--===============8878067578371777259==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

# Security update for jsoup, re2j

Announcement ID: SUSE-SU-2026:23856-1
Release Date: 2026-09-21T12:40:20Z
Rating: important
References:

* bsc#1275912

Cross-References:

* CVE-2026-75140

CVSS scores:

* CVE-2026-75140 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-75140 ( NVD ): 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-75140 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

* SUSE Linux Enterprise Server 16.0

An update that solves one vulnerability can now be installed.

## Description:

This update for jsoup, re2j fixes the following issue:

* CVE-2026-75140: The builder copies the entire inherited namespace map on
every start element, causing quadratic time and memory complexity, which
attackers can exploit to trigger an OutOfMemoryError and terminate the
application (bsc#1275912).

Changes for jsoup:

* Upgrade to upstream version 1.23.2
* Improvement: Improved consecutive StreamParser.selectFirst() calls during
progressive parsing, so later matches are returned with their parsed
contents when earlier selections had left them as parser lookahead. E.g.,
given <title>One</title><p
id=hit>Full</p><p>Next</p>, selecting title and
then #hit now advances the partial lookahead and returns <p
id="hit">Full</p>, rather than returning an empty <p
id="hit"></p> before
its content is parsed. The updated readiness tracking follows
StreamParser's
normal emission order across implicit HTML structure and parser recovery.
* Improvement: Improved XML parser performance and memory use for documents
with many nested namespace declarations by recording namespace changes
within each element scope (bsc#1275912, CVE-2026-75140).
* Improvement: Improved W3CDom conversion performance for documents with many
nested namespace declarations. The W3C converter now uses the same
optimized
namespace tracking as the XML parser.
* Improvement: Improved W3CDom XML conversion to retain processing
instructions, comments outside the root element, and CDATA sections, which
were previously dropped or converted to text.
* Improvement: DOM mutation methods, including child insertion and
replacement, now reject operations that would create a cycle, such as
making
a node its own child or moving an ancestor beneath a descendant.
* Improvement: Added Elements#before(Node), after(Node), prepend(Node), and
append(Node) to match the existing HTML string methods.
* Improvement: Large file-backed uploads through
Connection.requestBodyStream(InputStream) now stream directly with the JDK
HttpClient on Java 11+, rather than being loaded fully into memory first.
* Improvement: Extended Java 11+ HTTP client reuse from requests sharing a
Jsoup.newSession() to ordinary Jsoup.connect() calls, reducing transport
thread and connection setup churn under sustained request loads. Sessions
with custom authentication or SSL contexts continue to use their own
client.
* Change: Aligned the XML parser stack depth and lookups to the configured
maximum, which now defaults to 512 for both HTML and XML. Use
Parser#setMaxDepth(int) to configure.
* Bugfix: Fixed W3CDom namespace conversion in several cases:
* Namespace declarations and prefixed attributes now carry the correct
namespace URI, so namespace-aware DOM lookups work as expected.
* Attributes added after parsing, or included through subtree conversion, now
use inherited prefix declarations.
* Namespace declarations now apply regardless of attribute order, and an
empty
declaration shadows an inherited binding only within its scope.
* With namespace awareness disabled, inherited and undeclared prefixes now
receive the declarations needed for XML serialization.
* Valid HTML names that are not XML QNames, such as a:b:c, are normalized.
Attributes that still cannot be represented are skipped, and
unrepresentable
elements no longer change the surrounding tree.
* Bugfix: Fixed W3CDom conversion of programmatically created or renamed
elements whose names can be represented in a jsoup HTML DOM but are not
valid XML names, such as 1abc. These names are now normalized (e.g. _1abc)
instead of causing a NullPointerException.
* Bugfix: Fixed XML doctype serialization when a system identifier contains a
double quote, which could otherwise produce invalid XML.
* Bugfix: XML serialization now repairs element and attribute names that
start
with an invalid character, rather than outputting null elements or dropping
attributes. For example, an attribute named 1a is written as _1a.
Additional
leading underscores keep repaired attribute names unique if they conflict
with another attribute.
* Bugfix: Supplementary Unicode characters are now escaped correctly when
serializing with non-UTF, non-ASCII output charsets such as ISO-8859-1.
Previously, characters could be emitted unescaped when their low 16-bit
value was representable by the configured charset, causing replacement or
corruption when the output was encoded.
* Bugfix: Fixed the JDK HttpClient implementation to accept responses missing
a Content-Type header, matching the HttpURLConnection implementation.
* Bugfix: Fixed HTTP response Content-Type matching to handle media types
case-insensitively and recognize structured +xml suffixes, including
vendor-
specific media types.
* Bugfix: HTTP request URL normalization now percent-encodes ASCII control
characters, DEL, and embedded fragment delimiters, keeping normalized URLs
valid for HTTP requests while preserving existing escapes.
* Bugfix: Corrected multipart form encoding to percent-escape CR and LF in
field names and filenames, matching the HTML form submission specification.
Multipart file Content-Types containing CR or LF are now rejected with a
ValidationException.
* Bugfix: Aligned trailing comment placement with the HTML specification:
comments after </body> remain children of the html element, while
comments
after </html> remain children of the document.
* Bugfix: When using the optional re2j regular expression engine, memory
allocation errors caused by complex selector patterns at match time are now
normalized to a ValidationException with a Pattern complexity error
message.
* Bugfix: Fixed parsing of malformed SVG and MathML content so that breakout
HTML tags are placed according to the HTML specification.
* Bugfix: Fixed deeply nested malformed HTML parsing that could lose the
document body because stack lookups did not align to the configured maximum
parser depth.
* Bugfix: Aligned RCDATA, RAWTEXT, and script-data parsing with the HTML
specification: malformed end tags no longer consume following markup,
unclosed title/textarea content stays text through EOF, and custom text
tags
match exact names.
* Bugfix: Improved URL validation during HTTP/HTTPS URL resolution and
cleaning; resolved URLs without a host are now rejected instead of being
accepted based only on their scheme prefix, aligning to RFC 9110. Valid
relative links and non-HTTP(S) schemes are unchanged.
* Bugfix: Redirects with malformed single-slash HTTP locations now use
standard URL resolution to align with browsers.
* Bugfix: Template fragment parsing now handles unmatched </template>
tags
without throwing a ValidationException.
* Bugfix: Improved source tracking for adopted formatting elements and
malformed markup ending at EOF.
* Changes of 1.23.1
* Improvement: Reduced retained memory when parsing with source position
tracking enabled (Parser#setTrackPosition(true)). Source ranges are now
stored in compact parser-owned span records instead of node and attribute
user data, and Position objects are created lazily when source ranges are
read. This cuts tracked DOM retained size by about 50-60% on representative
benchmark documents, while keeping Node#sourceRange(),
Element#endSourceRange(), and Attribute#sourceRange() behavior intact.
* Improvement: Added Element#classList(), an immutable snapshot of an
element's class names in attribute order. Use hasClass() when you just
need
to test for one class, classList() when you want to read or iterate classes
without needing a mutable result, and classNames() when you want the
existing mutable, deduplicated set that can be written back with
classNames(Set). The class APIs now share an HTML-whitespace scanner, which
also makes classNames() faster and lighter on allocation, especially when
walking many elements without class names.
* Improvement: Aligned HTML parser scope classification with the current HTML
spec for select, foreignObject, and template.
* Improvement: Simplified the HTML tree builder's scope, implied-end-tag,
and
special-element checks by caching parser-only options on Tag. That improves
HTML parser throughput by about 10% on small inputs and up to about 30% on
larger inputs in the benchmark fixtures.
* Improvement: Improved HTML parser throughput stability by making hot
tokeniser scan paths compile more predictably.
* Improvement: <noscript> fallback markup is now parsed into an
inspectable
DOM subtree in both the document head and body. The fallback acts as a
contained parsing island, so malformed markup cannot disrupt the
surrounding
document structure, while normal HTML tokenization still applies within it.
This also improves round-trip serialization.
* Improvement: Improved redirect credential handling as a defense-in-depth
