sanitize-html - npm Package Versions

1.25.0:

• Adds enforceHtmlBoundary option to process code bounded by the html tag, discarding any code outside of those tags.
• Migrates to the main lodash package from the per method packages since they are deprecated and cause code duplication. Thanks to Merceyz for the contribution.
• Adds a warning when style and script tags are allowed, as they are inherently vulnerable to being used in XSS attacks. That warning can be disabled by including the option allowVulnerableTags: true so this choice is knowing and explicit.

1.24.0:

• Fixes a bug where self-closing tags resulted in deletion with disallowedTagsMode: 'escape' set. Thanks to Thiago Negri for the contribution.
• Adds abbr to the default allowedTags for better accessibility support. Thanks to Will Farrell for the contribution.
• Adds a mediaChildren property to the frame object in custom filters. This allows you to check for links or other parent tags that contain self-contained media to prevent collapse, regardless of whether there is also text inside. Thanks to axdg for the initial implementation and Marco Arduini for a failing test contribution.

1.23.0:

• Adds eslint configuration and adds eslint to test script.
• Sets sideEffects: false on package.json to allow module bundlers like webpack tree-shake this module and all the dependencies from client build. Thanks to Egor Voronov for the contribution.
• Adds the tagName (HTML element name) as a second parameter passed to textFilter. Thanks to Slava for the contribution.

1.22.1:

ncreases the patch version of lodash.mergewith to enforce an audit fix.

1.22.0:

bumped htmlparser2 dependency to the 4.x series. This fixes longstanding bugs and should cause no bc breaks for this module, since the only bc breaks upstream are in regard to features we don't expose in this module.

1.21.1:

fixed issue with bad main setting in package.json that broke 1.21.0.

1.21.0:

new disallowedTagsMode option can be set to escape to escape disallowed tags rather than discarding them. Any subtags are handled as usual. If you want to recursively escape them too, you can set disallowedTagsMode to recursiveEscape. Thanks to Yehonatan Zecharia for this contribution.

1.20.1:

Fix failing tests, add CircleCI config

1.20.0:

reduced size of npm package via the files key; we only need to publish what's in dist. Thanks to Steven. There should be zero impact on behavior, minor version bump is precautionary.

1.19.3:

reverted to postcss due to a reported issue with css-tree that might or might not have XSS implications.