- Fixed a
SAFE_FOR_TEMPLATESbypass where the final scrub cut through tags and let a template expression form on reparse, thanks @e1abrador - Fixed a direct property read in the clobbering check, thanks @trace37labs
- Removed several entries from the SVG tag allow-list that are attributes and not elements, thanks @hackvertor
- Added a console warning when
USE_PROFILESis combined withALLOWED_TAGSorALLOWED_ATTR, thanks @rugk - Refactored the code base: removed dead code and redundant helpers, shortened comments
- Fixed a hook-widened allow-list carrying over when the config object received by a hook was passed back to
sanitize() - Documented that the content of closed shadow roots cannot be sanitized (README and wiki)
- Updated the README, the wiki and the list of contributors
- Updated several dependencies