measure: explicit authorization headers and request cookies are no longer
forwarded across origins, reducing exposure through open redirects and
aligning with HTTP guidance. Cookies managed by a CookieStore continue to
follow their configured scope.
* Improvement: Elements can now append their outer HTML, including their own
tags, directly to an Appendable with Node#outerHtml(Appendable), without
first creating a String. This complements Element#html(Appendable), which
appends inner HTML only.
* Improvement: Aligned CDATA tokenization with the HTML spec: CDATA syntax in
HTML content is parsed as a bogus comment, while it remains supported in
SVG, MathML, and XML. Also improved namespace-aware fragment parsing so SVG
and MathML contexts, HTML integration points, and context-sensitive
tokenizer states are handled correctly.
* Improvement: When using the optional re2j regular expression engine, stack
overflows caused by complex selector patterns are now normalized to a
ValidationException with a Pattern complexity error message.
* Bugfix: Fixed HTML parsing of mixed-case RCDATA end tags after tag-shaped
text. For example, <title><p>Foo</TiTLE> and
<textarea><img
src=x></TeXtArEa> now keep the tag-shaped content as text instead
of
promoting it to markup.
* Bugfix: Fixed W3CDom XML conversion so plain XML elements don't
serialize
with the reserved XML namespace as the default namespace. Explicit XML
namespaces and xml:* attributes are still preserved.
* Bugfix: Preserve control characters in parsed tag names.
* Bugfix: Updated HTTP redirects to follow the specification: 307 and 308
preserve the request method and content, 301 and 302 only change POST to
GET, and Location is followed only for 301, 302, 303, 307, and 308
responses. Streamed request bodies are not buffered; if an automatic
redirect requires replaying one, execution fails, so the caller can resend
with a fresh stream.
* Bugfix: Corrected the Cleaner's same-site link detection to compare
hostnames rather than URL prefixes when applying rel=nofollow.
* Build change: Cleaned up the Maven build for the multi-release JAR so Java
8
and Java 11+ sources compile as separate source sets. This avoids spurious
Java 8 compiler warnings from newer-language overlay sources, keeps long-
running parser checks behind an explicit profile, and preserves the same
published artifacts and runtime behavior.
* Build change: Improved parallelism and tuned timing in our integration
tests, so that a full mvn clean verify drops from ~ 1m18s to ~ 21 seconds.
* Changes of 1.22.2
* Improvement: Expanded and clarified NodeTraversor support for in-place DOM
rewrites during NodeVisitor.head(). Current-node edits such as remove,
replace, and unwrap now recover more predictably, while traversal stays
within the original root subtree. This makes single-pass tree cleanup and
normalization visitors easier to write, for example when unwrapping
presentational elements or replacing text nodes as you walk the DOM.
* Documentation: clarified that a configured Cleaner may be reused across
concurrent threads, and that shared Safelist instances should not be
mutated
while in use.
* Improvement: Updated the default HTML TagSet for current HTML elements:
added dialog, search, picture, and slot; made ins, del, button, audio,
video, and canvas inline by default (Tag#isInline(), aligned to phrasing
content in the spec); and added readable Element.text() boundaries for
controls and embedded objects via the new Tag.TextBoundary option. This
improves pretty-printing and keeps normalized text from running adjacent
words together.
* Android (R8/ProGuard): added a rule to ignore the optional re2j dependency
when not present.
* Bugfix: Fixed a NodeTraversor regression in 1.21.2 where removing or
replacing the current node during head() could revisit the replacement node
and loop indefinitely. The traversal docs now also clarify which inserted
nodes are visited in the current pass.
* Bugfix: Parsing during charset sniffing no longer fails if an advisory
available() call throws IOException, as seen on JDK 8 HttpURLConnection.
* Bugfix: Cleaner no longer makes relative URL attributes in the input
document absolute when cleaning or validating a Document. URL normalization
now applies only to the cleaned output, and Safelist.isSafeAttribute() is
side effect free.
* Bugfix: Cleaner no longer duplicates enforced attributes when the input
Document preserves attribute case. A case-variant source attribute is now
replaced by the enforced attribute in the cleaned output.
* Bugfix: If a per-request SOCKS proxy is configured, jsoup now avoids using
the JDK HttpClient, because the JDK would silently ignore that proxy and
attempt to connect directly. Those requests now fall back to the legacy
HttpURLConnection transport instead, which does support SOCKS.
* Bugfix: Connection.Response.streamParser() and DataUtil.streamParser(Path,
...) could fail on small inputs without a declared charset, if the initial
5
KB charset sniff fully consumed the input and closed it before the stream
parse began.
* Bugfix: In XML mode, doctypes with an internal subset, such as <!DOCTYPE
root [<!ENTITY name "value">]>, now round-trip correctly.
The subset is
preserved as raw text only; entities are not expanded and external DTDs are
not loaded.
* Build change: Migrated the integration test server from Jetty to Netty,
which actively maintains support for our minimum JDK target (8).
* Changes of 1.22.1
* Improvement: Added support for using the re2j regular expression engine for
regex-based CSS selectors (e.g. [attr~=regex], :matches(regex)), which
ensures linear-time performance for regex evaluation. This allows safer
handling of arbitrary user-supplied query regexes. To enable, add the
com.google.re2j dependency to your classpath, e.g.: <dependency>
<groupId>com.google.re2j</groupId>
<artifactId>re2j</artifactId>
<version>1.8</version> </dependency> (If you already have
that dependency in
your classpath, but you want to keep using the Java regex engine, you can
disable re2j via System.setProperty("jsoup.useRe2j",
"false").) You can
confirm that the re2j engine has been enabled correctly by calling
Regex.usingRe2j().
* Improvement: Added an instance method Parser#unescape(String, boolean) that
unescapes HTML entities using the parser's configuration (e.g. to
support
error tracking), complementing the existing static utility
Parser.unescapeEntities(String, boolean).
* Improvement: Added a configurable maximum parser depth (to limit the number
of open elements on stack) to both HTML and XML parsers. The HTML parser
now
defaults to a depth of 512 to match browser behavior, and protect against
unbounded stack growth, while the XML parser keeps unlimited depth by
default, but can opt into a limit via Parser.setMaxDepth().
* Build: added CI coverage for JDK 25.
* Build: added a CI fuzzer for contextual fragment parsing (in addition to
existing full body HTML and XML fuzzers).
* Change: Set a removal schedule of jsoup 1.24.1 for previously deprecated
APIs.
* Bugfix: Previously cached child Elements of an Element were not correctly
invalidated in Node#replaceWith(Node), which could lead to incorrect
results
when subsequently calling Element#children().
* Bugfix: Attribute selector values are now compared literally without
trimming. Previously, jsoup trimmed whitespace from selector values and
from
element attribute values, which could cause mismatches with browser
behavior
(e.g. [attr=" foo "]). Now matches align with the CSS specification
and
browser engines.
* Bugfix: When using the JDK HttpClient, any system default proxy
(ProxySelector.getDefault()) was ignored. Now, the system proxy is used if
a
per-request proxy is not set.
* Bugfix: A ValidationException could be thrown in the adoption agency
algorithm with particularly broken input. Now logged as a parse error.
* Bugfix: Null characters in the HTML body were not consistently removed; and
in foreign content were not correctly replaced.
* Bugfix: An IndexOutOfBoundsException could be thrown when parsing a body
fragment with crafted input. Now logged as a parse error.
* Bugfix: When using StructuralEvaluators (e.g., a parent child selector)
across many retained threads, their memoized results could also be
retained,
increasing memory use. These results are now cleared immediately after use,
reducing overall memory consumption.
* Bugfix: Cloning a Parser now preserves any custom TagSet applied to the
parser.
* Bugfix: Custom tags marked as Tag.Void now parse and serialize like the
built-in void elements: they no longer consume following content, and the
XML serializer emits the expected self-closing form.
* Bugfix: The <br> element is once again classified as an inline tag
(Tag.isBlock() == false), matching common developer expectations and its
role as phrasing content in HTML, while pretty-printing and text extraction
continue to treat it as a line break in the rendered output.
* Bugfix: Fixed an intermittent truncation issue when fetching and parsing
remote documents via Jsoup.connect(url).get(). On responses without a
charset header, the initial charset sniff could sometimes (depending on
buffering / available() behavior) be mistaken for end-of-stream and a
partial parse reused, dropping trailing content.
* Bugfix: TagSet copies no longer mutate their template during lazy lookups,
