From 81c18e2f699f2053596ba0dcfd6029ffc93b31c8 Mon Sep 17 00:00:00 2001
From: Michael Roberson <michaelroberson@gmail.com>
Date: Thu, 16 Jul 2026 04:34:08 -0400
Subject: [PATCH 1/2] fix: remove stray punctuation from malformed To HTML
 Entity table values (#2660)

---
 src/core/operations/ToHTMLEntity.mjs |  6 ++---
 tests/node/index.mjs                 |  1 +
 tests/node/tests/ToHTMLEntity.mjs    | 33 ++++++++++++++++++++++++++++
 3 files changed, 37 insertions(+), 3 deletions(-)
 create mode 100644 tests/node/tests/ToHTMLEntity.mjs

diff --git a/src/core/operations/ToHTMLEntity.mjs b/src/core/operations/ToHTMLEntity.mjs
index f2a57a4328..75a82018f6 100644
--- a/src/core/operations/ToHTMLEntity.mjs
+++ b/src/core/operations/ToHTMLEntity.mjs
@@ -405,7 +405,7 @@ const byteToEntity = {
     989: "&gammad;",
     1008: "&kappav;",
     1009: "&rhov;",
-    1013: "&epsi;,",
+    1013: "&epsi;",
     1014: "&bepsi;",
     1025: "&IOcy;",
     1026: "&DJcy;",
@@ -660,7 +660,7 @@ const byteToEntity = {
     8649: "&rrarr;",
     8650: "&ddarr;",
     8651: "&lrhar;",
-    8652: "&rlhar;;",
+    8652: "&rlhar;",
     8653: "&nlArr;",
     8654: "&nhArr;",
     8655: "&nrArr;",
@@ -782,7 +782,7 @@ const byteToEntity = {
     8814: "&nlt;",
     8815: "&ngt;",
     8816: "&nle;",
-    8817: "&nge;;",
+    8817: "&nge;",
     8818: "&lsim;",
     8819: "&gsim;",
     8820: "&nlsim;",
diff --git a/tests/node/index.mjs b/tests/node/index.mjs
index 360bf481de..e53ca7b21e 100644
--- a/tests/node/index.mjs
+++ b/tests/node/index.mjs
@@ -24,6 +24,7 @@ import "./tests/Dish.mjs";
 import "./tests/NodeDish.mjs";
 import "./tests/Utils.mjs";
 import "./tests/Categories.mjs";
+import "./tests/ToHTMLEntity.mjs";
 import "./tests/lib/BigIntUtils.mjs";
 import "./tests/lib/ChartsProtocolPrototypePollution.mjs";
 
diff --git a/tests/node/tests/ToHTMLEntity.mjs b/tests/node/tests/ToHTMLEntity.mjs
new file mode 100644
index 0000000000..43d8cb4935
--- /dev/null
+++ b/tests/node/tests/ToHTMLEntity.mjs
@@ -0,0 +1,33 @@
+import TestRegister from "../../lib/TestRegister.mjs";
+import ToHTMLEntity from "../../../src/core/operations/ToHTMLEntity.mjs";
+import it from "../assertionHandler.mjs";
+import assert from "assert";
+
+TestRegister.addApiTests([
+    it("To HTML Entity: every named entity in the table is well-formed", () => {
+        // "Convert all characters" emits an entity for every code point, so a
+        // correct table yields an unbroken stream of entity tokens. A malformed
+        // value such as "&nge;;" or "&epsi;," leaves stray characters between
+        // tokens, which the walk below flags and reports with surrounding context.
+        let input = "";
+        for (let cp = 0; cp <= 0xFFFF; cp++) {
+            if (cp >= 0xD800 && cp <= 0xDFFF) continue; // skip surrogate range
+            input += String.fromCodePoint(cp);
+        }
+        const output = new ToHTMLEntity().run(input, [true, "Named entities"]);
+
+        const tokenRe = /&#[0-9]+;|&#x[0-9a-fA-F]+;|&[A-Za-z][A-Za-z0-9]*;/y;
+        const malformed = [];
+        let pos = 0;
+        while (pos < output.length) {
+            tokenRe.lastIndex = pos;
+            if (tokenRe.exec(output)) {
+                pos = tokenRe.lastIndex;
+            } else {
+                malformed.push(output.slice(Math.max(0, pos - 12), pos + 12));
+                pos++;
+            }
+        }
+        assert.deepStrictEqual(malformed, [], `Malformed entity value(s) near: ${JSON.stringify(malformed)}`);
+    }),
+]);

From 9e59868b843e4ba3d7575a0b86fcfddd4abe49e3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 10:21:11 +0100
Subject: [PATCH 2/2] chore (deps): bump websocket-driver from 0.7.4 to 0.7.5
 (#2673)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 958b25b8f6..cde26b1484 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18434,9 +18434,9 @@
       }
     },
     "node_modules/websocket-driver": {
-      "version": "0.7.4",
-      "resolved": "https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.4.tgz",
-      "integrity": "sha512-b17KeDIQVjvb0ssuSDF2cYXSg2iztliJ4B9WdsuB6J952qCPKmnVq4DyW5motImXHDC1cBT/1UezrJVsKw5zjg==",
+      "version": "0.7.5",
+      "resolved": "https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.5.tgz",
+      "integrity": "sha512-ZL2+3c7kMBdIRCMz6l8jQMHyGVxj+UL+xVk74Ombiciboca8rHa15L86B19E5oh1pL9Ii/uj54gtsIrZGMo6zA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {