Html Sanitizer Laravel Package

Changelog (https://github.com/symfony/html-sanitizer/compare/v8.1.0...v8.1.1)

• minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@nicolas-grekas)

Changelog (https://github.com/symfony/html-sanitizer/compare/v8.0.13...v8.0.14)

• minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@nicolas-grekas)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.4.13...v7.4.14)

• minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@nicolas-grekas)

Changelog (https://github.com/symfony/html-sanitizer/compare/v8.1.0-RC1...v8.1.0)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v8.1.0-BETA3...v8.1.0-RC1)

• security #cve-2026-48761 Sanitize URL attributes on , , , , and the URL inside content (@nicolas-grekas)
• security #cve-2026-48760 Reject percent-encoded BiDi marks and Unicode whitespace in URLs (@nicolas-grekas)
• bug #64342 Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (@nicolas-grekas)

Changelog (https://github.com/symfony/html-sanitizer/compare/v8.0.12...v8.0.13)

• security #cve-2026-48761 Sanitize URL attributes on , , , , and the URL inside content (@nicolas-grekas)
• security #cve-2026-48760 Reject percent-encoded BiDi marks and Unicode whitespace in URLs (@nicolas-grekas)
• bug #64342 Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (@nicolas-grekas)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.4.12...v7.4.13)

• security #cve-2026-48761 Sanitize URL attributes on , , , , and the URL inside content (@nicolas-grekas)
• security #cve-2026-48760 Reject percent-encoded BiDi marks and Unicode whitespace in URLs (@nicolas-grekas)
• bug #64342 Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (@nicolas-grekas)

Changelog (https://github.com/symfony/html-sanitizer/compare/v6.4.40...v6.4.41)

• security #cve-2026-48761 Sanitize URL attributes on , , , , and the URL inside content (@nicolas-grekas)
• security #cve-2026-48760 Reject percent-encoded BiDi marks and Unicode whitespace in URLs (@nicolas-grekas)
• bug #64342 Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (@nicolas-grekas)

Changelog (https://github.com/symfony/html-sanitizer/compare/v8.1.0-BETA1...v8.1.0-BETA3)

• security #cve-2026-45753 Sanitize URLs in action, formaction, poster and cite attributes (@nicolas-grekas)
• security #cve-2026-45064 Reject BiDi override characters and percent-encode spaces in URLs (@nicolas-grekas)
• security #cve-2026-45066 Fix allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification (@alexandre-daubois)

Changelog (https://github.com/symfony/html-sanitizer/compare/v8.0.7...v8.0.12)

• security #cve-2026-45753 Sanitize URLs in action, formaction, poster and cite attributes (@nicolas-grekas)
• security #cve-2026-45064 Reject BiDi override characters and percent-encode spaces in URLs (@nicolas-grekas)
• security #cve-2026-45066 Fix allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification (@alexandre-daubois)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.4.7...v7.4.12)

• security #cve-2026-45753 Sanitize URLs in action, formaction, poster and cite attributes (@nicolas-grekas)
• security #cve-2026-45064 Reject BiDi override characters and percent-encode spaces in URLs (@nicolas-grekas)
• security #cve-2026-45066 Fix allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification (@alexandre-daubois)

Changelog (https://github.com/symfony/html-sanitizer/compare/v6.4.35...v6.4.40)

• security #cve-2026-45753 Sanitize URLs in action, formaction, poster and cite attributes (@nicolas-grekas)
• security #cve-2026-45064 Reject BiDi override characters and percent-encode spaces in URLs (@nicolas-grekas)
• security #cve-2026-45066 Fix allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification (@alexandre-daubois)

Changelog (https://github.com/symfony/html-sanitizer/compare/v8.0.13...v8.1.0-BETA1)

• security #cve-2026-48761 Sanitize URL attributes on , , , , and the URL inside content (@nicolas-grekas)
• security #cve-2026-48760 Reject percent-encoded BiDi marks and Unicode whitespace in URLs (@nicolas-grekas)
• bug #64342 Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (@nicolas-grekas)
• security #cve-2026-45753 Sanitize URLs in action, formaction, poster and cite attributes (@nicolas-grekas)
• security #cve-2026-45064 Reject BiDi override characters and percent-encode spaces in URLs (@nicolas-grekas)
• security #cve-2026-45066 Fix allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification (@alexandre-daubois)