preventing cross-thread ConcurrentModificationException when parsing with
shared sessions.
* Bugfix: Fixed parsing of <svg> foreignObject content nested within a
<p>,
which could incorrectly move the HTML subtree outside the SVG.
* Change: Deprecated internal helper org.jsoup.internal.Functions (for
removal
in v1.23.1). This was previously used to support older Android API levels
without full java.util.function coverage; jsoup now requires core library
desugaring so this indirection is no longer necessary.
* Changes of 1.21.2
* Change: Deprecated internal (yet visible) methods
Normalizer#normalize(String, bool) and
Attribute#shouldCollapseAttribute(Document.OutputSettings). These will be
removed in a future version.
* Change: Deprecated Connection#sslSocketFactory(SSLSocketFactory) in favor
of
the new Connection#sslContext(SSLContext). Using sslSocketFactory will
force
the use of the legacy HttpUrlConnection implementation, which does not
support HTTP/2.
* Improvement: When pretty-printing, if there are consecutive text nodes (via
DOM manipulation), the non-significant whitespace between them will be
collapsed.
* Improvement: Updated Connection.Response#statusMessage() to return a simple
loggable string message (e.g. "OK") when using the HttpClient
implementation, which doesn't otherwise return any server-set status
message.
* Improvement: Attributes#size() and Attributes#isEmpty() now exclude any
internal attributes (such as user data) from their count. This aligns with
the attributes' serialized output and iterator.
* Improvement: Added Connection#sslContext(SSLContext) to provide a custom
SSL
(TLS) context to requests, supporting both the HttpClient and the legacy
HttUrlConnection implementations.
* Improvement: Performance optimizations for DOM manipulation methods
including when repeatedly removing an element's first child
(element.child(0).remove()), and when using Parser#parseBodyFragement() to
parse a large number of direct children.
* Bugfix: When parsing from an InputStream and a multibyte character happened
to straddle a buffer boundary, the stream would not be completely read.
* Bugfix: In NodeTraversor, if a last child element was removed during the
head() call, the parent would be visited twice.
* Bugfix: Cloning an Element that has an Attributes object would add an empty
internal user-data attribute to that clone, which would cause unexpected
results for Attributes#size() and Attributes#isEmpty().
* Bugfix: In a multithreaded application where multiple threads are calling
Element#children() on the same element concurrently, a race condition could
happen when the method was generating the internal child element cache (a
filtered view of its child nodes). Since concurrent reads of DOM objects
should be threadsafe without external synchronization, this method has been
updated to execute atomically.
* Bugfix: When parsing HTML with svg:script elements in SVG elements,
don't
enter the Text insertion mode, but continue to parse as foreign content.
Otherwise, misnested HTML could then cause an IndexOutOfBoundsException.
* Bugfix: Malformed HTML could throw an IndexOutOfBoundsException during the
adoption agency.
* Changes of 1.21.1
* Change: Removed previously deprecated methods.
* Change: Deprecated the :matchText pseduo-selector due to its side effects
on
the DOM; use the new ::textnode selector and the Element#selectNodes(String
css, Class<T> type) method instead.
* Change: Deprecated Connection.Response#bufferUp() in lieu of
Connection.Response#readFully() which can throw a checked IOException.
* Change: Deprecated internal methods Validate#ensureNotNull(Object)
(replaced
by typed Validate#expectNotNull(T)); protected HTML appenders from
Attribute
and Node.
* Change: If you happen to be using any of the deprecated methods, please
take
the opportunity now to migrate away from them, as they will be removed in a
future release.
* Improvement: Enhanced the Selector to support direct matching against nodes
such as comments and text nodes. For example, you can now find an element
that follows a specific comment: ::comment:contains(prices) + p will select
p elements immediately after a <!-- prices: --> comment. Supported
types
include ::node, ::leafnode, ::comment, ::text, ::data, and ::cdata. Node
contextual selectors like ::node:contains(text), :matches(regex), and
:blank
are also supported. Introduced Element#selectNodes(String css) and
Element#selectNodes(String css, Class<T> nodeType) for direct node
selection.
* Improvement: Added TagSet#onNewTag(Consumer<Tag> customizer):
register a
callback that's invoked for each new or cloned Tag when it's
inserted into
the set. Enables dynamic tweaks of tag options (for example, marking all
custom tags as self-closing, or everything in a given namespace as
preserving whitespace).
* Improvement: Made TokenQueue and CharacterReader autocloseable, to ensure
that they will release their buffers back to the buffer pool, for later
reuse.
* Improvement: Added Selector#evaluatorOf(String css), as a clearer way to
obtain an Evaluator from a CSS query. An alias of QueryParser.parse(String
css).
* Improvement: Custom tags (defined via the TagSet) in a foreign namespace
(e.g. SVG) can be configured to parse as data tags.
* Improvement: Added NodeVisitor#traverse(Node) to simplify node traversal
calls (vs. importing NodeTraversor).
* Improvement: Updated the default user-agent string to improve
compatibility.
* Improvement: The HTML parser now allows the specific text-data type (Data,
RcData) to be customized for known tags. (Previously, that was only
supported on custom tags.)
* Improvement: Added Connection.Response#readFully() as a replacement for
Connection.Response#bufferUp() with an explicit IOException. Similarly,
added Connection.Response#readBody() over Connection.Response#body().
Deprecated Connection.Response#bufferUp().
* Improvement: When serializing HTML, the < and > characters are now
escaped
in attributes. This helps prevent a class of mutation XSS attacks.
* Improvement: Changed Connection to prefer using the JDK's HttpClient
over
HttpUrlConnection, if available, to enable HTTP/2 support by default. Users
can disable via -Djsoup.useHttpClient=false.
* Bugfix: The contents of a script in a svg foreign context should be parsed
as script data, not text.
* Bugfix: Tag#isFormSubmittable() was updating the Tag's options.
* Bugfix: The HTML pretty-printer would incorrectly trim whitespace when text
followed an inline element in a block element.
* Bugfix: Custom tags with hyphens or other non-letter characters in their
names now work correctly as Data or RcData tags. Their closing tags are now
tokenized properly.
* Bugfix: When cloning an Element, the clone would retain the source's
cached
child Element list (if any), which could lead to incorrect results when
modifying the clone's child elements.
* Changes of 1.20.1
* Change: To better follow the HTML5 spec and current browsers, the HTML
parser no longer allows self-closing tags (<foo />) to close HTML
elements
by default. Foreign content (SVG, MathML), and content parsed with the XML
parser, still supports self-closing tags. If you need specific HTML tags to
support self-closing, you can register a custom tag via the TagSet
configured in Parser.tagSet(), using Tag#set(Tag.SelfClose). Standard void
tags (such as <img>, <br>, etc.) continue to behave as usual
and are not
affected by this change.
* Change: The following internal components have been deprecated. If you do
happen to be using any of these, please take the opportunity now to migrate
away from them, as they will be removed in jsoup 1.21.1.
* ChangeNotifyingArrayList, Document.updateMetaCharsetElement(),
Document.updateMetaCharsetElement(boolean),
HtmlTreeBuilder.isContentForTagData(String),
Parser.isContentForTagData(String), Parser.setTreeBuilder(TreeBuilder),
Tag.formatAsBlock(), Tag.isFormListed(), TokenQueue.addFirst(String),
TokenQueue.chompTo(String), TokenQueue.chompToIgnoreCase(String),
TokenQueue.consumeToIgnoreCase(String), TokenQueue.consumeWord(),
TokenQueue.matchesAny(String...)
* Improvement: Rebuilt the HTML pretty-printer, to simplify and consolidate
the implementation, improve consistency, support custom Tags, and provide a
cleaner path for ongoing improvements. The specific HTML produced by the
pretty-printer may be different from previous versions.
* Improvement: Added the ability to define custom tags, and to modify
properties of known tags, via the TagSet tag collection. Their properties
can impact both the parse and how content is serialized (output as HTML or
XML).
* Improvement: Element.cssSelector() will prefer to return shorter selectors
by using ancestor IDs when available and unique. E.g. #id > div > p
instead
of html > body > div > div > p.
* Improvement: Added Elements.deselect(int index), Elements.deselect(Object
o), and Elements.deselectAll() methods to remove elements from the Elements
list without removing them from the underlying DOM. Also added
Elements.asList() method to get a modifiable list of elements without
affecting the DOM. (Individual Elements remain linked to the DOM.)
* Improvement: Added support for sending a request body from an InputStream
with Connection.requestBodyStream(InputStream stream).
