[dependabot]

Bumps ammonia from 4.1.4 to 4.2.3.

Release notes

Sourced from ammonia's releases.

4.2.3

• Security fix: CSS sanitization did not correctly escape URLs when the URL scheme doesn't escape the quotes itself. This bug was reported by Uttej Badwane.
• Security fix: Add missing elements to the list of CSS animation elements. This bug was reported by ucsurf.

4.1.7

• Security fix: CSS sanitization did not correctly escape URLs when the URL scheme doesn't escape the quotes itself. This bug was reported by Uttej Badwane.
• Security fix: Add missing elements to the list of CSS animation elements. This bug was reported by ucsurf.

4.2.1

• fix: apply URL rewrites to CSS url() function
• Security fix: CSS sanitization only ever worked on attributes, not stylesheets. This now panics if you try to enable the style tag while also using style attribute filtering

4.1.5

• fix: apply URL rewrites to CSS url() function
• Security fix: CSS sanitization only ever worked on attributes, not stylesheets. This now panics if you try to enable the style tag while also using style attribute filtering

4.2.0

• chore: upgrade to html5ever 0.40.0
• chore: upgrade to cssparser 0.38.0
• chore: bump MSRV to 1.85.0
• feat: add introspection methods for relative url settings to Builder (@​gghez)
• Security fixes are not backported to 4.0 any more. Only 3.3, 4.1, and 4.2 are supported.

Changelog

Sourced from ammonia's changelog.

4.2.3

• Security fix: CSS sanitization did not correctly escape URLs when the URL scheme doesn't escape the quotes itself. This bug was reported by Uttej Badwane.
• Security fix: Add missing elements to the list of CSS animation elements. This bug was reported by ucsurf.
• 4.2.2 was accidentally released with an incomplete fix.

4.2.1

• fix: apply URL rewrites to CSS url() function
• Security fix: CSS sanitization only ever worked on attributes, not stylesheets. This now panics if you try to enable the style tag while also using style attribute filtering

4.2.0

• chore: upgrade to [html5ever 0.40.0][]
• chore: upgrade to cssparser 0.38.0
• chore: bump MSRV to 1.85.0
• feat: add introspection methods for relative url settings to Builder (@​gghez)
• Security fixes are not backported to 4.0 any more. Only 3.3, 4.1, and 4.2 are supported.

Commits

• 61fd35d Fix missing escape
• e0e1d22 Merge pull request #263 from rust-ammonia/release-4.2.2
• a97724f Bump version, add changelog
• 7a1c828 Merge pull request #261 from rust-ammonia/svg-animation-gaps
• 11c4b37 Fix SVG animation elements that were forgotten in fix
• 7c4e838 Merge pull request #259 from rust-ammonia/cid-fix
• 8906e71 Fix bug in url escaping with cid:
• 6013920 Merge pull request #258 from rust-ammonia/release-4.2.1
• 8de5554 Release 4.2.1
• 30d269b Merge pull request #256 from rust-ammonia/url-in-css
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like ammonia is up-to-date now, so this is no longer needed.