chore(deps): update dependency bleach to v6 by renovate[bot] · Pull Request #201 · Nikas-Project/Server

renovate · 2023-01-23T19:20:54Z

This PR contains the following updates:

Package	Change	Age	Confidence
bleach	`==5.0.1` → `==6.4.0`

Release Notes

mozilla/bleach (bleach)

`v6.4.0`

Compare Source

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future
releases including for security issues.
See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

Dropped support for pypy 3.10. (#764)

Security fixes

Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

Fix XSS issue with sanitize_uri_value where disallowed schemes with
Unicode invisible characters wouldn't be rejected.

For example::

import bleach
payload1 = 'Click'
result1 = bleach.clean(payload1)
print(repr(result1))

outputs::

'Click'

See the advisory for details.
Fix GHSA-gj48-438w-jh9v.

Fix issue where URI sanitization wasn't happening in formaction attributes.

See the advisory for details.

Bug fixes

Add support for pypy 3.11. (#764)
Drop version max in tinycss2 pin. (#772)

This removes one of the things we had to keep checking and updating. Users
now own the responsibility for correctness with the version of tinycss2
they're using.

`v6.3.0`

Compare Source

Backwards incompatible changes

Dropped support for Python 3.9. (#756)

Security fixes

None

Bug fixes

Add support for Python 3.14. (#758)
Fix wbr handling. (#488)

`v6.2.0`

Compare Source

Backwards incompatible changes

Dropped support for Python 3.8. (#737)

Security fixes

None

Bug fixes

Add support for Python 3.13. (#736)
Remove six depdenncy. (#618)
Update known-good versions for tinycss2. (#732)
Fix additional < followed by characters and EOF issues. (#728)

`v6.1.0`

Compare Source

Backwards incompatible changes

Dropped support for Python 3.7. (#709)

Security fixes

None

Bug fixes

Add support for Python 3.12. (#710)
Fix linkify with arrays in querystring (#436)
Handle more cases with < followed by character data (#705)
Fix entities inside a tags in linkification (#704)
Update cap for tinycss2 to <1.3 (#702)
Updated Sphinx requirement
Add dependabot for github actions and update github actions

`v6.0.0`

Compare Source

Backwards incompatible changes

bleach.clean, bleach.sanitizer.Cleaner,
bleach.html5lib_shim.BleachHTMLParser: the tags and protocols
arguments were changed from lists to sets.

Old pre-6.0.0:

.. code-block:: python

bleach.clean(
"some text",
tags=["a", "p", "img"],

^ ^ list

     protocols=["http", "https"],

^ ^ list

New 6.0.0 and later:

.. code-block:: python

 bleach.clean(
     "some text",
     tags={"a", "p", "img"},

^ ^ set

     protocols={"http", "https"},

^ ^ set

bleach.linkify, bleach.linkifier.Linker: the skip_tags and
recognized_tags arguments were changed from lists to sets.

Old pre-6.0.0:

.. code-block:: python

bleach.linkify(
"some text",
skip_tags=["pre"],

^ ^ list

 )

 linker = Linker(
     skip_tags=["pre"],

^ ^ list

     recognized_tags=html5lib_shim.HTML_TAGS + ["custom-element"],

^ ^ ^ list

|

| list concatenation

New 6.0.0 and later:

.. code-block:: python

 bleach.linkify(
     "some text",
     skip_tags={"pre"},

^ ^ set

 )

 linker = Linker(
     skip_tags={"pre"},

^ ^ set

     recognized_tags=html5lib_shim.HTML_TAGS | {"custom-element"},

^ ^ ^ set

|

| union operator

bleach.sanitizer.BleachSanitizerFilter: strip_allowed_elements is now
strip_allowed_tags. We now use "tags" everywhere rather than a mishmash
of "tags" in some places and "elements" in others.

Security fixes

None

Bug fixes

Add support for Python 3.11. (#675)
Fix API weirness in BleachSanitizerFilter. (#649)

We're using "tags" instead of "elements" everywhere--no more weird
overloading of "elements" anymore.

Also, it no longer calls the superclass constructor.
Add warning when css_sanitizer isn't set, but the style
attribute is allowed. (#676)
Fix linkify handling of character entities. (#501)
Rework dev dependencies to use requirements-dev.txt and
requirements-flake8.txt instead of extras.
Fix project infrastructure to be tox-based so it's easier to have CI
run the same things we're running in development and with flake8
in an isolated environment.
Update action versions in CI.
Switch to f-strings where possible. Make tests parametrized to be
easier to read/maintain.