------------------------------------------------------------------- Tue Mar 10 09:58:53 UTC 2026 - Nico Krapp - Update to 0.4.4 * Fixed a bug where Unicode escapes in CSS were not properly decoded before security checks. This prevents attackers from bypassing filters using escape sequences. (CVE-2026-28348) (bsc#1259378) * Fixed a security issue where tags could be used for URL hijacking attacks. The tag is now automatically removed whenever the tag is removed (via page_structure=True or manual configuration), as must be inside according to HTML specifications. (CVE-2026-28350) (bsc#1259379) ------------------------------------------------------------------- Fri Oct 10 05:38:18 UTC 2025 - Steve Kowalik - Update to 0.4.3: * Tests updated to work correctly with new lxml and libxml2 releases. * Python 3.6 and 3.7 are no longer tested. ------------------------------------------------------------------- Fri Apr 11 20:57:19 UTC 2025 - Dirk Müller - update to 0.4.2: * lxml_html_clean now correctly handles HTML input as bytes as it did before the 0.2.0 release. ------------------------------------------------------------------- Thu Nov 21 05:12:50 UTC 2024 - ecsos - Update to 0.4.1 * Bugs fixed - Removed superfluous debug prints. - Changes from 0.4.0 * Bugs fixed - The Cleaner() now scans for hidden JavaScript code embedded within CSS comments. In certain contexts, such as within