search

mganss / HtmlSanitizer

Cleans HTML to avoid XSS attacks
MIT License
1.52k stars 198 forks source link

Get rid of AngleSharp.Css dependency #451

Closed ronaldkroon closed 11 months ago

ronaldkroon commented 1 year ago

HtmlSanitizer (8.0.645) depends on AngleSharp 0.17.1, but AngleSharp is already on version 1.0.3. HtmlSanitizer also depends on AngleSharp.Css 0.17.1 which in turn depends on a similar old version of AngleSharp (0.17.0-0.18.0). But now if I want to use the latest version of AngleSharp, I'm getting compiler warning for mismatching versions, and I can imagine there are actual bugs when the newer version of AngleSharp is used. Unfortunately the AngleSharp.Css repo seems rather dead.

Would it be possible to get rid of the AngleSharp.Css dependency and move to the latest version of AngleSharp?

mganss commented 1 year ago

HtmlSanitizer uses AngleSharp.Css to process CSS so I currently don't see this happening. I hope that @FlorianRappl releases a 1.0 version of AngleSharp.Css with a relaxed dependency on AngleSharp soon.

tiesont commented 1 year ago

Also: #87 explains why the version is pinned, for those curious.

mganss commented 11 months ago

I've released 8.0.690-beta that depends on AngleSharp.Css 1.0.0-alpha-99 which can be used with AngleSharp 1.0.

dsparkplug commented 9 months ago

Is there any reason why v8.0.692 does not include this change from v8.0.690-beta?

mganss commented 9 months ago

@dsparkplug I don't want a stable version of HtmlSanitizer to depend on a prerelease version of AngleSharp.Css.

dsparkplug commented 9 months ago

Ok, that makes sense. I'll just use the beta..

dsparkplug commented 9 months ago

I think issue here is actually one of versioning. Currently v8.0.692 is an update to v8.0.691-beta which is quite confusing. Have you considered using a different minor version for the beta e.g. v8.1.xxx beta

mganss commented 9 months ago

I have released 8.1.719-beta.