* Improvement: The XML parser now supports scoped xmlns: prefix namespace
declarations, and applies the correct namespace to Tags and Attributes.
Also, added Tag#prefix(), Tag#localName(), Attribute#prefix(),
Attribute#localName(), and Attribute#namespace() to retrieve these.
* Improvement: CSS identifiers are now escaped and unescaped correctly to the
CSS spec. Element#cssSelector() will emit appropriately escaped selectors,
and the QueryParser supports those. Added Selector.escapeCssIdentifier()
and
` Selector.unescapeCssIdentifier().
* Improvement: Refactored the CSS QueryParser into a clearer recursive
descent
parser.
* Improvement: CSS selectors with consecutive combinators (e.g. div >>
p) will
throw an explicit parse exception.
* Performance: reduced the shallow size of an Element from 40 to 32 bytes,
and
the NodeList from 32 to 24.
* Performance: reduced GC load of new StringBuilders when tokenizing input
HTML.
* Improvement: Made Parser instances threadsafe, so that inadvertent use of
the same instance across threads will not lead to errors. For actual
concurrency, use Parser#newInstance() per thread.
* Bugfix: Element names containing characters invalid in XML are now
normalized to valid XML names when serializing.
* Bugfix: When serializing to XML, characters that are invalid in XML 1.0
should be removed (not encoded).
* Bugfix: When converting a Document to the W3C DOM in W3CDom, elements with
an attribute in an undeclared namespace now get a declaration of
xmlns:prefix="undefined". This allows subsequent serialization to
XML via
W3CDom.asString() to succeed.
* Bugfix: The StreamParser could emit the final elements of a document twice,
due to how onNodeCompleted was fired when closing out the stack.
* Bugfix: When parsing with the XML parser and error tracking enabled, the
trailing ? in <?xml version="1.0"?> would incorrectly emit an
error.
* Bugfix: Calling Element#cssSelector() on an element with combining
characters in the class or ID now produces the correct output.
* Changes of 1.19.1
* Change: Added support for http/2 requests in Jsoup.connect(), when running
on Java 11+, via the Java HttpClient implementation.
* In this version of jsoup, the default is to make requests via the
HttpUrlConnection implementation: use
System.setProperty("jsoup.useHttpClient", "true"); to
enable making requests
via the HttpClient (if available), which will enable http/2 support. This
will become the default in a later version of jsoup, so now is a good time
to validate it.
* If you are repackaging the jsoup jar in your deployment (i.e. creating a
shaded- or a fat-jar), make sure to specify that as a Multi-Release JAR.
* If the HttpClient impl is not available in your JRE, requests will continue
to be made via HttpURLConnection (in http/1.1 mode).
* Change: Updated the minimum Android API Level validation from 10 to 21. As
with previous jsoup versions, Android developers need to enable core
library
desugaring. The minimum Java version remains Java 8.
* Change: Removed previously deprecated class: org.jsoup.UncheckedIOException
(replace with java.io.UncheckedIOException); moved previously deprecated
method Element Element#forEach(Consumer) to void
Element#forEach(Consumer()).
* Change: Deprecated the methods Document#updateMetaCharsetElement(boolean)
and Document#updateMetaCharsetElement(), as the setting had no effect. When
Document#charset(Charset) is called, the document's meta charset or XML
encoding instruction is always set.
* Improvement: When cleaning HTML with a Safelist that preserves relative
links, the isValid() method will now consider these links valid.
Additionally, the enforced attribute rel=nofollow will only be added to
external links when configured in the safelist.
* Improvement: Added Element#selectStream(String query) and
Element#selectStream(Evaluator) methods, that return a Stream of matching
elements. Elements are evaluated and returned as they are found, and the
stream can be terminated early.
* Improvement: Element objects now implement Iterable, enabling them to be
used in enhanced for loops.
* Improvement: Added support for fragment parsing from a Reader via
Parser#parseFragmentInput(Reader, Element, String).
* Improvement: Reintroduced CLI executable examples, in jsoup-examples.jar.
* Improvement: Optimized performance of selectors like #id .class (and other
similar descendant queries) by around 4.6x, by better balancing the
Ancestor
evaluator's cost function in the query planner.
* Improvement: Removed the legacy parsing rules for <isindex> tags,
which
would autovivify a form element with labels. This is no longer in the spec.
* Improvement: Added Elements.selectFirst(String cssQuery) and
Elements.expectFirst(String cssQuery), to select the first matching element
from an Elements list.
* Improvement: When parsing with the XML parser, XML Declarations and
Processing Instructions are directly handled, vs bouncing through the HTML
parser's bogus comment handler. Serialization for non-doctype
declarations
no longer end with a spurious !.
* Improvement: When converting parsed HTML to XML or the W3C DOM, element
names containing < are normalized to _ to ensure valid XML. For example,
<foo<bar> becomes <foo_bar>, as XML does not allow < in
element names, but
HTML5 does.
* Improvement: Reimplemented the HTML5 Adoption Agency Algorithm to the
current spec. This handles mis-nested formating / structural elements.
* Bugfix: If an element has an ; in an attribute name, it could not be
converted to a W3C DOM element, and so subsequent XPath queries could miss
that element. Now, the attribute name is more completely normalized.
* Bugfix: For backwards compatibility, reverted the internal attribute key
for
doctype names to "name".
* Bugfix: In Connection, skip cookies that have no name, rather than throwing
a validation exception.
* Bugfix: When running on JDK 1.8, the error java.lang.NoSuchMethodError:
java.nio.ByteBuffer.flip()Ljava/nio/ByteBuffer; could be thrown when
calling
Response#body() after parsing from a URL and the buffer size was exceeded.
* Bugfix: For backwards compatibility, allow null InputStream inputs to
Jsoup.parse(InputStream stream, ...), by returning an empty Document.
* Bugfix: A template tag containing an li within an open li would be parsed
incorrectly, as it was not recognized as a "special" tag (which
have
additional processing rules). Also, added the SVG and MathML namespace tags
to the list of special tags.
* Bugfix: A template tag containing a button within an open button would be
parsed incorrectly, as the "in button scope" check was not aware of
the
template element. Corrected other instances including MathML and SVG
elements, also.
* Bugfix: An :nth-child selector with a negative digit-less step, such as
:nth-child(-n+2), would be parsed incorrectly as a positive step, and so
would not match as expected.
* Bugfix: Calling doc.charset(charset) on an empty XML document would throw
an
IndexOutOfBoundsException.
* Bugfix: Fixed a memory leak when reusing a nested StructuralEvaluator
(e.g.,
a selector ancestor chain like A B C) by ensuring cache reset calls cascade
to inner members.
* Bugfix: Concurrent calls to doc.clone().append(html) were not supported.
When a document was cloned, its Parser was not cloned but was a shallow
copy
of the original parser.
* Changes of 1.18.3
* Bugfix: When serializing to XML, attribute names containing -, ., or digits
were incorrectly marked as invalid and removed.
* Changes of 1.18.2
* Improvement: Optimized the throughput and memory use throughout the input
read and parse flows, with heap allocations and GC down between -6% and
-89%, and throughput improved up to +143% for small inputs. Most inputs
sizes will see throughput increases of ~ 20%. These performance
improvements
come through recycling the backing byte[] and char[] arrays used to read
and
parse the input.
* Improvement: Speed optimized html() and Entities.escape() when the input
contains UTF characters in a supplementary plane, by around 49%.
* Improvement: The form associated elements returned by
FormElement.elements()
now reflect changes made to the DOM, subsequently to the original parse.
* Improvement: In the TreeBuilder, the onNodeInserted() and onNodeClosed()
events are now also fired for the outermost / root Document node. This
enables source position tracking on the Document node (which was previously
unset). And it also enables the node traversor to see the outer Document
node.
* Improvement: Selected Elements can now be position swapped inline using
Elements#set().
* Bugfix: Element.cssSelector() would fail if the element's class
contained a
* character.
* Bugfix: When tracking source ranges, a text node following an invalid self-
closing element may be left untracked.
* Bugfix: When a document has no doctype, or a doctype not named html, it
should be parsed in Quirks Mode.
* Bugfix: With a selector like div:has(span + a), the has() component was not
working correctly, as the inner combining query caused the evaluator to
match those against the outer's siblings, not children.
* Bugfix: A selector query that included multiple :has() components in a
nested :has() might incorrectly execute.
* Bugfix: When cookie names in a response are duplicated, the simple view of
cookies available via Connection.Response#cookies() will provide the last
