Bump justhtml from 2.2.0 to 3.11.1

[dependabot]

Bumps justhtml from 2.2.0 to 3.11.1.

Release notes

Sourced from justhtml's releases.

Release v3.11.1

Fixed

• Preserve rendered word separation when pretty HTML serialization normalizes a newline next to an inline element.

Release v3.11.0

Performance

• Answer the open-elements scope check from a maintained name count before looking for a boundary, and settle target and boundary in one bounded pass on the shallow stacks that ordinary documents keep. The check runs several times per token, and the count returns outright on about two thirds of the calls (thanks @​kevin-hua-kraken in #76).

Security

• (Severity: Low) Bound Markdown blockquote prefix depth and avoid repeatedly splitting and copying accumulated inner output. Deeply nested blockquotes containing many block nodes now serialize in linear rather than super-quadratic time.
• (Severity: Low) Bound the total DOM expansion performed when many selectedcontent markers project the same large option subtree. Crafted input can no longer multiply marker count by option size into quadratic time and memory use.
• (Severity: High) Prevent selectedcontent projection in the default fused sanitizer from cloning deferred disallowed foreign content back into the output, where SVG or MathML event handlers could execute.
• (Severity: Low) Re-record only the slot that changed when the adoption agency clones a formatting element back onto the open-elements stack, instead of rebuilding the whole position index. Since 3.10.0, markup nesting a formatting element between the end tag's subject and the furthest block, such as "<b><i><div></b>" * n, took time quadratic in its length -- about 3.7x longer than 3.9.0 on the same input.

Fixed

• Preserve collapsed whitespace at a, b, strong, em, and i boundaries in Markdown output without adding duplicate spaces after heading or list markers.

Release v3.10.1

Performance

• Answer the pretty-printer's "does this subtree contain a block element" question with a lazy per-run memo behind a bounded direct walk, rather than classifying every subtree in the document before serializing. Small subtrees -- nearly all of them -- no longer pay for an answer recorded for each of their descendants, which recovers about 8% of to_html() time on the web100k benchmark.

Fixed

• Keep the open-elements position index consistent when a node is inserted below the top of the stack, or when the stack grows past the indexing depth through such an insertion. Since 3.10.0, misnested formatting markup below about thirty levels of nesting could raise IndexError instead of parsing, for example "<div>" * 30 + "<i><blockquote><ul></i>".

v3.10.0

Performance

• Keep parsing, sanitization, deep cloning, pretty serialization, streaming, and diagnostic collection linear for deeply nested or repeatedly misnested adversarial input by indexing parser state and avoiding repeated subtree and sibling walks (thanks @​kevin-hua-kraken in #72).

Security

• (Severity: Low) Bound parser and sanitizer work for crafted deep nesting, foreign-content end tags, active formatting recovery, template cleanup, and nested disallowed wrappers that could previously trigger quadratic processing.

Fixed

• Make append_child(), insert_before(), and replace_child() splice DocumentFragment children into the target and empty the fragment, matching DOM behavior (thanks @​jph00 in #68).
• Preserve literal text when serializing the legacy raw-text elements iframe, noembed, noframes, and xmp, so parsing serialized output recovers the same text (thanks @​jph00 in #70).
• Minimize name-matching attribute values only for boolean attributes, preventing ordinary attributes such as id="id" from changing value during serialization (thanks @​jph00 in #69).

... (truncated)

Changelog

Sourced from justhtml's changelog.

[3.11.1] - 2026-08-16

Fixed

• Preserve rendered word separation when pretty HTML serialization normalizes a newline next to an inline element.

[3.11.0] - 2026-08-07

Performance

• Answer the open-elements scope check from a maintained name count before looking for a boundary, and settle target and boundary in one bounded pass on the shallow stacks that ordinary documents keep. The check runs several times per token, and the count returns outright on about two thirds of the calls (thanks @​kevin-hua-kraken in #76).

Security

• (Severity: Low) Bound Markdown blockquote prefix depth and avoid repeatedly splitting and copying accumulated inner output. Deeply nested blockquotes containing many block nodes now serialize in linear rather than super-quadratic time.
• (Severity: Low) Bound the total DOM expansion performed when many selectedcontent markers project the same large option subtree. Crafted input can no longer multiply marker count by option size into quadratic time and memory use.
• (Severity: High) Prevent selectedcontent projection in the default fused sanitizer from cloning deferred disallowed foreign content back into the output, where SVG or MathML event handlers could execute.
• (Severity: Low) Re-record only the slot that changed when the adoption agency clones a formatting element back onto the open-elements stack, instead of rebuilding the whole position index. Since 3.10.0, markup nesting a formatting element between the end tag's subject and the furthest block, such as "<b><i><div></b>" * n, took time quadratic in its length -- about 3.7x longer than 3.9.0 on the same input.

Fixed

• Preserve collapsed whitespace at a, b, strong, em, and i boundaries in Markdown output without adding duplicate spaces after heading or list markers.

[3.10.1] - 2026-07-25

Performance

• Answer the pretty-printer's "does this subtree contain a block element" question with a lazy per-run memo behind a bounded direct walk, rather than classifying every subtree in the document before serializing. Small subtrees -- nearly all of them -- no longer pay for an answer recorded for each of their descendants, which recovers about 8% of to_html() time on the web100k benchmark.

Fixed

• Keep the open-elements position index consistent when a node is inserted below the top of the stack, or when the stack grows past the indexing depth through such an insertion. Since 3.10.0, misnested formatting markup below about thirty levels of nesting could raise IndexError instead of parsing, for example "<div>" * 30 + "<i><blockquote><ul></i>".

[3.10.0] - 2026-07-25

Performance

• Keep parsing, sanitization, deep cloning, pretty serialization, streaming, and diagnostic collection linear for deeply nested or repeatedly misnested adversarial input by indexing parser state and avoiding repeated subtree and sibling walks (thanks @​kevin-hua-kraken in #72).

Security

• (Severity: Low) Bound parser and sanitizer work for crafted deep nesting, foreign-content end tags, active formatting recovery, template cleanup, and nested disallowed wrappers that could previously trigger quadratic processing.

Fixed

... (truncated)

Commits

• 297b49c Release v3.11.1
• a5596ea docs: prepare 3.11.1 changelog
• 7155cbe fix: enhance whitespace preservation in HTML serialization
• 8fc4ec6 Merge pull request #80 from gaborbernat/fix/turbohtml-attribute-namespaces
• 1fe5660 🐛 fix(bench): qualify foreign attributes
• 13ab469 Release v3.11.0
• 96b1df2 docs: prepare 3.11.0 changelog
• 00c697a Merge pull request #79 from EmilStenstrom/agent/fix-markdown-inline-whitespace
• 2e60cb3 fix: preserve Markdown inline boundary spaces
• 9046128 security: bound markdown blockquote nesting
• Additional commits viewable in compare view

[dependabot]

Superseded by #25388.