[dependabot]

Bumps symfony/html-sanitizer from 7.4.19 to 8.1.10.

Release notes

Sourced from symfony/html-sanitizer's releases.

v8.1.10

Changelog (symfony/html-sanitizer@v8.1.8...v8.1.10)

• bug #67227 Don't cut a multibyte character when truncating the input to its maximum length (@​nicolas-grekas)
• bug #67226 Ignore meta charset declarations in NativeParser (@​lazerg)

[SECURITY] Security release

v8.1.8

Changelog (symfony/html-sanitizer@v8.1.7...v8.1.8)

• bug #66394 Don't render comments as elements when the default action is Allow (@​nicolas-grekas)
• bug #66393 Fix sanitizeFor() with table-related, image and plaintext contexts (@​nicolas-grekas)

v8.1.7

Changelog (symfony/html-sanitizer@v8.1.6...v8.1.7)

• bug #65843 Drop relative URLs whose first path segment contains a colon instead of throwing (@​nicolas-grekas)

v8.1.6

Changelog (symfony/html-sanitizer@v8.1.1...v8.1.6)

• bug #65702 Compare schemes and hosts case-insensitively (@​nicolas-grekas)
• bug #65664 Keep rejecting denied URL characters when percent-decoding yields malformed UTF-8 (@​nicolas-grekas)
• bug #65662 Accept percent-encoded line breaks and tabs in the query of hostless URLs (@​webdevsamran)

v8.1.1

Changelog (symfony/html-sanitizer@v8.1.0...v8.1.1)

• minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@​nicolas-grekas)

v8.1.0

Changelog (symfony/html-sanitizer@v8.1.0-RC1...v8.1.0)

• no significant changes

v8.1.0-RC1

Changelog (symfony/html-sanitizer@v8.1.0-BETA3...v8.1.0-RC1)

• security #cve-2026-48761 Sanitize URL attributes on , , , , and the URL inside content (@​nicolas-grekas)
• security #cve-2026-48760 Reject percent-encoded BiDi marks and Unicode whitespace in URLs (@​nicolas-grekas)
• bug #64342 Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (@​nicolas-grekas)

v8.1.0-BETA3

Changelog (symfony/html-sanitizer@v8.1.0-BETA1...v8.1.0-BETA3)

• security #cve-2026-45753 Sanitize URLs in action, formaction, poster and cite attributes (@​nicolas-grekas)
• security #cve-2026-45064 Reject BiDi override characters and percent-encode spaces in URLs (@​nicolas-grekas)
• security #cve-2026-45066 Fix allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification (@​alexandre-daubois)

... (truncated)

Changelog

Sourced from symfony/html-sanitizer's changelog.

CHANGELOG

8.2

• Add HtmlSanitizerBundle, which provides the html_sanitizer configuration and the services previously provided by FrameworkBundle under framework.html_sanitizer

8.0

• Remove MastermindsParser; use NativeParser instead
• Add argument $context to ParserInterface::parse()

7.4

• Use the native HTML5 parser when using PHP 8.4+
• Deprecate MastermindsParser; use NativeParser instead
• [BC BREAK] ParserInterface::parse() can now return \Dom\Node|\DOMNode|null instead of just \DOMNode|null
• Add argument $context to ParserInterface::parse()

7.2

• Add support for configuring the default action to block or allow unconfigured elements instead of dropping them

6.4

• Add support for sanitizing unlimited length of HTML document

6.1

• Add the component as experimental

Commits

• 04db220 Merge branch '7.4' into 8.1
• bd9f00c Merge branch '6.4' into 7.4
• 6748062 [HtmlSanitizer] Don't cut a multibyte character when truncating the input to ...
• b2d779b [HtmlSanitizer] Ignore meta charset declarations in NativeParser
• c67061a Merge branch '7.4' into 8.1
• 0b7605d bug #66394 [HtmlSanitizer] Don't render comments as elements when the default...
• 27da818 [HtmlSanitizer] Don't render comments as elements when the default action is ...
• b97de77 [HtmlSanitizer] Fix sanitizeFor() with table-related, image and `plaintex...
• 3d79bde Merge branch '7.4' into 8.1
• f8bbdb0 Merge branch '7.4' into 8.1
• Additional commits viewable in compare view