Changelog (https://github.com/symfony/html-sanitizer/compare/v8.0.7...v8.0.8)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.4.7...v7.4.8)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v8.0.6...v8.0.7)

• bug #63598 Add 'sms' to hostless schemes (@hivokas)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.4.6...v7.4.7)

• bug #63598 Add 'sms' to hostless schemes (@hivokas)

Changelog (https://github.com/symfony/html-sanitizer/compare/v6.4.34...v6.4.35)

• bug #63598 Add 'sms' to hostless schemes (@hivokas)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.4.0-RC3...v7.4.0)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v8.0.0-RC3...v8.0.0)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v8.0.0-BETA2...v8.0.0-RC1)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.4.0-BETA2...v7.4.0-RC1)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.3.5...v7.3.6)

• bug symfony/symfony#62201 [HtmlSanitizer] Remove srcdoc from allowed attributes (@Spomky)

Changelog (https://github.com/symfony/html-sanitizer/compare/v6.4.27...v6.4.28)

• bug symfony/symfony#62201 [HtmlSanitizer] Remove srcdoc from allowed attributes (@Spomky)

Changelog (https://github.com/symfony/html-sanitizer/compare/v8.0.0-BETA1...v8.0.0-BETA2)

• bug symfony/symfony#62201 [HtmlSanitizer] Remove srcdoc from allowed attributes (@Spomky)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.4.0-BETA1...v7.4.0-BETA2)

• bug symfony/symfony#62201 [HtmlSanitizer] Remove srcdoc from allowed attributes (@Spomky)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.3.4...v8.0.0-BETA1)

• feature symfony/symfony#61391 [HtmlSanitizer] Remove MastermindsParser and add $context arg to ParserInterface::parse() (@nicolas-grekas)
• feature symfony/symfony#61366 [HtmlSanitizer] Use the native HTML5 parser when using PHP 8.4+ (@nicolas-grekas)
• feature symfony/symfony#60639 Bump Symfony 8 to PHP >= 8.4 (@nicolas-grekas)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.3.4...v7.4.0-BETA1)

• feature symfony/symfony#61366 [HtmlSanitizer] Use the native HTML5 parser when using PHP 8.4+ (@nicolas-grekas)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.3.2...v7.3.3)

• bug symfony/symfony#58547 [HtmlSanitizer] Fix force_attributes not replacing existing attribute in initial data (@tgalopin)

Changelog (https://github.com/symfony/html-sanitizer/compare/v6.4.24...v6.4.25)

• bug symfony/symfony#58547 [HtmlSanitizer] Fix force_attributes not replacing existing attribute in initial data (@tgalopin)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.3.1...v7.3.2)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.2.8...v7.2.9)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v6.4.23...v6.4.24)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.3.0-RC1...v7.3.0)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.3.0-BETA2...v7.3.0-RC1)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.2.6...v7.3.0-BETA1)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.2.5...v7.2.6)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v6.4.20...v6.4.21)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.2.2...v7.2.3)

• bug symfony/symfony#59525 [HtmlSanitizer] Fix access to undefined keys in UrlSanitizer (Antoine Beyet)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.1.10...v7.1.11)

• bug symfony/symfony#59525 [HtmlSanitizer] Fix access to undefined keys in UrlSanitizer (Antoine Beyet)

Changelog (https://github.com/symfony/html-sanitizer/compare/v6.4.17...v6.4.18)

• bug symfony/symfony#59525 [HtmlSanitizer] Fix access to undefined keys in UrlSanitizer (Antoine Beyet)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.2.1...v7.2.2)

• bug symfony/symfony#59321 [HtmlSanitizer] reject URLs containing whitespaces (@xabbuh)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.1.9...v7.1.10)

• bug symfony/symfony#59321 [HtmlSanitizer] reject URLs containing whitespaces (@xabbuh)

Changelog (https://github.com/symfony/html-sanitizer/compare/v6.4.16...v6.4.17)

• bug symfony/symfony#59321 [HtmlSanitizer] reject URLs containing whitespaces (@xabbuh)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.2.0-RC1...v7.2.0)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.2.0-BETA2...v7.2.0-RC1)

• no significant changes

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.1.6...v7.2.0-BETA1)

• feature symfony/symfony#57399 [HtmlSanitizer] Add support for configuring the default action (@Seldaek)

Changelog (https://github.com/symfony/html-sanitizer/compare/v7.1.5...v7.1.6)

• no significant changes