Bump justhtml from 2.2.0 to 3.9.0

[dependabot]

Bumps justhtml from 2.2.0 to 3.9.0.

Release notes

Sourced from justhtml's releases.

Release v3.9.0

Performance

Combined, the changes below reduce default-constructor parse time by about 9.5% relative to 3.8.0, on top of that release's 40% reduction from 3.7.1.

• Speed up the default JustHTML() constructor by about 3% on the web100k parser benchmark by moving the common text and compiled-attribute paths into their callers and avoiding full active-formatting bookkeeping for uncomplicated first entries.
• Reduce another 1.2% of default-constructor parse time by dispatching start and end tags before uncommon markup and removing redundant CDATA probes and regular-expression offset lookups while skipping dropped subtrees.
• Reduce default-constructor parse time by another 2% on a 1,000-document web100k sample by clearing stale foreign-context scan state, using C-level membership for ASCII tag dispatch, and inlining bounded case-insensitive raw-text matching.
• Reduce default-constructor parse time by another 3.6% on a 1,000-document web100k sample and shrink ordinary element nodes by one third by lazily allocating source-location metadata and bypassing adaptive stack bookkeeping for shallow end-tag mutations.

Release v3.8.0

Performance

On the web100k parser benchmark (1,000 documents, three iterations), the default JustHTML() constructor now completes in 13.020 seconds rather than 21.648 seconds in 3.7.1: a 40% reduction in parse time, or about 1.7× higher throughput.

• Speed up the default JustHTML() constructor by compiling common start/end-tag and URL-sanitization decisions, and by folding only names that the parser encounters instead of copying and lowercasing the full input.
• Reduce tree-construction overhead by adaptively tracking open elements, removing completed formatting entries without leaving tombstones, and deferring formatting-attribute signatures until duplicate tracking actually needs them.
• Remove redundant constructor-path work for discarded end-tag attributes, canonical attribute names, shallow non-paragraph stack updates, active-formatting bookkeeping, and parser state that could never become active.
• Cut fixed default-constructor overhead by reusing built-in execution plans, skipping no-op finalization and error-list work, lazily allocating formatting indexes, and collapsing duplicate shell, mode, and end-of-input state.
• Collapse common start-tag and text insertion-mode checks into synchronized state flags, avoiding repeated condition ladders in the default JustHTML() constructor.
• Avoid open-elements membership scans for ordinary HTML insertions and batch large disallowed-wrapper projections instead of repeatedly searching and shifting the same child lists.
• Remove already-resolved sanitizer insertion, unknown-tag condition ladders, template-mode lookups, and wrapper-list copies from the default JustHTML() constructor path.

Security

• (Severity: Low) Keep sanitization projection linear for large runs of disallowed sibling wrappers and avoid depth-proportional parent validation for nested wrappers. Previously, crafted wrapper-heavy HTML could make the default JustHTML() constructor take quadratic time.

Release v3.7.0

Fixed

• Keep templates open in the head when they contain a processing instruction, matching the latest web-platform-tests tree-construction fixture.

Changed

• Refresh the web-platform-tests tree-construction fixtures and comparison scores.
• Make the correctness benchmark skip an optional html5-parser installation when its libxml2 ABI conflicts with lxml.

Release v3.6.1

Fixed

• Keep processing instructions inside a scripting-disabled head noscript, and process them in body mode inside templates as required by the latest WHATWG parsing rules.

Changed

• Move raw parser input/output regressions from Python unit tests into the shared tree-construction fixture format.

Release v3.6.0

Fixed

Note: The below are all minor parsing differences found when diffing against Chromium output, that is not covered in WPT's html5 parsing tests.

... (truncated)

Changelog

Sourced from justhtml's changelog.

[3.9.0] - 2026-07-20

Performance

Combined, the changes below reduce default-constructor parse time by about 9.5% relative to 3.8.0, on top of that release's 40% reduction from 3.7.1.

• Speed up the default JustHTML() constructor by about 3% on the web100k parser benchmark by moving the common text and compiled-attribute paths into their callers and avoiding full active-formatting bookkeeping for uncomplicated first entries.
• Reduce another 1.2% of default-constructor parse time by dispatching start and end tags before uncommon markup and removing redundant CDATA probes and regular-expression offset lookups while skipping dropped subtrees.
• Reduce default-constructor parse time by another 2% on a 1,000-document web100k sample by clearing stale foreign-context scan state, using C-level membership for ASCII tag dispatch, and inlining bounded case-insensitive raw-text matching.
• Reduce default-constructor parse time by another 3.6% on a 1,000-document web100k sample and shrink ordinary element nodes by one third by lazily allocating source-location metadata and bypassing adaptive stack bookkeeping for shallow end-tag mutations.

[3.8.0] - 2026-07-19

Performance

On the web100k parser benchmark (1,000 documents, three iterations), the default JustHTML() constructor now completes in 13.020 seconds rather than 21.648 seconds in 3.7.1: a 40% reduction in parse time, or about 1.7× higher throughput.

• Speed up the default JustHTML() constructor by compiling common start/end-tag and URL-sanitization decisions, and by folding only names that the parser encounters instead of copying and lowercasing the full input.
• Reduce tree-construction overhead by adaptively tracking open elements, removing completed formatting entries without leaving tombstones, and deferring formatting-attribute signatures until duplicate tracking actually needs them.
• Remove redundant constructor-path work for discarded end-tag attributes, canonical attribute names, shallow non-paragraph stack updates, active-formatting bookkeeping, and parser state that could never become active.
• Cut fixed default-constructor overhead by reusing built-in execution plans, skipping no-op finalization and error-list work, lazily allocating formatting indexes, and collapsing duplicate shell, mode, and end-of-input state.
• Collapse common start-tag and text insertion-mode checks into synchronized state flags, avoiding repeated condition ladders in the default JustHTML() constructor.
• Avoid open-elements membership scans for ordinary HTML insertions and batch large disallowed-wrapper projections instead of repeatedly searching and shifting the same child lists.
• Remove already-resolved sanitizer insertion, unknown-tag condition ladders, template-mode lookups, and wrapper-list copies from the default JustHTML() constructor path.

Security

• (Severity: Low) Keep sanitization projection linear for large runs of disallowed sibling wrappers and avoid depth-proportional parent validation for nested wrappers. Previously, crafted wrapper-heavy HTML could make the default JustHTML() constructor take quadratic time.

[3.7.1] - 2026-07-17

Fixed

• Make CollapseWhitespace(...) trim text at block-sibling and line-break boundaries, including <pre>, <hr>, and <br>.
• Preserve visible spacing around closed dialogs and hidden elements while ignoring comments, processing instructions, empty text nodes, and native non-rendering elements when locating rendered siblings.
• Collapse whitespace across adjacent text runs exposed by transforms such as Unwrap(...) and DropComments(...) without merging the text nodes.

[3.7.0] - 2026-07-15

Fixed

• Keep templates open in the head when they contain a processing instruction, matching the latest web-platform-tests tree-construction fixture.

Changed

• Refresh the web-platform-tests tree-construction fixtures and comparison scores.
• Make the correctness benchmark skip an optional html5-parser installation when its libxml2 ABI conflicts with lxml.

[3.6.1] - 2026-07-13

... (truncated)

Commits

• 8ede3ba Release v3.9.0
• 3edb954 docs: Prepare 3.9.0 changelog
• 02c008b docs: Update changelog to reflect 9.5% reduction in default-constructor parse...
• eec67d9 perf: Optimize node metadata handling and improve performance in parser and D...
• a82fe00 perf: Enhance parse performance by optimizing tag handling and ASCII checks
• 4e52b1d perf: Optimize parse time in ParseEngine by refining tag handling logic
• f06fd9f perf: Improvements for JustHTML() constructor and parser attribute handling
• 103c9aa deps: Update optional dependencies in pyproject.toml with version constraints
• abf0128 Release v3.8.0
• 302fb49 docs: Prepare 3.8.0 changelog
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #25235.