dependabot[bot] opened a new pull request, #7494: URL: https://github.com/apache/myfaces-tobago/pull/7494
Bumps [org.jsoup:jsoup](https://github.com/jhy/jsoup) from 1.22.2 to 1.23.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jhy/jsoup/releases";>org.jsoup:jsoup's releases</a>.</em></p> <blockquote> <h2>jsoup 1.23.1</h2> <h1>jsoup Java HTML Parser release 1.23.1</h1> <p><strong>jsoup 1.23.1</strong> is out now, with a faster and more memory-efficient HTML parser, improved alignment with the HTML standard across <code>noscript</code>, CDATA, SVG, and MathML parsing, and safer, specification-correct HTTP redirects. The release also adds a fast immutable <code>Element#classList()</code>, direct outer-HTML output to an <code>Appendable</code>, and fixes across RCDATA parsing, XML conversion, tag-name handling, and Cleaner link detection.</p> <p>Performance optimization was a major focus for this release. In our OpenJDK 21 benchmarks, ordinary string parsing is now 18% faster on average, parsing from an <code>InputStream</code> is 11% faster, and parsing with source position tracking is 70% faster while allocating 64% fewer bytes per document.</p> <p>Source-tracked DOMs retain 58-65% less memory on representative medium-to-large documents, and the improvements hold under concurrent parsing without introducing new contention. Exact gains will naturally vary with document shape, JVM, and hardware.</p> <p>This release also fixes a <a href="https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8";>security issue in the Cleaner</a> that could expose markup when malformed HTML is cleaned with a custom <code>Safelist</code> permitting certain raw-text elements. The built-in Safelists are unaffected.</p> <p><strong>jsoup</strong> is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.</p> <p><a href="https://github.com/jhy/jsoup/blob/HEAD/download";><strong>Download</strong></a> jsoup now.</p> <h2>Improvements</h2> <ul> <li>Reduced retained memory when parsing with source position tracking enabled (<code>Parser#setTrackPosition(true)</code>). Source ranges are now stored in compact parser-owned span records instead of node and attribute user data, and <code>Position</code> objects are created lazily when source ranges are read. This cuts tracked DOM retained size by about 50-60% on representative benchmark documents, while keeping <code>Node#sourceRange()</code>, <code>Element#endSourceRange()</code>, and <code>Attribute#sourceRange()</code> behavior intact. <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/pull/2498";>#2498</a><!-- raw HTML omitted --></li> <li>Added <code>Element#classList()</code>, an immutable snapshot of an element's class names in attribute order. Use <code>hasClass()</code> when you just need to test for one class, <code>classList()</code> when you want to read or iterate classes without needing a mutable result, and <code>classNames()</code> when you want the existing mutable, deduplicated set that can be written back with <code>classNames(Set)</code>. The class APIs now share an HTML-whitespace scanner, which also makes <code>classNames()</code> faster and lighter on allocation, especially when walking many elements without class names. <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/pull/2500";>#2500</a><!-- raw HTML omitted --></li> <li>Aligned HTML parser scope classification with the current HTML spec for <code>select</code>, <code>foreignObject</code>, and <code>template</code>. <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/issues/2501";>#2501</a><!-- raw HTML omitted --></li> <li>Simplified the HTML tree builder's scope, implied-end-tag, and special-element checks by caching parser-only options on Tag. That improves HTML parser throughput by about 10% on small inputs and up to about 30% on larger inputs in the benchmark fixtures. <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/issues/2502";>#2502</a><!-- raw HTML omitted --></li> <li>Improved HTML parser throughput stability by making hot tokeniser scan paths compile more predictably. <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/pull/2507";>#2507</a><!