Release v3.15.0

Added

• Allow per-attribute literal and Regex(...) value allowlists in allowed_attributes, preserving URL and inline-style validation.
• Allow per-property CSS value allowlists with literal strings and Regex(...) patterns, including explicit permission for CSS variable references.

Security

• Keep script scanning linear across repeated HTML comment markers, including with default sanitization and the event stream API.
• Bound Markdown list indentation to prevent quadratic output expansion from deeply nested lists.
• Reject non-ASCII IPv4 octets during linkification without raising conversion errors on Unicode digit lookalikes.

Fixed

• Keep whitespace after a <base>, <link> or <meta> that implies the <head> in the head, including when sanitization removes the metadata element.