[dependabot]

Bumps com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer from 20261103.2 to 20261110.1.

Release notes

Sourced from com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer's releases.

Release 20261110.1

Changelog

• f05e4d6 Release version 20261110.1 (GitHub Actions)
• 178be01 Take the review: wording on text-content and template table modes (Jim Manico)
• a150c46 Close three more image check bypasses found in review (Jim Manico)
• a539989 Take the review: comment wording and a hostile-size test (Jim Manico)
• 0513b7b Take the review: a template under an unknown context starts unknown (Jim Manico)
• d91243e Take the review: document the sink condition and widen the tests (Jim Manico)
• 0d2e10d Take the review: fail closed for receivers that may forward to the renderer (Jim Manico)
• eddea8b Track the output context under the name the renderer writes (Jim Manico)
• d19cf5c Quote the placeholder version in the signing check (Jim Manico)
• cdab7ea Pin the release signing key and add a no-publish signing check (Jim Manico)
• 2e67850 Remove one-time release tag repair workflow (Jim Manico)
• 606702f Use release key identity for signed tags (Jim Manico)
• edfcf9e Sign release tags explicitly in publication workflow (Jim Manico)
• 9a363d4 Credit reporter of 20261107.1 security fixes (Jim Manico)
• e4b845d Prepare for next development version (GitHub Actions)

Contributors

We'd like to thank the following people for their contributions:

• Jim Manico

Release 20261107.1

Changelog

• 1fde26f Release version 20261107.1 (GitHub Actions)
• e6440ce Document model-assisted review workflow (Jim Manico)
• 4ba9150 Match rendered font breakout attribute names (Jim Manico)
• c455308 Complete image alias review fixes (Jim Manico)
• 81d31a5 Address review of URL elision fix (Jim Manico)
• 24bee06 Keep image only where browsers build an SVG image (Jim Manico)
• 3d8292c Percent-encode URL characters the renderer would drop (Jim Manico)
• 557edb6 Document active-content risks in explicitly allowed attributes (#532) (Jim Manico)
• bd425bc Take the review: say what an unescaped line break in a URL drops (Jim Manico)
• 2f570aa Take the review: read CRLF after a hex escape as one character (Jim Manico)
• 3547a0d Take the review: decode an escaped code point outside the BMP whole (Jim Manico)
• d399af5 Describe the review's fixes in the change log (Jim Manico)
• b401240 Take the review: use isCssWhitespace after a hex escape (Jim Manico)
• 7066d31 Take the review: read a CSS string used as a URL as a URL (Jim Manico)
• 892bc54 Take the review: delete tabs and newlines inside a URL (Jim Manico)
• ada2faf Take the review: drop a quoted URL broken by a line terminator (Jim Manico)
• d69c6c4 Take the review: continue escaped lines in a quoted URL (Jim Manico)
• 687fcfe Take the review: read NUL and surrogates in a URL as U+FFFD (Jim Manico)
• 4a80e29 Take the review: give the linear-time test its javadoc back (Jim Manico)
• d68e849 Drop the spaces at either end of a CSS url() (Jim Manico)
• 06e04f1 Record GHSA-76cc-622x-jwm4 (Jim Manico)
• 34735cf Prepare for next development version (GitHub Actions)

... (truncated)

Commits

• f05e4d6 Release version 20261110.1
• 4eea862 Merge pull request #541 from OWASP/xmp-breakout-image
• 178be01 Take the review: wording on text-content and template table modes
• a150c46 Close three more image check bypasses found in review
• a539989 Take the review: comment wording and a hostile-size test
• 0513b7b Take the review: a template under an unknown context starts unknown
• d91243e Take the review: document the sink condition and widen the tests
• 0d2e10d Take the review: fail closed for receivers that may forward to the renderer
• eddea8b Track the output context under the name the renderer writes
• 79765a5 Merge pull request #539 from OWASP/quote-verify-signing-version
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)