one set. Generally it is better to use the Jsoup.newSession method to
maintain a cookie jar, as that applies appropriate path selection on
cookies
when making requests.
* Bugfix: When parsing named HTML entities, base entities should resolve if
they are a prefix of the input token (and not in an attribute).
* Bugfix: Fixed incorrect tracking of source ranges for attributes merged
from
late-occurring elements that were implicitly created (html or body).
* Bugfix: Follow the current HTML specification in the tokenizer to allow
< as
part of a tag name, instead of emitting it as a character node.
* Bugfix: Similarly, allow a < as the start of an attribute name, vs
creating
a new element. The previous behavior was intended to parse closer to what
we
anticipated the author's intent to be, but that does not align to the
spec
or to how browsers behave.
* Changes of 1.18.1
* Improvement: Stream Parser: A StreamParser provides a progressive parse of
its input. For URL requests, available via
Connection.Response.streamParser(). As each Element is completed, it is
emitted via a Stream or Iterator interface. Elements returned will be
complete with all their children, and an (empty) next sibling, if
applicable. Elements (or their children) may be removed from the DOM during
the parse, for e.g. to conserve memory, providing a mechanism to parse an
input document that would otherwise be too large to fit into memory, yet
still providing a DOM interface to the document and its elements.
Additionally, the parser provides a selectFirst(String query) /
selectNext(String query), which will run the parser until a hit is found,
at
which point the parse is suspended. It can be resumed via another select()
call, or via the stream() or iterator() methods.
* Improvement: Download Progress: added a Response Progress event interface,
which reports progress and URLs are downloaded (and parsed). Set via
Connection.onResponseProgress(). Supported on both a session and a single
connection level.
* Improvement: Added Path accepting parse methods: Jsoup.parse(Path),
Jsoup.parse(path, charsetName, baseUri, parser), etc.
* Improvement: Updated the button tag configuration to include a space
between
multiple button elements in the Element.text() method.
* Improvement: Added support for the ns|* all elements in namespace Selector.
* Improvement: When normalising attribute names during serialization, invalid
characters are now replaced with _, vs being stripped. This should make the
process clearer, and generally prevent an invalid attribute name being
coerced unexpectedly.
* Change: Removed previously deprecated internal classes and methods.
* Build change: the built jar's OSGi manifest no longer imports itself.
* Bugfix: When tracking source positions, if the first node was a TextNode,
its position was incorrectly set to -1.
* Bugfix: When connecting (or redirecting) to URLs with characters such as {,
} in the path, a Malformed URL exception would be thrown (if in
development), or the URL might otherwise not be escaped correctly (if in
production). The URL encoding process has been improved to handle these
characters correctly.
* Bugfix: When using W3CDom with a custom output Document, a Null Pointer
Exception would be thrown.
* Bugfix: The :has() selector did not match correctly when using sibling
combinators (like e.g.: h1:has(+h2)).
* Bugfix: The :empty selector incorrectly matched elements that started with
a
blank text node and were followed by non-empty nodes, due to an incorrect
short-circuit.
* Bugfix: Element.cssSelector() would fail with "Did not find balanced
marker"
when building a selector for elements that had a ( or [ in their class
names. And selectors with those characters escaped would not match as
expected.
* Bugfix: Updated Entities.escape(string) to make the escaped text suitable
for both text nodes and attributes (previously was only for text nodes).
This does not impact the output of Element.html() which correctly applies a
minimal escape depending on if the use will be for text data or in a quoted
attribute.
* Fuzz: a Stack Overflow exception could occur when resolving a crafted
<base
href> URL, in the normalizing regex.
* Changes of 1.17.2
* Improvement: Attribute object accessors: Added Element.attribute(String)
and
Attributes.attribute(String) to more simply obtain an Attribute object.
* Improvement: Attribute source tracking: If source tracking is on, and an
Attribute's key is changed (via Attribute.setKey(String)), the source
range
is now still tracked in Attribute.sourceRange().
* Improvement: Wildcard attribute selector: Added support for the [*] element
with any attribute selector. And also restored support for selecting by an
empty attribute name prefix ([^]).
* Bugfix: Mixed-cased source position: When tracking the source position of
attributes, if the source attribute name was mix-cased but the parser was
lower-case normalizing attribute names, the source position for that
attribute was not tracked
* Bugfix: Source position NPE: When tracking the source position of a body
fragment parse, a null pointer exception was thrown.
* Bugfix: Multi-point emoji entity: A multi-point encoded emoji entity may be
incorrectly decoded to the replacement character
* Bugfix: Selector sub-expressions: (Regression) in a selector like parent
[attr=va], other, the , OR was binding to [attr=va] instead of parent
[attr=va], causing incorrect selections. The fix includes a EvaluatorDebug
class that generates a sexpr to represent the query, allowing simpler and
more thorough query parse tests.
* Bugfix: XML CData output: When generating XML-syntax output from parsed
HTML, script nodes containing (pseudo) CData sections would have an
extraneous CData section added, causing script execution errors. Now, the
data content is emitted in a HTML/XML/XHTML polyglot format, if the data is
not already within a CData section.
* Bugfix: Thread safety: The :has evaluator held a non-thread-safe Iterator,
and so if an Evaluator object was shared across multiple concurrent
threads,
a NoSuchElement exception may be thrown, and the selected results may be
incorrect. Now, the iterator object is a thread-local.
* Changes of 1.17.1
* Improvement: in Jsoup.connect(), added support for request-level
authentication, supporting authentication to proxies and to servers.
* Improvement: in the Elements list, added direct support for `#set(index,
element)`, `#remove(index)`, `#remove(object)`, `#clear()`,
`#removeAll(collection)`, `#retainAll(collection)`, `#removeIf(filter)`,
`#replaceAll(operator)`. These methods update the original DOM, as well as
the Elements list.
* Improvement: added the NodeIterator class, to efficiently traverse a node
tree using the Iterator interface. And added Stream Element#stream() and
Node#nodeStream() methods, to enable fluent composable stream pipelines of
node traversals.
* Improvement: when changing the OutputSettings syntax to XML, the xhtml
EscapeMode is automatically set by default.
* Improvement: added the `:is(selector list)` pseudo-selector, which finds
elements that match any of the selectors in the selector list. Useful for
making large ORed selectors more readable.
* Improvement: repackaged the library with native (vs automatic) JPMS module
support.
* Improvement: better fidelity of source positions when tracking is enabled.
And implicitly created or closed elements are tracked and detectable via
Range.isImplicit().
* Improvement: when source tracking is enabled, the source position for
attribute names and values is now available. Attribute#sourceRange()
provides the ranges.
* Improvement: when running concurrently under Java 21+ Virtual Threads,
virtual threads could be pinned to their carrier platform thread when
parsing an input stream. To improve performance, particularly when parsing
fetched URLs, the internal ConstrainableInputStream has been replaced by
ControllableInputStream, which avoids the locking which caused that
pinning.
* Improvement: in Jsoup.Connect, allow any XML mimetype as a supported
mimetype. Was previously limited to `{application|text}/xml`. This enables
for e.g. fetching SVGs with a image/svg+xml mimetype, without having to
disable mimetype validation.
* Bugfix: when outputting with XML syntax, HTML elements that were parsed as
data nodes (<script> and <style>) should be emitted as CDATA
nodes, so that
they can be parsed correctly by an XML parser.
* Bugfix: the Immediate Parent selector `&gt;` could match elements above
the
root context element, causing incorrect elements to be returned when used
on
elements other than the root document
* Bugfix: in a sub-query such as `p:has(&gt; span, &gt; i)`,
combinators
following the `,` Or combinator would be incorrectly skipped, such that the
sub-query was parsed as `i` instead of `&gt; i`.
* Bugfix: in W3CDom, if the jsoup input document contained an empty doctype,
the conversion would fail with a DOMException. Now, said doctype is
discarded, and the conversion continues.
* Bugfix: when cleaning a document containing SVG elements (or other foreign
elements that have preserved case names), the cleaned output would be
incorrectly nested if the safelist had a different case than the input
document.
* Bugfix: when cleaning a document, the output style of unknown self-closing
