8 output (#685) c9abf30
• Added an ESM build (#684) 5426af3

Other changes

• Bump domhandler to 5.0.2, entities to 4.2.0 b0b31ab
• Added a regression test for XSS via missing attribute escaping (#441) dc550c2
• Switched to GitHub Actions bc838d5 414af03 96448fc
• Compute foreign name keys a956f87

New Contributors

• @​tosmolka made their first contribution in cheeriojs/dom-serializer#441
• @​alloystory made their first contribution in cheeriojs/dom-serializer#427

Full Changelog: cheeriojs/dom-serializer@v1.3.2...v2.0.0

v1.4.1

This is a re-release of 1.3.2. See the release notes of 1.4.0 for an explanation of why this was necessary.

v1.4.0

Note: This release unfortunately depends on the TypeScript types of [email protected] and should therefore have been a major release. Release 1.4.1 was published to fix this.

Commits

• add044a 2.0.0
• e6e2695 1.4.0
• 5a05207 Update docs
• c9abf30 feat: Add encodeEntities option with utf8 output (#685)
• 5426af3 feat: Add ESM build (#684)
• a956f87 refactor: Compute foreign name keys
• b0b31ab Bump domhandler to 5.0.2, entities to 4.2.0
• 5985a25 build(deps): bump domelementtype from 2.2.0 to 2.3.0 (#683)
• d31a071 build(deps-dev): bump @​typescript-eslint/parser from 5.17.0 to 5.18.0 (#681)
• a5edf58 build(deps-dev): bump @​typescript-eslint/eslint-plugin (#680)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[ledsoft]

/kbss-bot help

[kbss-bot]

SummarizePRAgent Report 🤖

🔍 PR Overview

Title: Bump dom-serializer from 1.3.2 to 2.0.0
Description: This Pull Request (PR) upgrades the dom-serializer library from version 1.3.2 to 2.0.0. The update includes new features, dependency bumps, and changes to how the library is tested and built, particularly with a focus on security.

🧐 Diff Summary

• Dependency Update:

  • Updated dom-serializer version from ^1.3.2 to ^2.0.0 in both package-lock.json and package.json.

• Feature Additions:

  • Added an encodeEntities option for utf8 output.
  • Introduced an ECMAScript Module (ESM) build.

• Dependencies:

  • Bumped the domhandler dependency from version 4.3.1 to 5.0.2.
  • Updated entities from 2.0.0 to 4.2.0.

• Testing and Build Enhancements:

  • Added regression tests for XSS vulnerability to ensure that the software can handle dangerous input correctly.
  • Switched to using GitHub Actions for Continuous Integration (CI).

• Miscellaneous Changes:

  • Code refactoring to compute foreign name keys more efficiently.

⚡️ Change Impact

Risks:

• The version bump may introduce breaking changes due to the major version upgrade of the domhandler dependency. Developer testing is advised to ensure compatibility with the rest of the application.
• New features could introduce unforeseen bugs.

Benefits:

• The new encodeEntities option increases functionality, allowing for better handling of character encoding.
• Including an ESM build improves compatibility with modern JavaScript applications, which aligns with current development standards.
• Improved security with the added regression tests helps to safeguard against XSS vulnerabilities.

✅ Final Verdict (Experimental)

The PR is ready to merge. It offers significant improvements, particularly in security and functionality, while modernizing the library’s build process. However, thorough testing should be conducted to ensure that the integration of these new features and the dependency upgrades do not disrupt existing functionalities. Consider adding appropriate tests to cover any new feature usage introduced in this update.

📋 Click to see available commands

🤖 PR Command List

Command	Description
/kbss-bot label	Label the current PR
/kbss-bot summarize	Generates a concise summary of the current PR changes

[ledsoft]

/kbss-bot summarize