v1.14.0

What's Changed

• 👷 ci(fuzz): run the deep fuzzer daily by @gaborbernat in #959
• 🐛 fix(js): bound empty member-name read by @gaborbernat in #949
• 🐛 fix(dom): survive tree edits during live walks by @gaborbernat in #950
• 🐛 fix(relaxng): reject invalid grammars at compile by @gaborbernat in #951
• 🐛 fix(css): guard crash, bound rule merge by @gaborbernat in #952
• 🐛 fix(xslt): cap built-in rule recursion depth by @gaborbernat in #953
• 🐛 fix(parse): bound formatting-element DOM growth by @gaborbernat in #954
• 🐛 fix(xml): dedup attributes in linear time by @gaborbernat in #955
• 🐛 fix(serialize): make xml output well-formed by @gaborbernat in #963
• 🐛 fix(detect): match parser on UTF-32 BOM bytes by @gaborbernat in #964
• 🐛 fix(xslt): reject UNC paths in xsl:import by @gaborbernat in #965
• 🐛 fix(detect): BOM codec decodes with replace by @gaborbernat in #961
• 🔒 fix(url): attribute hosts the WHATWG way by @gaborbernat in #960
• 🐛 fix(sanitize): vet <style> rule preludes by @gaborbernat in #958
• 🐛 fix(xpath): cap str:padding at 100,000 by @gaborbernat in #957
• 🐛 fix(url): bound and validate IDNA ToASCII by @gaborbernat in #966
• 🐛 fix(xsd): reject unresolvable and cyclic schemas by @gaborbernat in #956
• 🐛 fix(extract): cap JSON-LD nesting depth by @gaborbernat in #962
• 🐛 fix(detect): drop stale UTF-32 BOM test cases by @gaborbernat in #967
• 🧪 test: replace wall-clock checks with a bench by @gaborbernat in #975
• 🔒 fix(sanitize): read URL scheme the WHATWG way by @gaborbernat in #974
• 🐛 fix(css): keep merge property scan in the body by @gaborbernat in #972
• 👷 ci(fuzz): hide crashers, add a malloc pass by @gaborbernat in #970
• 🐛 fix(js): treat param-named function as a write by @gaborbernat in #986
• 🐛 fix(js): reject nameless function declarations by @gaborbernat in #990
• 🐛 fix(xml): reject xmlns:p="" undeclaring by @gaborbernat in #989
• 🐛 fix(core): skip mem* calls on NULL empty runs by @gaborbernat in #977
• 🐛 fix(serialize): write raw-text element children as markup by @gaborbernat in #994
• 🐛 fix(xml): resolve namespace prefixes by hash by @gaborbernat in #979
• 🐛 fix(serialize): write raw-text inner content literally by @gaborbernat in #999
• 🧪 test: drop stale #977 leftovers by @gaborbernat in #995
• 🐛 fix(js): clear children of emptied nodes by @gaborbernat in #992
• ♻️ refactor: bring the security fixes to house style by @gaborbernat in #978
• 🧪 test(fuzz): add sanitizer wrong-output oracles by @gaborbernat in #971
• 🐛 fix(js): keep async function expression name and * by @gaborbernat in #1000
• 🐛 fix(js): hoist catch and if-clause function decls by @gaborbernat in #1001
• 🐛 fix(js): keep parentheses V8 needs on pattern args by @gaborbernat in #1003
• 🐛 fix(js): keep fold semantics-preserving by @gaborbernat in #1004
• 🐛 fix(js): never mangle into a kept binding name by @gaborbernat in #1007
• 🐛 fix(css): read merge property names by token by @gaborbernat in #1006
• 🐛 fix(serialize): ignore void children in inner_html by @anshurajbisoyi98-ctrl in #1008
• 🐛 fix(css): decode escaped names in the merge check by @gaborbernat in #1023
• 🐛 fix(css): read a trailing backslash as U+FFFD by @gaborbernat in #1022
• 🧪 test(fuzz): score super-linear time and output by @gaborbernat in #1020
• 🐛 fix(js): parse await, static blocks and import() by @gaborbernat in #1029
• 🧪 test(fuzz): give the slope probe a synthetic cost by @gaborbernat in #1045
• 🐛 fix(parse): skip disabled selectedcontent by @gaborbernat in #1044
• 🐛 fix(css): read a dimension unit as an ident by @gaborbernat in #1050
• 🐛 fix(css): keep the space ending a hex escape by @gaborbernat in #1049
• 🐛 fix(css): close an unterminated url or string by @gaborbernat in #1048
• 🐛 fix(render): size table rows for nested row groups by @gaborbernat in #1047
• 👷 ci(fuzz): give the WPT checkout an origin remote by @gaborbernat in #1041
• 🐛 fix(js): reject let bindings and duplicate params by @gaborbernat in #1030
• 🧪 test(fuzz): add round-trip oracles by @gaborbernat in #1042
• ⚡ perf(parse): clone a selected option in O(1) by @gaborbernat in #1057
• 👷 ci: move arm64 MSVC setup off Node 20, bump deps by @gaborbernat in #1043
• 🐛 fix(render): render trees of any depth by @gaborbernat in #1046
• 🔒 fix(sanitize): make output parse-stable by @gaborbernat in #1002
• 🧪 test(fuzz): drop two sanitizer oracle false positives by @gaborbernat in #1080
• 🐛 fix(render): bound list and quote indentation by @gaborbernat in #1079
• ⚡ perf(select): match the sibling combinator in linear time by @gaborbernat in #1081
• 🐛 fix(css): keep an escaped custom property name's case by @gaborbernat in #1083
• 🐛 fix(js): treat leading let as an identifier by @gaborbernat in #1084
• 🐛 fix(css): keep url() with a modifier in @import by @gaborbernat in #1082
• 🐛 fix(xml): accept an empty comment before the root by @gaborbernat in #1087
• 🐛 fix(convert): css_to_xpath empty value with i flag by @gaborbernat in #1086
• 🐛 fix(parse): reset insertion mode skips foreign html by @gaborbernat in #1090
• 📝 docs(changelog): shorten recent fragments by @gaborbernat in #1103
• 🐛 fix(xpath): allow an operator name after a * test by @gaborbernat in #1085
• 🐛 fix(parse): no end-tag span for an unclosed element by @gaborbernat in #1089
• 🐛 fix(parse): drop pre leading newline in template row by @gaborbernat in #1091
• 🐛 fix(sanitize): keep escaped table tags in order by @gaborbernat in #1095
• 📝 docs(changelog): correct the #1087 fragment by @gaborbernat in #1122
• 🐛 fix(parse): ignore end tag with body out of scope by @gaborbernat in #1092
• 🐛 fix(css): don't fuse a number into an e-unit by @gaborbernat in #1097
• 🐛 fix(css): drop stray token between top rules by @gaborbernat in #1104
• 🐛 fix(serialize): make XML output re-read via parse_xml by @gaborbernat in #1088
• 🐛 fix(js): reject missing statement terminator by @gaborbernat in #1100
• 🐛 fix(parse): follow spec for selectedcontent options by @gaborbernat in #1093
• 🐛 fix(js): flatten nested blocks in one pass by @gaborbernat in #1094
• 🐛 fix(css): keep an illegal rgb() argument shape by @gaborbernat in #1117
• 🐛 fix(css): keep meaning-changing spaces in minify by @gaborbernat in #1098
• 🐛 fix(js): reject declarations in statement bodies by @gaborbernat in #1123
• 🐛 fix(xslt): hash nodes by sequence not address by @gaborbernat in #1102
• 🐛 fix(markdown): round-trip inline delimiters by @gaborbernat in #1099
• 🐛 fix(css): don't fuse idents in a property name by @gaborbernat in #1115
• 🐛 fix(markdown): round-trip five inline and list cases by @gaborbernat in #1096
• 🐛 fix(convert): require the attribute for empty |= by @gaborbernat in #1124
• 🐛 fix(css): drop rule with an empty selector by @gaborbernat in #1105
• 🐛 fix(css): keep an escaped space in a name by @gaborbernat in #1116
• 🐛 fix(css): close a bare block left open by @gaborbernat in #1101
• 🐛 fix(css): keep number boundary in at-rule/calc by @gaborbernat in #1106
• 🐛 fix(js): store fold list head after the call by @gaborbernat in #1126
• 🐛 fix(js): keep a binding read after its read moves by @gaborbernat in #1125
• 🐛 fix(css): merge @media rules in one pass by @gaborbernat in #1107
• 🐛 fix(css): keep {} blocks in a custom property by @gaborbernat in #1129
