GHSA-c9vm-hv86-f23r justhtml includes multiple security fixes

• PyPI justhtml: < 1.15.0 → fixed in 1.15.0

Summary `justhtml` `1.15.0` includes multiple security fixes affecting URL sanitization helpers, HTML serialization, Markdown passthrough, and several custom sanitization-policy edge cases. These issues have different impact levels and do not all affect the default configuration in the same way. Affected versions • `justhtml` `` could break out of the comment and inject live markup. Markdown passthrough issue • `to_markdown(html_passthrough=True)` could reintroduce active HTML from sanitized `` content by emitting a raw closing `` sequence. Custom policy issues These issues affected custom policies more than the default safe configuration. • `a[ping]` was handled as a single URL even though browsers interpret it as a space-separated URL list. • `attributionsrc` was not treated as URL-bearing and could preserve attacker-controlled reporting endpoints. • `link[imagesrcset]` was not treated as URL-bearing and could preserve attacker-controlled image candidates. • Preserved `` tags could keep redirect targets without URL-policy enforcement. • Preserved `` tags could rewrite how later relative URLs resolved in the browser. • Preserved `` blocks could keep resource-loading CSS such as `@import`, `url(...)`, or `image-set(...)`. • Mixed-case attribute names in custom transform pipelines could bypass or confuse security-related transforms such as `DropAttrs(...)`, `DropUrlAttrs(...)`, `AllowStyleAttrs(...)`, and `MergeAttrs(...)`. Default configuration Most of the custom-policy issues above did not affect the default `JustHTML(..., sanitize=True)` behavior. The main exceptions were: • helper APIs such as `clean_url_value(...)` • programmatic DOM / serializer usage • applications explicitly using `html_passthrough=True` • applications using custom policies or custom transform pipelines Recommended action Upgrade to `justhtml` `1.15.0`. If you cannot upgrade immediately: • avoid `html_passthrough=True` for untrusted content • avoid preserving ``, ``, and `` in custom policies • avoid allowing `ping`, `attributionsrc`, or `imagesrcset` unless you explicitly validate them • avoid serializing untrusted programmatic node names, attribute names, or comment data