4.1.2

• fix: unexpected namespace switches after cleanup can cause mXSS (reported by [email protected])

4.0.1

• fix: unexpected namespace switches after cleanup can cause mXSS (reported by [email protected], backport 4.1.2)

3.3.1

• fix: unexpected namespace switches after cleanup can cause mXSS (reported by [email protected], backport 4.1.2)

4.1.1

• chore: upgrade to html5ever 0.35

4.1.0

• chore: bump MSRV to 1.80.0
• chore: switch to std's LazyLock instead of once_cell's Lazy
• feature: improve panic message when clean_content_tags conflicts with other options
• feature: add support for sanitizing the style attribute

4.0.0

• Update html5ever to 0.27
• feature: change lifetimes on UrlRelative (breaking change)
• chore: use the Display trait (and ToString) instead of an inherent to_string method (breaking change)
• Security fixes are not backported to the 2.0 branch any more. Only the v3 and v4 branches are supported.

3.3.0

• chore: bump MSRV to 1.60.0
• docs: fix incorrect XSS example
• feature: add UrlRelative::RewriteWithRoot

3.2.1

• chore: bump MSRV to 1.51.0 serde-rs/serde#2255
• chore: fix broken links in documentation

3.2.0

• chore: bump MSRV to 1.49.0
• chore: update to html5ever 0.26
• chore: switch from lazy_static to once_cell
• feature: add Builder::empty() constructor

3.1.4

• chore: use #[non_exhaustive] instead of hidden variant for UrlRelative policy
• chore: remove unnecessary dependency on third-party matches! macro