• 🐛 fix(dom): reject children for a built frame by @gaborbernat in #1130
• 🐛 fix(parse): fill selectedcontent inserted late by @gaborbernat in #1131
• 🐛 fix(render): cap indentation at 17 nesting levels by @gaborbernat in #1132
• 🐛 fix(css): end a final statement at-rule with ; by @gaborbernat in #1133
• ✨ feat(css): drop spaces next to a prelude string by @gaborbernat in #1134
• 🐛 fix(css): finish value rewrites in one call by @gaborbernat in #1136
• 🐛 fix(css): drop rules holding a bad string by @gaborbernat in #1135
• 🐛 fix(css): merge @media twins across dropped rules by @gaborbernat in #1137
• 🐛 fix(js): reject more early-error programs by @gaborbernat in #1138
• ✨ feat(css): shorten escaped names by @gaborbernat in #1142
• ✨ feat(js): drop constant statements, print {} as ; by @gaborbernat in #1140
• ✨ feat(js): shorten static{}, new, async and else by @gaborbernat in #1139
• 🐛 fix(css): preserve box-edge fallbacks by @gaborbernat in #1143
• 🐛 fix(css): preserve selector token roles by @gaborbernat in #1144
• ✨ feat(fuzz): detect unstable URL output by @gaborbernat in #1145
• 🐛 fix(css): preserve position delimiters by @gaborbernat in #1146
• 🐛 fix(css): preserve invalid math whitespace by @gaborbernat in #1147
• ⚡ perf(select): reuse sibling walk results by @gaborbernat in #1141
• 🧪 test(fuzz): check RELAX NG corpus labels by @gaborbernat in #1150
• 🐛 fix(css): preserve trailing decimal points by @gaborbernat in #1148
• ✨ feat(fuzz): check encoding invariants by @gaborbernat in #1152
• 🐛 fix(css): retain auto after functions by @gaborbernat in #1169
• 🐛 fix(rng): enforce numeric range facets by @gaborbernat in #1174
• 🐛 fix(rng): enforce data exclusions by @gaborbernat in #1165
• 🐛 fix(css): preserve z-index integer roles by @gaborbernat in #1151
• 🐛 fix(css): preserve quoted position values by @gaborbernat in #1154
• 🧪 test(fuzz): compare anchored XPath results by @gaborbernat in #1153
• 🐛 fix(rng): reject foreign schema roots by @gaborbernat in #1156
• 🐛 fix(rng): default untyped values to tokens by @gaborbernat in #1161
• 🐛 fix(css): preserve box substitution values by @gaborbernat in #1173
• ✨ feat(fuzz): generate custom CSS tokens by @gaborbernat in #1167
• 🐛 fix(css): preserve nested rule boundaries by @gaborbernat in #1163
• 🐛 fix(rng): match empty element content by @gaborbernat in #1171
• 🐛 fix(url): reject unstable cleaned hosts by @gaborbernat in #1149
• ✨ feat(fuzz): check DOM observer sequences by @gaborbernat in #1162
• 🐛 fix(css): preserve invalid background pairs by @gaborbernat in #1166
• ✨ feat(fuzz): generate XML lexical islands by @gaborbernat in #1172
• 🐛 fix(url): normalize file path separators by @gaborbernat in #1175
• ✨ feat(fuzz): add bounded XML grammar by @gaborbernat in #1170
• ✨ feat(fuzz): check iterator edit sequences by @gaborbernat in #1164
• ✨ feat(fuzz): generate literal sibling trees by @gaborbernat in #1168
• ✨ feat(fuzz): check link resolution targets by @gaborbernat in #1159
• ✨ feat(fuzz): pin valid IDNA mappings by @gaborbernat in #1155
• ✨ feat(fuzz): check streaming byte parsing by @gaborbernat in #1160
• 👷 ci: shallow-clone pinned fixtures by @gaborbernat in #1158
• ✨ feat(fuzz): check canonical IDNA host forms by @gaborbernat in #1176
• ✨ feat(fuzz): generate SVG integration trees by @gaborbernat in #1177
• 🐛 fix(css): preserve functional universal stars by @gaborbernat in #1178
• ♻️ refactor(url): share the IDNA pipeline by @gaborbernat in #1179
• ✨ feat(fuzz): check BOM declaration priority by @gaborbernat in #1180
• fix(css): preserve position functions by @gaborbernat in #1182
• ✨ feat(fuzz): cover encoding pragma forms by @gaborbernat in #1181
• ✨ feat(fuzz): cover UTF-16 meta rewrites by @gaborbernat in #1183
• ✨ feat(fuzz): check nested list attachment by @gaborbernat in #1184
• ✨ feat(fuzz): cover windows-1252 labels by @gaborbernat in #1186
• fix(css): preserve font functions by @gaborbernat in #1187
• ✨ feat(fuzz): check table row groups by @gaborbernat in #1185
• ✨ feat(fuzz): check standalone IDNA invariants by @gaborbernat in #1188
• 🐛 fix(xsd): reject invalid declarations by @gaborbernat in #1191
• ✨ feat(fuzz): expand pinned HTML generation by @gaborbernat in #1192
• 🐛 fix(url): reject mapped host delimiters by @gaborbernat in #1193
• fix(fuzz): reject documented Atheris input errors by @gaborbernat in #1190
• 👷 ci(coverage): report macOS selector gaps by @gaborbernat in #1189
• feat(fuzz): group saved crash reports by @gaborbernat in #1194
• feat(fuzz): add structural reduction by @gaborbernat in #1195
• feat(fuzz): bound XML grammar expansion by @gaborbernat in #1196
• feat(fuzz): add qualified public consumers by @gaborbernat in #1197
• fix(schema): compare inline reference results by @gaborbernat in #1198
• fix(rng): reject resource references without href by @gaborbernat in #1199
• feat(fuzz): route generated Atheris corpora by @gaborbernat in #1200
• feat(fuzz): add bounded DOM byte programs by @gaborbernat in #1203
• feat(fuzz): add bounded Markdown grammars by @gaborbernat in #1204
• feat(fuzz): add bounded CSS grammar by @gaborbernat in #1201
• ci: overlap corpus and tool setup by @gaborbernat in #1202
• feat(fuzz): generate bounded encoding inputs by @gaborbernat in #1205
• feat(fuzz): check exact JavaScript input by @gaborbernat in #1206
• 🐛 fix(fuzz): accept unwritable Markdown shapes by @gaborbernat in #1208
• feat(fuzz): admit generated source corpus by @gaborbernat in #1207
• 🐛 fix(markdown): keep empty quotes and code blocks by @gaborbernat in #1209
• 🐛 fix(fuzz): split Markdown meaning at blocks by @gaborbernat in #1211
• 🐛 fix(markdown): keep empty link destinations by @gaborbernat in #1212
• 🐛 fix(markdown): keep leading and repeated breaks by @gaborbernat in #1210
• 🐛 fix(markdown): loosen items with text after a block by @gaborbernat in #1216
• 🐛 fix(fuzz): read the converted tree for meaning by @gaborbernat in #1221
• 👷 ci(codspeed): time out a stalled glibc upgrade by @gaborbernat in #1220
• 🐛 fix(markdown): keep line breaks inside code spans by @gaborbernat in #1213
• 🐛 fix(markdown): close emphasis around inner blocks by @gaborbernat in #1215
• ✨ feat(fuzz): add a fuzz-only C build mode by @gaborbernat in #1217
• ✨ feat(validate): resolve RELAX NG include files by @gaborbernat in #1218
• 🐛 fix(dom): guard callback reentry and id probes by @gaborbernat in #1222
• ✨ feat(fuzz): verify trees across lifecycle programs by @gaborbernat in #1223
• 🐛 fix(markdown): keep block content in headings by @gaborbernat in #1214
• ✨ feat(fuzz): stop XPath and XSLT at an op limit by @gaborbernat in #1219
• 🐛 fix(fuzz): link the JS harness against libFuzzer by @gaborbernat in #1225
• ✨ feat(fuzz): run ClusterFuzzLite and build for OSS-Fuzz by @gaborbernat in #1226
• 🐛 fix(dom): drop id anchors for detached elements by @gaborbernat in #1227
• 🐛 fix(dom): run iterator removal steps on live trees by @gaborbernat in #1228
• 🐛 fix(dom): keep edits on the tree they locked by @gaborbernat in #1229
• 🐛 fix(dom): lock the container in Range constructors by @gaborbernat in #1230
• 🐛 fix(dom): lock node arguments in Range methods by @gaborbernat in #1231
• 🐛 fix(fuzz): drop spaces before a Markdown break by @gaborbernat in #1232
• ✨ feat(fuzz): drive Atheris with a failure header by @gaborbernat in #1234
• 🐛 fix(fuzz): size harness buffers to their input by @gaborbernat in #1235
• 🐛 fix(fuzz): compile out replay helpers in fuzz mode by @gaborbernat in #1236
• 🐛 fix(markdown): drop whitespace in link destinations by @gaborbernat in #1237
• 🐛 fix(markdown): keep edge spaces in inline code by @gaborbernat in #1238
• 🐛 fix(select): raise MemoryError on selector OOM by @gaborbernat in #1233
• 🐛 fix(fuzz): name the crashing target in CFLite output by @gaborbernat in #1239
• 🐛 fix(fuzz): compare open CSS blocks as the spec reads them by @gaborbernat in #1240
• 🐛 fix(markdown): keep emphasis around table cells by @gaborbernat in #1241
• 🐛 fix(css): raise MemoryError on minifier OOM by @gaborbernat in #1242
• ✨ feat(fuzz): run normalize and Range extraction ops by @gaborbernat in #1243
• ✨ feat(fuzz): add MSan lanes and threaded DOM runs by @gaborbernat in #1244
• 🐛 fix(markdown): keep line breaks inside pre blocks by @gaborbernat in #1245
• 🐛 fix(markdown): bracket control chars in link destinations by @gaborbernat in #1248
• 🐛 fix(markdown): raise MemoryError on lost buffer failures by @gaborbernat in #1247
• 🐛 fix(js): raise MemoryError on minifier OOM by @gaborbernat in #1253
• 👷 ci(fuzz): fuzz main pushes instead of PRs by @gaborbernat in #1250
• 🐛 fix(css): read blocks and escapes in custom properties by @gaborbernat in #1246
• 🐛 fix(markdown): close emphasis around block quotes by @gaborbernat in #1249
• 🐛 fix(markdown): skip elements browsers do not render by @gaborbernat in #1251
• 🐛 fix(dom): recheck imported copy before linking by @gaborbernat in #1254
• 🐛 fix(markdown): keep line breaks out of link titles by @gaborbernat in #1259
• ⚡ perf(js): skip the sink outside a parse by @gaborbernat in #1257
• 🐛 fix(markdown): escape character references split across nodes by @gaborbernat in #1256
• 🐛 fix(css): keep escaped slashes out of comments by @gaborbernat in #1255
• 🐛 fix(parse): raise MemoryError on tokenizer OOM by @gaborbernat in #1252
• 🐛 fix(dom): raise MemoryError on construction OOM by @gaborbernat in #1262
• 🐛 fix(markdown): drop table rows without cells by @gaborbernat in #1261
• 🐛 fix(fuzz): read code text off the tree by @gaborbernat in #1271
• 🐛 fix(markdown): split lists across empty blocks by @gaborbernat in #1263
• 🐛 fix(linkify): raise MemoryError on walk OOM by @gaborbernat in #1273
• 🐛 fix(markdown): skip template content when rendering by @gaborbernat in #1260
• 🐛 fix(markdown): keep emphasis runs from merging by @gaborbernat in #1264
• 🐛 fix(xslt): keep xsl:number values in range by @gaborbernat in #1265
• 🐛 fix(markdown): flatten blocks in table cells by @gaborbernat in #1268
• 🐛 fix(fuzz): read a run of breaks as no paragraph by @gaborbernat in #1270
• ✨ feat(fuzz): share trees across threaded DOM runs by @gaborbernat in #1274
• ✨ feat(fuzz): sweep injected allocation failures by @gaborbernat in #1277
• 🐛 fix(markdown): put list blocks on readable lines by @gaborbernat in #1266
• 🐛 fix(markdown): escape inline syntax in image alt text by @gaborbernat in #1258
• 🐛 fix(fuzz): flatten blocks inside inline runs by @gaborbernat in #1272
• 🐛 fix(markdown): drop breaks before empty elements by @gaborbernat in #1267
• 🐛 fix(markdown): loosen items with wrapped blocks by @gaborbernat in #1269
• ✨ feat(fuzz): add three allocation sweep targets by @gaborbernat in #1278

New Contributors

• @anshurajbisoyi98-ctrl made their first contribution in #1008

Full Changelog: 1.13.1...1.14.0