-- raw HTML omitted --></li> <li><code><noscript></code> fallback markup is now parsed into an inspectable DOM subtree in both the document head and body. The fallback acts as a contained parsing island, so malformed markup cannot disrupt the surrounding document structure, while normal HTML tokenization still applies within it. This also improves round-trip serialization. <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/pull/2537";>#2537</a><!-- raw HTML omitted --></li> <li>Improved redirect credential handling as a defense-in-depth measure: explicit authorization headers and request cookies are no longer forwarded across origins, reducing exposure through open redirects and aligning with HTTP guidance. Cookies managed by a <code>CookieStore</code> continue to follow their configured scope. <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/pull/2540";>#2540</a><!-- raw HTML omitted --></li> <li>Elements can now append their outer HTML, including their own tags, directly to an <code>Appendable</code> with <code>Node#outerHtml(Appendable)</code>, without first creating a <code>String</code>. This complements <code>Element#html(Appendable)</code>, which appends inner HTML only. <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/issues/2532";>#2532</a><!-- raw HTML omitted --></li> <li>Aligned CDATA tokenization with the HTML spec: CDATA syntax in HTML content is parsed as a bogus comment, while it remains supported in SVG, MathML, and XML. Also improved namespace-aware fragment parsing so SVG and MathML contexts, HTML integration points, and context-sensitive tokenizer states are handled correctly. <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/issues/2542";>#2542</a><!-- raw HTML omitted --></li> <li>When using the optional <code>re2j</code> regular expression engine, stack overflows caused by complex selector patterns are now normalized to a <code>ValidationException</code> with a <code>Pattern complexity error</code> message. <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/issues/2548";>#2548</a><!-- raw HTML omitted --></li> </ul> <h2>Bug Fixes</h2> <ul> <li>Fixed HTML parsing of mixed-case RCDATA end tags after tag-shaped text. For example, <code><title><p>Foo</TiTLE></code> and <code><textarea><img src=x></TeXtArEa></code> now keep the tag-shaped content as text instead of promoting it to markup. <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/issues/2503";>#2503</a><!-- raw HTML omitted --></li> <li>Fixed <code>W3CDom</code> XML conversion so plain XML elements don't serialize with the reserved XML namespace as the default namespace. Explicit XML namespaces and <code>xml:*</code> attributes are still preserved. <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/issues/2504";>#2504</a><!-- raw HTML omitted --></li> <li>Preserve control characters in parsed tag names <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/issues/2538";>#2538</a><!-- raw HTML omitted --></li> <li>Updated HTTP redirects to follow the specification: 307 and 308 preserve the request method and content, 301 and 302 only change POST to GET, and <code>Location</code> is followed only for 301, 302, 303, 307, and 308 responses. Streamed request bodies are not buffered; if an automatic redirect requires replaying one, execution fails, so the caller can resend with a fresh stream. <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/pull/2540";>#2540</a><!-- raw HTML omitted --></li> <li>Corrected the Cleaner's same-site link detection to compare hostnames rather than URL prefixes when applying <code>rel=nofollow</code>. <!-- raw HTML omitted --><a href="https://redirect.github.com/jhy/jsoup/issues/2543";>#2543</a><!-- raw HTML omitted --></li> </ul> <h2>Build Changes</h2> <ul> <li>Cleaned up the Maven build for the multi-release JAR so Java 8 and Java 11+ sources compile as separate source sets. This avoids spurious Java 8 compiler warnings from newer-language overlay sources, keeps long-running parser checks behind an explicit profile, and preserves the same published artifacts and runtime behavior.</li> <li>Improved parallelism and tuned timing in our integration tests, so that a full <code>mvn clean verify</code> drops from ~ 1m18s to ~ 21 seconds.</li> </ul> <hr /> <p>My sincere thanks to everyone who contributed to this release! If you have any suggestions for the next release, I would love to hear them; please get in touch via <a href="https://github.com/jhy/jsoup/discussions";>jsoup discussions</a>, or with me <a href="https://jhedley.com/";>directly</a>.</p> <p>You can also <!-- raw HTML omitted -->follow me<!-- raw HTML omitted --> (<!-- raw HTML omitted --><!-- raw HTML omitted -->@<a href="mailto:[email protected]";>[email protected]</a><!-- raw HTML omitted --><!-- raw HTML omitted -->) on Mastodon / Fediverse to receive occasional notes about jsoup releases.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jhy/jsoup/blob/master/CHANGES.md";>org.jsoup:jsoup's changelog</a>.</em></p> <blockquote> <h2>1.23.1 (2026-Jul-30)</h2> <h3>Improvements</h3> <ul> <li>Reduced retained memory when parsing with source position tracking enabled (<code>Parser#setTrackPosition(true)</code>). Source ranges are now stored in compact parser-owned span records instead of node and attribute user data, and <code>Position</code> objects are created lazily when source ranges are read. This cuts tracked DOM retained size by about 50-60% on representative benchmark documents, while keeping <code>Node#sourceRange()</code>, <code>Element#endSourceRange()</code>, and <code>Attribute#sourceRange()</code> behavior intact. <a href="https://redirect.github.com/jhy/jsoup/pull/2498";>#2498</a></li> <li>Added <code>Element#classList()</code>, an immutable snapshot of an element's class names in attribute order. Use <code>hasClass()</code> when you just need to test for one class, <code>classList()</code> when you want to read or iterate classes without needing a mutable result, and <code>classNames()</code> when you want the existing mutable, deduplicated set that can be written back with <code>classNames(Set)</code>. The class APIs now share an HTML-whitespace scanner, which also makes <code>classNames()</code> faster and lighter on allocation, especially when walking many elements without class names. <a href="https://redirect.github.com/jhy/jsoup/pull/2500";>#2500</a></li> <li>Aligned HTML parser scope classification with the current HTML spec for <code>select</code>, <code>foreignObject</code>, and <code>template</code>. <a href="https://redirect.github.com/jhy/jsoup/issues/2501";>#2501</a></li> <li>Simplified the HTML tree builder's scope, implied-end-tag, and special-element checks by caching parser-only options on Tag. That improves HTML parser throughput by about 10% on small inputs and up to about 30% on larger inputs in the benchmark fixtures. <a href="https://redirect.github.com/jhy/jsoup/issues/2502";>#2502</a></li> <li>Improved HTML parser throughput stability by making hot tokeniser scan paths compile more predictably. <a href="https://redirect.github.com/jhy/jsoup/pull/2507";>#2507</a></li> <li><code><noscript></code> fallback markup is now parsed into an inspectable DOM subtree in both the document head and body. The fallback acts as a contained parsing island, so malformed markup cannot disrupt the surrounding document structure, while normal HTML tokenization still applies within it. This also improves round-trip serialization. <a href="https://redirect.github.com/jhy/jsoup/pull/2537";>#2537</a></li> <li>Improved redirect credential handling as a defense-in-depth measure: explicit authorization headers and request cookies are no longer forwarded across origins, reducing exposure through open redirects and aligning with HTTP guidance. Cookies managed by a <code>CookieStore</code> continue to follow their configured scope. <a href="https://redirect.github.com/jhy/jsoup/pull/2540";>#2540</a></li> <li>Elements can now append their outer HTML, including their own tags, directly to an <code>Appendable</code> with <code>Node#outerHtml(Appendable)</code>, without first creating a <code>String</code>. This complements <code>Element#html(Appendable)</code>, which appends inner HTML only. <a href="https://redirect.github.com/jhy/jsoup/issues/2532";>#2532</a></li> <li>Aligned CDATA tokenization with the HTML spec: CDATA syntax in HTML content is parsed as a bogus comment, while it remains supported in SVG, MathML, and XML. Also improved namespace-aware fragment parsing so SVG and MathML contexts, HTML integration points, and context-sensitive tokenizer states are handled correctly. <a href="https://redirect.github.com/jhy/jsoup/issues/2542";>#2542</a></li> <li>When using the optional <code>re2j</code> regular expression engine, stack overflows caused by complex selector patterns are now normalized to a <code>ValidationException</code> with a <code>Pattern complexity error</code> message. <a href="https://redirect.github.com/jhy/jsoup/issues/2548";>#2548</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>Fixed HTML parsing of mixed-case RCDATA end tags after tag-shaped text. For example, <code><title><p>Foo</TiTLE></code> and <code><textarea><img src=x></TeXtArEa></code> now keep the tag-shaped content as text instead of promoting it to markup. <a href="https://redirect.github.com/jhy/jsoup/issues/2503";>#2503</a></li> <li>Fixed <code>W3CDom</code> XML conversion so plain XML elements don't serialize with the reserved XML namespace as the default namespace. Explicit XML namespaces and <code>xml:*</code> attributes are still preserved. <a href="https://redirect.github.com/jhy/jsoup/issues/2504";>#2504</a></li> <li>Preserve control characters in parsed tag names <a href="https://redirect.github.com/jhy/jsoup/issues/2538";>#2538</a></li> <li>Updated HTTP redirects to follow the specification: 307 and 308 preserve the request method and content, 301 and 302 only change POST to GET, and <code>Location</code> is followed only for 301, 302, 303, 307, and 308 responses. Streamed request bodies are not buffered; if an automatic redirect requires replaying one, execution fails, so the caller can resend with a fresh stream. <a href="https://redirect.github.com/jhy/jsoup/pull/2540";>#2540</a></li> <li>Corrected the Cleaner's same-site link detection to compare hostnames rather than URL prefixes when applying <code>rel=nofollow</code>. <a href="https://redirect.github.com/jhy/jsoup/issues/2543";>#2543</a></li> </ul> <h3>Build Changes</h3> <ul> <li>Cleaned up the Maven build for the multi-release JAR so Java 8 and Java 11+ sources compile as separate source sets. This avoids spurious Java 8 compiler warnings from newer-language overlay sources, keeps long-running parser checks behind an explicit profile, and preserves the same published artifacts and runtime behavior.</li> <li>Improved parallelism and tuned timing in our integration tests, so that a full <code>mvn clean verify</code> drops from ~ 1m18s to ~ 21 seconds.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jhy/jsoup/commit/bb077a8b0da1203cf11d5139967f0d52fe8f5a59";><code>bb077a8</code></a> [maven-release-plugin] prepare release jsoup-1.23.1</li> <li><a href="https://github.com/jhy/jsoup/commit/cdb5579d50b32ce464e08260f14dbd3994b05059";><code>cdb5579</code></a> Harden the test some</li> <li><a href="https://github.com/jhy/jsoup/commit/b86b282eeacaaf2bf1f440b17e713fcbeeafe176";><code>b86b282</code></a> Normalize re2j complexity exceptions</li> <li><a href="https://github.com/jhy/jsoup/commit/0fcc3691ac3b686dc2e90e15c536273c920136d2";><code>0fcc369</code></a> Bump github/codeql-action from 4.37.0 to 4.37.1</li> <li><a href="https://github.com/jhy/jsoup/commit/aea4a1b9af15af96f6aab50d51390a1bc68bb3f1";><code>aea4a1b</code></a> Bump actions/setup-java from 5.5.0 to 5.6.0</li> <li><a href="https://github.com/jhy/jsoup/commit/ec9c8798c08cbddc7c0f03b9c2321b469152a2c9";><code>ec9c879</code></a> Bump actions/checkout from 7.0.0 to 7.0.1</li> <li><a href="https://github.com/jhy/jsoup/commit/1fb2c97f34add3bab499bc603848d9c183df37ef";><code>1fb2c97</code></a> Fix <code>KeyVal.inputStream</code> validation</li> <li><a href="https://github.com/jhy/jsoup/commit/3475afc43aae34001dc45f1697dcf3d389ebb9c4";><code>3475afc</code></a> Handle non-string internal attribute values; test for internal attribute data</li> <li><a href="https://github.com/jhy/jsoup/commit/be8c37562cffa48c36a0f0bda93fc6502fb79b1f";><code>be8c375</code></a> Parse CDATA according to the context namespace</li> <li><a href="https://github.com/jhy/jsoup/commit/8996fce0844e852b1e8979f5cbdb0699ac540e0a";><code>8996fce</code></a> Add appendable outer HTML output</li> <li>Additional commits viewable in <a href="https://github.com/jhy/jsoup/compare/jsoup-1.22.2...jsoup-1.23.1";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
