4.19.0 (2025-10-17)

Bug Fixes

• add warning for misleading option (#433) (b21a591)
• catastrophic backtracking in Core.AggressivelyFixLt (#440) (418eeb7)
• Deprecated: preg_replace(): Passing null to parameter #3 ($subject) o… (#421) (5d154a2)
• non-substantive typos (#434) (c2bc354)

Features

• Add CSS direction support (#429) (63e631e)
• Add option for safe iframe hosts using array lookup (#423) (b5cbf0c)
• Allow more image widths by default (#430) (00a0748)
• Define option URI.AllowedSymbols (#447) (77ebd08)
• PHP 8.4 support (#441) (ff005f6)
• Support PHP 8.5 versions (#453) (1eb05d9)

Bug Fixes

• add warning for misleading option (#433) (b21a591)
• catastrophic backtracking in Core.AggressivelyFixLt (#440) (418eeb7)
• Deprecated: preg_replace(): Passing null to parameter #3 ($subject) o… (#421) (5d154a2)
• non-substantive typos (#434) (c2bc354)

Features

• Add CSS direction support (#429) (63e631e)
• Add option for safe iframe hosts using array lookup (#423) (b5cbf0c)
• Allow more image widths by default (#430) (00a0748)
• Define option URI.AllowedSymbols (#447) (77ebd08)
• PHP 8.4 support (#441) (ff005f6)
• Support PHP 8.5 versions (#453) (1eb05d9)

4.18.0 (2024-11-01)

Bug Fixes

• Adjust Core.AllowHostnameUnderscore to consider that "_" is defined as Unreserved Characters in RFC 3986 (#406) (d9fbef8)
• Avoid a deprecated error when the attribute name is numeric and DirectLex is used (#412) (f0fbf51)
• checking that node has property name (#399) (9ca5a36)
• Ignore conditional comments (#401) (4828fdf)
• Support PHP 8.4 (#396) (92da247)
• undefined array key warning (#419) (01be377)

Features

• Add allowfullscreen attr for iframe (#411) (70754a2)
• add directive for removing blank nodes (#404) (c9d60c9)
• Add support for CSS aspect-ratio (#408) (93bee73)
• Allow universal CSS values for all properties (#410) (9723267)

Bug Fixes

• Adjust Core.AllowHostnameUnderscore to consider that "_" is defined as Unreserved Characters in RFC 3986 (#406) (d9fbef8)
• Avoid a deprecated error when the attribute name is numeric and DirectLex is used (#412) (f0fbf51)
• checking that node has property name (#399) (9ca5a36)
• Ignore conditional comments (#401) (4828fdf)
• Support PHP 8.4 (#396) (92da247)
• undefined array key warning (#419) (01be377)

Features

• Add allowfullscreen attr for iframe (#411) (70754a2)
• add directive for removing blank nodes (#404) (c9d60c9)
• Add support for CSS aspect-ratio (#408) (93bee73)
• Allow universal CSS values for all properties (#410) (9723267)

4.17.0 (2023-11-17)

Bug Fixes

• CSSTidy ImportantComments not handled properly (#359) (78a9b4d)
• fix CI (#361) (9ec687c)
• Invalid scheme check in Attr.TargetBlank (#363) (0176ef4)
• semantic release (#339) (d82f3d9)
• semantic release (#341) (e55fead), closes #339
• Support for locales using decimal separators other than . (dot) (#372) (43f49ac)

Features

• Add support for all text-decoration properties (#360) (2d775c0)
• Allows commas to be included in tel URI (#389) (ec92490), closes #388

Reverts

• Revert "fix: semantic release (#339)" (#340) (3e83215), closes #339 #340

Bug Fixes

• CSSTidy ImportantComments not handled properly (#359) (78a9b4d)
• fix CI (#361) (9ec687c)
• Invalid scheme check in Attr.TargetBlank (#363) (0176ef4)
• semantic release (#339) (d82f3d9)
• semantic release (#341) (e55fead), closes #339
• Support for locales using decimal separators other than . (dot) (#372) (43f49ac)

Features

• Add support for all text-decoration properties (#360) (2d775c0)
• Allows commas to be included in tel URI (#389) (ec92490), closes #388

Reverts

• Revert "fix: semantic release (#339)" (#340) (3e83215), closes #339 #340

NEWS ( CHANGELOG and HISTORY ) HTMLPurifier |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||

= KEY ==================== # Breaks back-compat ! Feature - Bugfix + Sub-comment . Internal change

4.15.0, released 2022-09-18 ! PHP 8.1 and 8.2 support, esp. fixes for deprecation warnings. A joint effort by David Rans, Tim Düsterhus, Kieran and John Flatness. ! Allow contenteditable="false" (#336), contributed by Kieran.

• Replace PHP 8.1 deprecated utf8_ functions with mbstring (#326), contributed by John Flatness.
• Enhanced composer suggestions with extensions (#317), contributed by func0der.

4.14.0, released 2021-12-24 ! Add "background-size" support (#289), contributed by Václav Smítal ! Transform deprecated width attribute when tidying HTML, contributed by Kieran.

• PHP 8 support, contributed by Maksims Sļotovs.
• Improved PHP 7.3 compatibility, contributed by kishor.
• Avoid spurious magic quotes notice in PHP 7.4. Thanks Jasper Zonneveld for the fix.
• Do not remove thead from table even if there are no tbody/tr (#264). Thanks Marcus Artner for the fix.
• Fix "Parameter must be an array or an object that implements Countable" (#285)". Thanks Kieran for this fix. . Fix unnecessary reference assignment, handling behavior change from PHP5 and PHP7. Thanks Arkadiusz Biczewski for the fix.

4.13.0, released 2020-06-28 ! Add %HTML.Forms directive, which lets you accept forms in user HTML without requiring full %HTML.Trusted. Note that forms can be (trivially) used to setup phishing; e.g., an attacker can use CSS absolute positioning to overlay a form on top of a login element, so please be sure to use this with care! Fixes #213. Thanks Mateusz Turcza for contributing this feature. ! tr@bgcolor attribute is now supported. Thanks Kieran Brahney for this enhancement.

• Further improvements to PHP 7.4 support, contributed by Witold Wasiczko and Eloy Lafuente.
• Fix PSR-0 compatibility. Thanks Jordi Boggiano for contributing part of this fix.
• Fix bug with purifyArray where it doesn't work on empty arrays. Thanks Fräntz Miccoli for the fix.
• Reduce amount of maintenance scripts included in distribution packages. Thanks Sergei Morozov for this patch.
• Remove leading zeros unless if it is only a zero, fixes #239. Thanks lubomirbartos for this fix.
• Correct type hinting of maybeGet*, fixes #240. Thanks Anders Jenbo for this fix.

4.12.0, released 2019-10-27 ! PHP 7.4 is supported, thank you Witold Wasiczko, Mateuz Turcza and Edi Modrić

• PHPDocs for HTMLModule::addElement() and Bool attr are fixed (thanks Mateusz)

4.11.0, released 2019-07-14

4.16.0 (2022-09-18)

Features

• add semantic release (#307) (db31243), closes #322 #323 #326 #327 #328 #329 #330 #331 #332 #333 #337 #335 ezyang/htmlpurifier#334 #336 #338