[dependabot]

Bumps com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer from 20260313.1 to 20260924.1.

Release notes

Sourced from com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer's releases.

Release 20260924.1

Changelog

• 4fd25f3 Release version 20260924.1 (GitHub Actions)
• 1231831 Take the review: mark function depths in a plain array, not a BitSet (Jim Manico)
• 82e9b10 Add the denial-of-service invariant to AGENTS.md (Jim Manico)
• d0b06bd Drop an unmatched CSS close bracket in constant time (Jim Manico)
• 8a55b77 Drop CSS declarations that nest functions deeper than sixteen (Jim Manico)
• a310fe4 Harden release and build verification (Jim Manico)
• 3b122bb Record GHSA-6rfr-g8xv-xrp3 (Jim Manico)
• 393d86d Prepare for next development version (GitHub Actions)

Contributors

We'd like to thank the following people for their contributions:

• Jim Manico

Release 20260922.1

Changelog

• c2042c0 Release version 20260922.1 (GitHub Actions)
• ea86ffa Encode CSS URL content after rewriting (Jim Manico)
• de7555c Record GHSA-vqwm-jvq2-mfwc and pin its reported cases (Jim Manico)
• 0261fc6 Prepare for next development version (GitHub Actions)

Contributors

We'd like to thank the following people for their contributions:

• Jim Manico

Release 20260921.1

Changelog

• b8d90c9 Release version 20260921.1 (GitHub Actions)
• 37d9212 Preserve form text policy across implied tables (Jim Manico)
• 7ae2b5c Stabilize list-item closure across output contexts (Jim Manico)
• 9059be1 Preserve text after an ignored form in a dropped table (Jim Manico)
• 27d2c04 Preserve nested list context for browser tree stability (Jim Manico)
• 1901496 Cover dropped-template list residuals (Jim Manico)
• 0a55504 Stabilize list contexts after dropped wrappers (Jim Manico)
• 6e0254c Stabilize text after bare dropped-table parts (Jim Manico)
• 7b4e234 Take the review: keep select retirement synchronized and scoped (Jim Manico)
• 50a7d01 Fix browser-round-trip text gates for #497 (Jim Manico)
• 9ebd255 Take the review: keep the rule to the container, not to table scope (Jim Manico)
• 6469377 Take the third review: keep the formatting a browser keeps, and say what changed (Jim Manico)
• ee953d2 Take the second review: judge every barrier by the output, keep the option's item (Jim Manico)
• afe8e8e Take the review: bound the resumption queue, judge barriers by the output (Jim Manico)
• 2a9ede4 Take the probe: do not resume formatting inside an element read as raw text (Jim Manico)
• a9f9abb Close the open list item for a list item start tag, through formatting (Jim Manico)
• f9a0c87 Take the review: a dropped template bounds no table scope, and holds a col directly too (Jim Manico)

... (truncated)

Commits

• 4fd25f3 Release version 20260924.1
• 2b038e8 Merge pull request #508 from OWASP/css-nesting-depth
• 1231831 Take the review: mark function depths in a plain array, not a BitSet
• 82e9b10 Add the denial-of-service invariant to AGENTS.md
• d0b06bd Drop an unmatched CSS close bracket in constant time
• 8a55b77 Drop CSS declarations that nest functions deeper than sixteen
• 9aed451 Merge pull request #507 from OWASP/harden-release-build-verification
• a310fe4 Harden release and build verification
• dc77920 Merge pull request #506 from OWASP/ghsa-6rfr-docs
• 3b122bb Record GHSA-6rfr-g8xv-xrp3
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)