lukebrogan-mend / vulnerable-rust

0 stars 0 forks source link

Update Rust crate ammonia to v3 - autoclosed #42

Closed mend-for-github-com[bot] closed 5 months ago

mend-for-github-com[bot] commented 1 year ago

This PR contains the following updates:

Package Type Update Change
ammonia dependencies major 2.0.0 -> 3.3.0

Release Notes

rust-ammonia/ammonia (ammonia) ### [`v3.3.0`](https://togithub.com/rust-ammonia/ammonia/blob/HEAD/CHANGELOG.md#330) [Compare Source](https://togithub.com/rust-ammonia/ammonia/compare/v3.2.1...v3.3.0) - chore: bump MSRV to 1.60.0 - docs: fix incorrect XSS example - feature: add `UrlRelative::RewriteWithRoot` ### [`v3.2.1`](https://togithub.com/rust-ammonia/ammonia/blob/HEAD/CHANGELOG.md#321) [Compare Source](https://togithub.com/rust-ammonia/ammonia/compare/v3.2.0...v3.2.1) - chore: bump MSRV to 1.51.0 [serde-rs/serde#2255](https://togithub.com/serde-rs/serde/issues/2255) - chore: fix broken links in documentation ### [`v3.2.0`](https://togithub.com/rust-ammonia/ammonia/blob/HEAD/CHANGELOG.md#320) [Compare Source](https://togithub.com/rust-ammonia/ammonia/compare/v3.1.4...v3.2.0) - chore: bump MSRV to 1.49.0 - chore: update to html5ever 0.26 - chore: switch from lazy_static to once_cell - feature: add `Builder::empty()` constructor ### [`v3.1.4`](https://togithub.com/rust-ammonia/ammonia/blob/HEAD/CHANGELOG.md#314) [Compare Source](https://togithub.com/rust-ammonia/ammonia/compare/v3.1.3...v3.1.4) - chore: use `#[non_exhaustive]` instead of hidden variant for `UrlRelative` policy - chore: remove unnecessary dependency on third-party `matches!` macro ### [`v3.1.3`](https://togithub.com/rust-ammonia/ammonia/blob/HEAD/CHANGELOG.md#313) [Compare Source](https://togithub.com/rust-ammonia/ammonia/compare/v3.1.2...v3.1.3) - fix: incorrect FF/CR handling in `clean_text` - fix: split class name attribute by all ASCII whitespace, not just SP 0x20 - docs: fix incorrect English in `is_html` documentation ### [`v3.1.2`](https://togithub.com/rust-ammonia/ammonia/blob/HEAD/CHANGELOG.md#312) [Compare Source](https://togithub.com/rust-ammonia/ammonia/compare/v3.1.1...v3.1.2) - fix: unexpected namespace switches can allow XSS via svg/mathml parsing ### [`v3.1.1`](https://togithub.com/rust-ammonia/ammonia/blob/HEAD/CHANGELOG.md#311) [Compare Source](https://togithub.com/rust-ammonia/ammonia/compare/v3.1.0...v3.1.1) - fix: Crash on invalid URLs in some configurations ([issue #​136](https://togithub.com/rust-ammonia/ammonia/issues/136)) ### [`v3.1.0`](https://togithub.com/rust-ammonia/ammonia/blob/HEAD/CHANGELOG.md#310) [Compare Source](https://togithub.com/rust-ammonia/ammonia/compare/v3.0.0...v3.1.0) - feature: Whitelist generic attribute prefix - chore: Update html5ever to 0.25 - feature: support adding attribute values to elements ### [`v3.0.0`](https://togithub.com/rust-ammonia/ammonia/blob/HEAD/CHANGELOG.md#300) [Compare Source](https://togithub.com/rust-ammonia/ammonia/compare/v2.1.4...v3.0.0) - Add [`clean_text`][clean_text] function. - Updated to [rust-url 2.0]. - Updated to the 2018 edition. [`clean_text`]: https://docs.rs/ammonia/3.0.0/ammonia/fn.clean_text.html [rust-url 2.0]: https://docs.rs/url/2.0.0/url/ ### [`v2.1.4`](https://togithub.com/rust-ammonia/ammonia/blob/HEAD/CHANGELOG.md#214) [Compare Source](https://togithub.com/rust-ammonia/ammonia/compare/v2.1.3...v2.1.4) - fix: split class name attribute by all ASCII whitespace, not just SP 0x20 (backported from 3.1.3) ### [`v2.1.3`](https://togithub.com/rust-ammonia/ammonia/blob/HEAD/CHANGELOG.md#213) [Compare Source](https://togithub.com/rust-ammonia/ammonia/compare/v2.1.2...v2.1.3) - fix: unexpected namespace switches can allow XSS via svg/mathml parsing (backported from 3.1.2)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

â™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.