[dependabot]

Bumps css-inline from 0.21.3 to 0.22.0.

Release notes

Sourced from css-inline's releases.

[C] Release 0.22.0

Changed

• Update cssparser to 0.38.
• Update html5ever to 0.40.
• Update selectors to 0.41.

Fixed

• remove_inlined_selectors removed @-rules from the <style> blocks it rewrites (it should remove only inlined selectors).

Security

• class attribute values not HTML-escaped in the output, allowing markup injection via " in a class value. GHSA-jh54-c7gc-mvcc

[Java] Release 0.22.0

Changed

• Update cssparser to 0.38.
• Update html5ever to 0.40.
• Update selectors to 0.41.

Fixed

• remove_inlined_selectors removed @-rules from the <style> blocks it rewrites (it should remove only inlined selectors).

Security

• class attribute values not HTML-escaped in the output, allowing markup injection via " in a class value. GHSA-jh54-c7gc-mvcc

[JavaScript] Release 0.22.0

Changed

• Update cssparser to 0.38.
• Update html5ever to 0.40.
• Update selectors to 0.41.

Fixed

• remove_inlined_selectors removed @-rules from the <style> blocks it rewrites (it should remove only inlined selectors).

Security

• class attribute values not HTML-escaped in the output, allowing markup injection via " in a class value. GHSA-jh54-c7gc-mvcc

[Python] Release 0.22.0

Changed

• Update cssparser to 0.38.
• Update html5ever to 0.40.

... (truncated)

Changelog

Sourced from css-inline's changelog.

[0.22.0] - 2026-10-02

Changed

• Update cssparser to 0.38.
• Update html5ever to 0.40.
• Update selectors to 0.41.

Fixed

• remove_inlined_selectors removed @-rules from the <style> blocks it rewrites (it should remove only inlined selectors).

Security

• class attribute values not HTML-escaped in the output, allowing markup injection via " in a class value. GHSA-jh54-c7gc-mvcc

[0.21.2] - 2026-08-24

Fixed

• file:// stylesheet URLs not percent-decoded and broken on Windows drive letters.

[0.21.1] - 2026-08-08

Fixed

• With keep_at_rules enabled, at-rules without a block (e.g. @import) lost their prelude and terminator, fusing with the following rule (@import@media ...) and producing a stylesheet browsers reject entirely.

[0.21.0] - 2026-06-16

Changed

• Bump MSRV to 1.85.
• Update selectors to 0.38.
• Update cssparser to 0.37.

Fixed

• width/height HTML attributes not derived from an element's own inline style attribute. #725

[0.20.2] - 2026-04-02

Fixed

• inline_fragment silently returning only whitespace when the input starts with whitespace or contains structural HTML tags (<html>, <head>, <body>, <style>). #692 #693

[0.20.1] - 2026-03-26

Changed

... (truncated)

Commits

• 14ba94b chore(c): Release 0.22.0
• 7dc9dce chore(python): Release 0.22.0
• e1de61c fix: HTML-escape class attribute values
• ba71b28 fix: Keep @-rules in blocks rewritten by remove_inlined_selectors
• f1eca58 build(ruby): Update magnus to 0.9
• 38ae396 chore: Update cssparser to 0.38 & selectors to 0.41
• 1ce3e12 build: Skip fat LTO in Python test builds
• c80a66b build(deps): bump virtualenv in /bindings/python/requirements
• 4d23bfb build(deps): bump undici from 6.28.0 to 6.29.0 in /bindings/javascript
• 1f2c0fd build(deps): bump brace-expansion in /bindings/javascript
• Additional commits viewable in compare view

[coveralls]

coverage: 81.461%. remained the same — dependabot/uv/css-inline-0.22.0 into main