tags from the input was not preserved in the output. (So a <foo /> in
the
input, if safe-listed, would be output as <foo></foo>.)
* Build Improvement: added a local test proxy implementation, for proxy
integration tests.
* Build Improvement: added tests for HTTPS request support, using a local
self-signed cert. Includes proxy tests.
* Change: the InputStream returned in Connection.Response .bodyStream() is no
longer a ConstrainedInputStream, and so is not subject to settings such as
timeout or maximum size. It is now a plain BufferedInputStream around the
response stream. Whilst this behaviour was not documented, you may have
been
inadvertently relying on those constraints. The constraints are still
applied to other methods such as .parse() and .bufferUp(). So if you do
want
a constrained BufferedInputStream, you may do
Connection.Response.bufferUp()
.bodyStream().
* Changes of 1.16.2
* Improvement: optimized the performance of complex CSS selectors, by adding
a
cost-based query planner. Evaluators are sorted by their relative execution
cost, and executed in order of lower to higher cost. This speeds the
matching process by ensuring that simpler evaluations (such as a tag name
match) are conducted prior to more complex evaluations (such as an
attribute
regex, or a deep child scan with a :has).
* Improvement: added support for <svg> and <math> tags (and their
children).
This includes tag namespaces and case preservation on applicable tags and
attributes.
* Improvement: when converting jsoup Documents to W3C Documents in W3CDom,
HTML documents will be placed in the `http://www.w3.org/1999/xhtml`
namespace by default, per the HTML5 spec. This can be controlled by setting
`W3CDom#namespaceAware(false)`.
* Improvement: speed optimized the Structural Evaluators by memoizing
previous
evaluations. Particularly the `~` (any preceding sibling) and
`:nth-of-type`
selectors are improved.
* Improvement: tweaked the performance of the Element nextElementSibling,
previousElementSibling, firstElementSibling, lastElementSibling,
firstElementChild, and lastElementChild. They now inplace filter/skip in
the
child-node list, vs having to allocate and scan a complete Element filtered
list.
* Improvement: optimized internal methods that previously called
Element.children() to use filter/skip child-node list accessors instead,
reducing new Element List allocations.
* Improvement: tweaked the performance of parsing :pseudo selectors.
* Improvement: when using the `:empty` pseudo-selector, blank textnodes are
now considered empty. Previously, an element containing any whitespace was
not considered empty.
* Improvement: in forms, <input type="image"> should be
excluded from
formData() (and hence from form submissions).
* Improvement: in Safelist, made isSafeTag and isSafeAttribute public
methods,
for extensibility.
* Bugfix: `form` elements and empty elements (such as `img`) did not have
their attributes de-duplicated.
* Bugfix: if Document.OutputSettings was cloned from a clone, an NPE would be
thrown when used.
* Bugfix: in Jsoup.connect(url), URL paths containing a %2B were incorrectly
recoded to a '+', or a '+' was recoded to a ' '.
Fixed by reverting to the
previous behavior of not encoding supplied paths, other than normalizing to
ASCII.
* Bugfix: in Jsoup.connect(url), strings containing supplemental characters
(e.g. emoji) were not URL escaped correctly.
* Bugfix: in Jsoup.connect(url), the ConstrainableInputStream would clear
Thread interrupts when reading the body. This precluded callers from
spawning a thread, running a number of requests for a length of time, then
joining that thread after interrupting it.
* Bugfix: when tracking HTML source positions, the closing tags for H1...H6
elements were not tracked correctly.
* Bugfix: in Jsoup.connect(), a DELETE method request did not support a
request body.
* Bugfix: when calling Element.cssSelector() on an extremely deeply nested
element, a StackOverflowError could occur. Further, a StackOverflowError
may
occur when running the query
* Bugfix: appending a node back to its original Element after empty() would
throw an Index out of bounds exception. Also, now the child nodes that were
removed have their parent node cleared, fully detaching them from the
original parent.
* Bugfix: in Jsoup.Connection when adding headers, the value may have been
assumed to be an incorrectly decoded ISO_8859_1 string, and re-encoded as
UTF-8. The value is now left as-is.
* Change: removed previously deprecated methods Document#normalise,
Element#forEach(org.jsoup.helper .Consumer<>),
Node#forEach(org.jsoup.helper.Consumer<>), and the
org.jsoup.helper.Consumer
interface; the latter being a previously required compatibility shim prior
to Android's de-sugaring support.
* Change: the previous compatibility shim org.jsoup.UncheckedIOException is
deprecated in favor of the now supported java.io.UncheckedIOException. If
you are catching the former, modify your code to catch the latter
* Change: blocked noscript tags from being added to Safelists, due to
incompatibilities between parsers with and without script-mode enabled.
* Changes of 1.16.1
* Improvement: in Jsoup.connect(url), natively support URLs with Unicode
characters in the path or query string, without having to be escaped by the
caller.
* Improvement: Calling Node.remove() on a node with no parent is now a no-op,
vs a validation error.
* Bugfix: aligned the HTML Tree Builder processing steps for AfterBody and
AfterAfterBody to the updated WHATWG standard, to not pop the stack to
close
<body> or <html> elements. This prevents an errant
</html> closing preceding
structure. Also added appropriate error message outputs in this case.
* Bugfix: Corrected support for ruby elements (<ruby>, <rp>,
<rt>, and <rtc>)
to current spec.
* Bugfix: When using Node.before(node) or Node.after(node), if the incoming
node was a sibling of the context node, the incoming node may be inserted
into the wrong relative location
* Bugfix: In Jsoup.connect(url), if the input URL had components that were
already % escaped, they would be escaped again, causing errors when
fetched.
* Bugfix: when tracking input source positions, text in tables that was
fostered had invalid positions.
* Bugfix: If the Document.OutputSettings class was initialized, and then
Entities.escape(String) called, an NPE may be thrown due to a class loading
circular dependency.
* Bugfix: when pretty-printing, the first inline Element or Comment in a
block
would not be wrap-indented if it were preceded by a blank text node.
* Bugfix: when pretty-printing a <pre> containing block tags, those
tags were
incorrectly indented.
* Bugfix: when pretty-printing nested inlineable blocks (such as a <p>
in a
<td>), the inner element should be indented.
* Bugfix: <br> tags should be wrap-indented when in block tags (and not
when
in inline tags).
* Bugfix: the contents of a sufficiently large <textarea> with
un-escaped HTML
closing tags may be incorrectly parsed to an empty node.
* Changes of 1.15.4
* Improvement: added the ability to escape CSS selectors (tags, IDs, classes)
to match elements that don't follow regular CSS syntax. For example, to
match by classname <p class="one.two">, use
document.select("p.one\\.two");
* Improvement: when pretty-printing, wrap text that follows a <br> tag.
* Improvement: when pretty-printing, normalize newlines that follow self-
closing tags in custom tags.
* Improvement: when pretty-printing, collapse non-significant whitespace
between a block and an inline tag.
* Improvement: in Element#forEach and Node#forEachNode, use
java.util.function.Consumer instead of the previous Android compatibility
shim org.jsoup.helper.Consumer. Subsequently, the latter has been
deprecated.
* Improvement: added a new method Document#forms(), to conveniently retrieve
a
List<FormElement> containing the <form> elements in a document.
* Improvement: added a new method Document#expectForm(query), to find the
first matching FormElement, or blow up trying.
* Bugfix: URLs containing characters such as [ and ] were not escaped
correctly, and would throw a MalformedURLException when fetched.
* Bugfix: Element.cssSelector would create invalid selectors for elements
where the tag name, ID, or classnames needed to be escaped (e.g. if a class
name contained a ':' or '.').
* Bugfix: element.text() should have a space between a block and an inline
element.
* Bugfix: if a Node or an Element was replaced with itself, that node would
incorrectly be orphaned.
* Bugfix: form data on a previous request was copied to a new request in
newRequest(), resulting in an accumulation of form data when executing
multi-step form submissions, or data sent to later requests incorrectly.
Now, newRequest() only copies session related settings (cookies, proxy
settings, user-agent, etc) but not the request data nor the body.
* Bugfix: fixed an issue in Safelist.removeAttributes which could throw a
ConcurrentModificationException when using the ":all"
pseudo-attribute.
* Bugfix: given extremely deeply nested HTML, a number of methods in Element
could throw a StackOverflowError due to excessive recursion. Namely:
#data(), #hasText(), #parents(), and #wrap(html).
* Change: deprecated the unused Document#normalise() method. Normalization
occurs during the HTML tree construction, and no longer as a distinct
phase.

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise Server 16.0
zypper in -t patch SUSE-SLES-16.0-1728

## Package List:

* SUSE Linux Enterprise Server 16.0 (noarch)
* jsoup-1.23.2-160000.1.1
* jsoup-javadoc-1.23.2-160000.1.1

## References:

* https://www.suse.com/security/cve/CVE-2026-75140.html
* https://bugzilla.suse.com/show_bug.cgi?id=1275912

--===============8878067578371777259==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

<div class="container">
<h1>Security update for jsoup, re2j</h1>

<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:23856-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-09-21T12:40:20Z</td>
</tr>

<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>

<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1275912">bsc#1275912</a>
</li>

</ul>
</td>
</tr>

<tr>
<th>
Cross-References:
</th>
<td>
<ul>

<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-75140.html">CVE-2026-75140</a>
</li>

</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">

<li class="list-group-item">
<span
class="cvss-reference">CVE-2026-75140</span>
<span class="cvss-source">
(

SUSE

):
</span>
<span
class="cvss-score">7.5</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>

<li class="list-group-item">
<span
class="cvss-reference">CVE-2026-75140</span>
<span class="cvss-source">
(

NVD

):
</span>
<span
class="cvss-score">8.7</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>

<li class="list-group-item">
<span
class="cvss-reference">CVE-2026-75140</span>
<span class="cvss-source">
(

NVD

):
</span>
<span
class="cvss-score">7.5</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>

