Skip to content

deps(deps): bump ammonia from 4.1.4 to 4.2.1 - #399

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/ammonia-4.2.1
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/ammonia-4.2.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 6, 2026 •

Copy link
Copy Markdown
Contributor

Bumps ammonia from 4.1.4 to 4.2.1.

Release notes

Sourced from ammonia's releases.

4.2.1

  • fix: apply URL rewrites to CSS url() function
  • Security fix: CSS sanitization only ever worked on attributes, not stylesheets. This now panics if you try to enable the style tag while also using style attribute filtering

4.1.5

  • fix: apply URL rewrites to CSS url() function
  • Security fix: CSS sanitization only ever worked on attributes, not stylesheets. This now panics if you try to enable the style tag while also using style attribute filtering

4.2.0

  • chore: upgrade to html5ever 0.40.0
  • chore: upgrade to cssparser 0.38.0
  • chore: bump MSRV to 1.85.0
  • feat: add introspection methods for relative url settings to Builder (@​gghez)
  • Security fixes are not backported to 4.0 any more. Only 3.3, 4.1, and 4.2 are supported.
Changelog

Sourced from ammonia's changelog.

4.2.1

  • fix: apply URL rewrites to CSS url() function
  • Security fix: CSS sanitization only ever worked on attributes, not stylesheets. This now panics if you try to enable the style tag while also using style attribute filtering

4.2.0

  • chore: upgrade to [html5ever 0.40.0][]
  • chore: upgrade to cssparser 0.38.0
  • chore: bump MSRV to 1.85.0
  • feat: add introspection methods for relative url settings to Builder (@​gghez)
  • Security fixes are not backported to 4.0 any more. Only 3.3, 4.1, and 4.2 are supported.
Commits
  • 6013920 Merge pull request #258 from rust-ammonia/release-4.2.1
  • 8de5554 Release 4.2.1
  • 30d269b Merge pull request #256 from rust-ammonia/url-in-css
  • 406ba91 Prevent footgun around style filtering
  • 0239fea Fix handling of URLs in CSS background
  • 4c7a852 Merge pull request #254 from rust-ammonia/release-4.2
  • 6734bc7 Update security policy
  • b058406 Add changelog entry for gghez's PR 240
  • 6bb0458 Merge pull request #253 from rust-ammonia/dependabot/cargo/cssparser-0.38.0
  • 0201004 Merge pull request #240 from gghez/worktree-issue-128-expose-base-url
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 6, 2026
@dependabot
dependabot Bot force-pushed the dependabot/cargo/ammonia-4.2.1 branch 9 times, most recently from e11410a to 5ec75ce Compare October 10, 2026 11:36
Bumps [ammonia](https://github.com/rust-ammonia/ammonia) from 4.1.4 to 4.2.1.
- [Release notes](https://github.com/rust-ammonia/ammonia/releases)
- [Changelog](https://github.com/rust-ammonia/ammonia/blob/master/CHANGELOG.md)
- [Commits](rust-ammonia/ammonia@v4.1.4...v4.2.1)

---
updated-dependencies:
- dependency-name: ammonia
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/ammonia-4.2.1 branch from 5ec75ce to a604e10 Compare October 10, 2026 17:34
@dependabot @github

dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #427.

@dependabot dependabot Bot closed this Oct 14, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/ammonia-4.2.1 branch October 14, 2026 13:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant