Skip to content

build(deps): bump lxml-html-clean from 0.4.0 to 0.4.4#331

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/lxml-html-clean-0.4.4
Open

build(deps): bump lxml-html-clean from 0.4.0 to 0.4.4#331
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/lxml-html-clean-0.4.4

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 8, 2026

Bumps lxml-html-clean from 0.4.0 to 0.4.4.

Changelog

Sourced from lxml-html-clean's changelog.

0.4.4 (2026-02-26)

Bugs fixed

  • Fixed a bug where Unicode escapes in CSS were not properly decoded before security checks. This prevents attackers from bypassing filters using escape sequences. (CVE-2026-28348)
  • Fixed a security issue where <base> tags could be used for URL hijacking attacks. The <base> tag is now automatically removed whenever the <head> tag is removed (via page_structure=True or manual configuration), as <base> must be inside <head> according to HTML specifications. (CVE-2026-28350)

0.4.3 (2025-10-02)

Maintenance

  • Tests updated to work correctly with new lxml and libxml2 releases.
  • Python 3.6 and 3.7 are no longer tested.
  • Improved documentation about CSS removal behavior.

0.4.2 (2025-04-09)

Bugs fixed

  • lxml_html_clean now correctly handles HTML input as bytes as it did before the 0.2.0 release.

0.4.1 (2024-11-15)

Bugs fixed

  • Removed superfluous debug prints.
Commits
  • fd10d79 Add more tests for different combinations of backslashes and unicode
  • 5b7e228 Restore the removal of all backslashes from styles after decoding of unicode ...
  • 88da8f9 Prepare release 0.4.4
  • 9c5612c Remove <base> tags to prevent URL hijacking attacks
  • 2ef7326 Implement unicode escape decoding
  • 7c854af Add missing Python 3.14 to classifiers
  • 80cebf7 Continue using the package link
  • 1cef82e Update safe sanitizer recommendation
  • 79f35f4 CI: Drop Python 3.8, add 3.14
  • fab1dd4 Release 0.4.3
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels May 8, 2026
Bumps [lxml-html-clean](https://github.com/fedora-python/lxml_html_clean) from 0.4.0 to 0.4.4.
- [Changelog](https://github.com/fedora-python/lxml_html_clean/blob/main/CHANGES.rst)
- [Commits](fedora-python/lxml_html_clean@0.4.0...0.4.4)

---
updated-dependencies:
- dependency-name: lxml-html-clean
  dependency-version: 0.4.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/pip/lxml-html-clean-0.4.4 branch from fb6cb64 to 710821b Compare May 15, 2026 08:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants