Bump justhtml from 2.2.0 to 3.10.1

[dependabot]

Bumps justhtml from 2.2.0 to 3.10.1.

Release notes

Sourced from justhtml's releases.

Release v3.10.1

Performance

• Answer the pretty-printer's "does this subtree contain a block element" question with a lazy per-run memo behind a bounded direct walk, rather than classifying every subtree in the document before serializing. Small subtrees -- nearly all of them -- no longer pay for an answer recorded for each of their descendants, which recovers about 8% of to_html() time on the web100k benchmark.

Fixed

• Keep the open-elements position index consistent when a node is inserted below the top of the stack, or when the stack grows past the indexing depth through such an insertion. Since 3.10.0, misnested formatting markup below about thirty levels of nesting could raise IndexError instead of parsing, for example "<div>" * 30 + "<i><blockquote><ul></i>".

v3.10.0

Performance

• Keep parsing, sanitization, deep cloning, pretty serialization, streaming, and diagnostic collection linear for deeply nested or repeatedly misnested adversarial input by indexing parser state and avoiding repeated subtree and sibling walks (thanks @​kevin-hua-kraken in #72).

Security

• (Severity: Low) Bound parser and sanitizer work for crafted deep nesting, foreign-content end tags, active formatting recovery, template cleanup, and nested disallowed wrappers that could previously trigger quadratic processing.

Fixed

• Make append_child(), insert_before(), and replace_child() splice DocumentFragment children into the target and empty the fragment, matching DOM behavior (thanks @​jph00 in #68).
• Preserve literal text when serializing the legacy raw-text elements iframe, noembed, noframes, and xmp, so parsing serialized output recovers the same text (thanks @​jph00 in #70).
• Minimize name-matching attribute values only for boolean attributes, preventing ordinary attributes such as id="id" from changing value during serialization (thanks @​jph00 in #69).

Release v3.9.0

Performance

Combined, the changes below reduce default-constructor parse time by about 9.5% relative to 3.8.0, on top of that release's 40% reduction from 3.7.1.

• Speed up the default JustHTML() constructor by about 3% on the web100k parser benchmark by moving the common text and compiled-attribute paths into their callers and avoiding full active-formatting bookkeeping for uncomplicated first entries.
• Reduce another 1.2% of default-constructor parse time by dispatching start and end tags before uncommon markup and removing redundant CDATA probes and regular-expression offset lookups while skipping dropped subtrees.
• Reduce default-constructor parse time by another 2% on a 1,000-document web100k sample by clearing stale foreign-context scan state, using C-level membership for ASCII tag dispatch, and inlining bounded case-insensitive raw-text matching.
• Reduce default-constructor parse time by another 3.6% on a 1,000-document web100k sample and shrink ordinary element nodes by one third by lazily allocating source-location metadata and bypassing adaptive stack bookkeeping for shallow end-tag mutations.

Release v3.8.0

Performance

On the web100k parser benchmark (1,000 documents, three iterations), the default JustHTML() constructor now completes in 13.020 seconds rather than 21.648 seconds in 3.7.1: a 40% reduction in parse time, or about 1.7× higher throughput.

• Speed up the default JustHTML() constructor by compiling common start/end-tag and URL-sanitization decisions, and by folding only names that the parser encounters instead of copying and lowercasing the full input.
• Reduce tree-construction overhead by adaptively tracking open elements, removing completed formatting entries without leaving tombstones, and deferring formatting-attribute signatures until duplicate tracking actually needs them.
• Remove redundant constructor-path work for discarded end-tag attributes, canonical attribute names, shallow non-paragraph stack updates, active-formatting bookkeeping, and parser state that could never become active.
• Cut fixed default-constructor overhead by reusing built-in execution plans, skipping no-op finalization and error-list work, lazily allocating formatting indexes, and collapsing duplicate shell, mode, and end-of-input state.
• Collapse common start-tag and text insertion-mode checks into synchronized state flags, avoiding repeated condition ladders in the default JustHTML() constructor.
• Avoid open-elements membership scans for ordinary HTML insertions and batch large disallowed-wrapper projections instead of repeatedly searching and shifting the same child lists.
• Remove already-resolved sanitizer insertion, unknown-tag condition ladders, template-mode lookups, and wrapper-list copies from the default JustHTML() constructor path.

Security

• (Severity: Low) Keep sanitization projection linear for large runs of disallowed sibling wrappers and avoid depth-proportional parent validation for nested wrappers. Previously, crafted wrapper-heavy HTML could make the default JustHTML() constructor take quadratic time.

... (truncated)

Changelog

Sourced from justhtml's changelog.

[3.10.1] - 2026-07-25

Performance

• Answer the pretty-printer's "does this subtree contain a block element" question with a lazy per-run memo behind a bounded direct walk, rather than classifying every subtree in the document before serializing. Small subtrees -- nearly all of them -- no longer pay for an answer recorded for each of their descendants, which recovers about 8% of to_html() time on the web100k benchmark.

Fixed

• Keep the open-elements position index consistent when a node is inserted below the top of the stack, or when the stack grows past the indexing depth through such an insertion. Since 3.10.0, misnested formatting markup below about thirty levels of nesting could raise IndexError instead of parsing, for example "<div>" * 30 + "<i><blockquote><ul></i>".

[3.10.0] - 2026-07-25

Performance

• Keep parsing, sanitization, deep cloning, pretty serialization, streaming, and diagnostic collection linear for deeply nested or repeatedly misnested adversarial input by indexing parser state and avoiding repeated subtree and sibling walks (thanks @​kevin-hua-kraken in #72).

Security

• (Severity: Low) Bound parser and sanitizer work for crafted deep nesting, foreign-content end tags, active formatting recovery, template cleanup, and nested disallowed wrappers that could previously trigger quadratic processing.

Fixed

• Make append_child(), insert_before(), and replace_child() splice DocumentFragment children into the target and empty the fragment, matching DOM behavior (thanks @​jph00 in #68).
• Preserve literal text when serializing the legacy raw-text elements iframe, noembed, noframes, and xmp, so parsing serialized output recovers the same text (thanks @​jph00 in #70).
• Minimize name-matching attribute values only for boolean attributes, preventing ordinary attributes such as id="id" from changing value during serialization (thanks @​jph00 in #69).

[3.9.0] - 2026-07-20

Performance

Combined, the changes below reduce default-constructor parse time by about 9.5% relative to 3.8.0, on top of that release's 40% reduction from 3.7.1.

• Speed up the default JustHTML() constructor by about 3% on the web100k parser benchmark by moving the common text and compiled-attribute paths into their callers and avoiding full active-formatting bookkeeping for uncomplicated first entries.
• Reduce another 1.2% of default-constructor parse time by dispatching start and end tags before uncommon markup and removing redundant CDATA probes and regular-expression offset lookups while skipping dropped subtrees.
• Reduce default-constructor parse time by another 2% on a 1,000-document web100k sample by clearing stale foreign-context scan state, using C-level membership for ASCII tag dispatch, and inlining bounded case-insensitive raw-text matching.
• Reduce default-constructor parse time by another 3.6% on a 1,000-document web100k sample and shrink ordinary element nodes by one third by lazily allocating source-location metadata and bypassing adaptive stack bookkeeping for shallow end-tag mutations.

[3.8.0] - 2026-07-19

Performance

On the web100k parser benchmark (1,000 documents, three iterations), the default JustHTML() constructor now completes in 13.020 seconds rather than 21.648 seconds in 3.7.1: a 40% reduction in parse time, or about 1.7× higher throughput.

• Speed up the default JustHTML() constructor by compiling common start/end-tag and URL-sanitization decisions, and by folding only names that the parser encounters instead of copying and lowercasing the full input.
• Reduce tree-construction overhead by adaptively tracking open elements, removing completed formatting entries without leaving tombstones, and deferring formatting-attribute signatures until duplicate tracking actually needs them.
• Remove redundant constructor-path work for discarded end-tag attributes, canonical attribute names, shallow non-paragraph stack updates, active-formatting bookkeeping, and parser state that could never become active.
• Cut fixed default-constructor overhead by reusing built-in execution plans, skipping no-op finalization and error-list work, lazily allocating formatting indexes, and collapsing duplicate shell, mode, and end-of-input state.
• Collapse common start-tag and text insertion-mode checks into synchronized state flags, avoiding repeated condition ladders in the default JustHTML() constructor.
• Avoid open-elements membership scans for ordinary HTML insertions and batch large disallowed-wrapper projections instead of repeatedly searching and shifting the same child lists.
• Remove already-resolved sanitizer insertion, unknown-tag condition ladders, template-mode lookups, and wrapper-list copies from the default JustHTML() constructor path.

... (truncated)

Commits

• 19158ac Release v3.10.1
• 2635d70 docs: Prepare 3.10.1 changelog
• e69978c Merge pull request #75 from kevin-hua-kraken/perf/pretty-block-memo
• 24a0d61 Merge remote-tracking branch 'origin/main' into pr75-merge
• c2a8758 Merge pull request #74 from kevin-hua-kraken/fix/stack-index-corruption
• 84e099a test: Cover the fold over an empty element and a hole
• 75c88d2 test: Cover every ascending list on a mid-stack insert
• 6c28883 perf: Classify pretty-print block subtrees lazily
• 1713580 fix: Keep the open-element index consistent on mid-stack inserts
• af685d4 Release v3.10.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)