</ul>
</td>
</tr>

<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">

<li class="list-group-item">SUSE Linux
Enterprise Server 16.0</li>

</ul>
</td>
</tr>
</tbody>
</table>

<p>An update that solves one vulnerability can now be
installed.</p>

<h2>Description:</h2>

<p>This update for jsoup, re2j fixes the following issue:</p>
<ul>
<li>CVE-2026-75140: The builder copies the entire inherited namespace map
on every start element, causing quadratic time
and memory complexity, which attackers can exploit to trigger an
OutOfMemoryError and terminate the application
(bsc#1275912).</li>
</ul>
<p>Changes for jsoup:</p>
<ul>
<li>Upgrade to upstream version 1.23.2</li>
<li>Improvement: Improved consecutive StreamParser.selectFirst()
calls during progressive parsing, so later matches are
returned with their parsed contents when earlier selections
had left them as parser lookahead. E.g., given
&lt;title&gt;One&lt;/title&gt;&lt;p
id=hit&gt;Full&lt;/p&gt;&lt;p&gt;Next&lt;/p&gt;, selecting
title and then #hit now advances the partial lookahead and
returns &lt;p id=&quot;hit&quot;&gt;Full&lt;/p&gt;,
rather than returning an empty
&lt;p id=&quot;hit&quot;&gt;&lt;/p&gt; before its
content is parsed. The updated
readiness tracking follows StreamParser&#x27;s normal emission
order across implicit HTML structure and parser recovery.</li>
<li>Improvement: Improved XML parser performance and memory use
for documents with many nested namespace declarations by
recording namespace changes within each element scope
(bsc#1275912, CVE-2026-75140).</li>
<li>Improvement: Improved W3CDom conversion performance for
documents with many nested namespace declarations. The W3C
converter now uses the same optimized namespace tracking as
the XML parser.</li>
<li>Improvement: Improved W3CDom XML conversion to retain
processing instructions, comments outside the root element,
and CDATA sections, which were previously dropped or converted
to text.</li>
<li>Improvement: DOM mutation methods, including child insertion
and replacement, now reject operations that would create a
cycle, such as making a node its own child or moving an
ancestor beneath a descendant.</li>
<li>Improvement: Added Elements#before(Node), after(Node),
prepend(Node), and append(Node) to match the existing HTML
string methods.</li>
<li>Improvement: Large file-backed uploads through
Connection.requestBodyStream(InputStream) now stream directly
with the JDK HttpClient on Java 11+, rather than being loaded
fully into memory first.</li>
<li>Improvement: Extended Java 11+ HTTP client reuse from requests
sharing a Jsoup.newSession() to ordinary Jsoup.connect()
calls, reducing transport thread and connection setup churn
under sustained request loads. Sessions with custom
authentication or SSL contexts continue to use their own
client.</li>
<li>Change: Aligned the XML parser stack depth and lookups to the
configured maximum, which now defaults to 512 for both HTML
and XML. Use Parser#setMaxDepth(int) to configure.</li>
<li>Bugfix: Fixed W3CDom namespace conversion in several
cases:</li>
<li>Namespace declarations and prefixed attributes now carry the
correct namespace URI, so namespace-aware DOM lookups work
as expected.</li>
<li>Attributes added after parsing, or included through subtree
conversion, now use inherited prefix declarations.</li>
<li>Namespace declarations now apply regardless of attribute
order, and an empty declaration shadows an inherited binding
only within its scope.</li>
<li>With namespace awareness disabled, inherited and undeclared
prefixes now receive the declarations needed for XML
serialization.</li>
<li>Valid HTML names that are not XML QNames, such as a:b:c, are
normalized. Attributes that still cannot be represented are
skipped, and unrepresentable elements no longer change the
surrounding tree.</li>
<li>Bugfix: Fixed W3CDom conversion of programmatically created or
renamed elements whose names can be represented in a jsoup
HTML DOM but are not valid XML names, such as 1abc. These
names are now normalized (e.g. _1abc) instead of causing a
NullPointerException.</li>
<li>Bugfix: Fixed XML doctype serialization when a system
identifier contains a double quote, which could otherwise
produce invalid XML.</li>
<li>Bugfix: XML serialization now repairs element and attribute
names that start with an invalid character, rather than
outputting null elements or dropping attributes. For example,
an attribute named 1a is written as _1a. Additional leading
underscores keep repaired attribute names unique if they
conflict with another attribute.</li>
<li>Bugfix: Supplementary Unicode characters are now escaped
correctly when serializing with non-UTF, non-ASCII output
charsets such as ISO-8859-1. Previously, characters could be
emitted unescaped when their low 16-bit value was
representable by the configured charset, causing replacement
or corruption when the output was encoded.</li>
<li>Bugfix: Fixed the JDK HttpClient implementation to accept
responses missing a Content-Type header, matching the
HttpURLConnection implementation.</li>
<li>Bugfix: Fixed HTTP response Content-Type matching to handle
media types case-insensitively and recognize structured +xml
suffixes, including vendor-specific media types.</li>
<li>Bugfix: HTTP request URL normalization now percent-encodes
ASCII control characters, DEL, and embedded fragment
delimiters, keeping normalized URLs valid for HTTP requests
while preserving existing escapes.</li>
<li>Bugfix: Corrected multipart form encoding to percent-escape CR
and LF in field names and filenames, matching the HTML form
submission specification. Multipart file Content-Types
containing CR or LF are now rejected with a
ValidationException.</li>
<li>Bugfix: Aligned trailing comment placement with the HTML
specification: comments after &lt;/body&gt; remain children of the
html element, while comments after &lt;/html&gt; remain children of
the document.</li>
<li>Bugfix: When using the optional re2j regular expression
engine, memory allocation errors caused by complex selector
patterns at match time are now normalized to a
ValidationException with a Pattern complexity error message.</li>
<li>Bugfix: Fixed parsing of malformed SVG and MathML content so
that breakout HTML tags are placed according to the HTML
specification.</li>
<li>Bugfix: Fixed deeply nested malformed HTML parsing that could
lose the document body because stack lookups did not align to
the configured maximum parser depth.</li>
<li>Bugfix: Aligned RCDATA, RAWTEXT, and script-data parsing with
the HTML specification: malformed end tags no longer consume
following markup, unclosed title/textarea content stays text
through EOF, and custom text tags match exact names.</li>
<li>Bugfix: Improved URL validation during HTTP/HTTPS URL
resolution and cleaning; resolved URLs without a host are now
rejected instead of being accepted based only on their scheme
prefix, aligning to RFC 9110. Valid relative links and
non-HTTP(S) schemes are unchanged.</li>
<li>Bugfix: Redirects with malformed single-slash HTTP locations
now use standard URL resolution to align with browsers.</li>
<li>Bugfix: Template fragment parsing now handles unmatched
&lt;/template&gt; tags without throwing a
ValidationException.</li>
<li>Bugfix: Improved source tracking for adopted formatting
elements and malformed markup ending at EOF.</li>
<li>Changes of 1.23.1</li>
<li>Improvement: Reduced retained memory when parsing with source
position tracking enabled (Parser#setTrackPosition(true)).
Source ranges are now stored in compact parser-owned span
records instead of node and attribute user data, and Position
objects are created lazily when source ranges are read. This
cuts tracked DOM retained size by about 50-60% on
representative benchmark documents, while keeping
Node#sourceRange(), Element#endSourceRange(), and
Attribute#sourceRange() behavior intact.</li>
<li>Improvement: Added Element#classList(), an immutable snapshot
of an element&#x27;s class names in attribute order. Use hasClass()
when you just need to test for one class, classList() when you
want to read or iterate classes without needing a mutable
result, and classNames() when you want the existing mutable,
deduplicated set that can be written back with
classNames(Set). The class APIs now share an HTML-whitespace
scanner, which also makes classNames() faster and lighter on
allocation, especially when walking many elements without
class names.</li>
<li>Improvement: Aligned HTML parser scope classification with the
current HTML spec for select, foreignObject, and template.</li>
<li>Improvement: Simplified the HTML tree builder&#x27;s scope,
implied-end-tag, and special-element checks by caching
parser-only options on Tag. That improves HTML parser
throughput by about 10% on small inputs and up to about 30% on
larger inputs in the benchmark fixtures.</li>
<li>Improvement: Improved HTML parser throughput stability by
making hot tokeniser scan paths compile more predictably.</li>
<li>Improvement: &lt;noscript&gt; fallback markup is now parsed
into an
inspectable DOM subtree in both the document head and body.
The fallback acts as a contained parsing island, so malformed
markup cannot disrupt the surrounding document structure,
while normal HTML tokenization still applies within it. This
also improves round-trip serialization.</li>
<li>Improvement: Improved redirect credential handling as a
defense-in-depth measure: explicit authorization headers and
request cookies are no longer forwarded across origins,
reducing exposure through open redirects and aligning with
HTTP guidance. Cookies managed by a CookieStore continue to
follow their configured scope.</li>
<li>Improvement: Elements can now append their outer HTML,
including their own tags, directly to an Appendable with
Node#outerHtml(Appendable), without first creating a String.
This complements Element#html(Appendable), which appends inner
HTML only.</li>
<li>Improvement: Aligned CDATA tokenization with the HTML spec:
CDATA syntax in HTML content is parsed as a bogus comment,
while it remains supported in SVG, MathML, and XML. Also
improved namespace-aware fragment parsing so SVG and MathML
contexts, HTML integration points, and context-sensitive
tokenizer states are handled correctly.</li>
<li>Improvement: When using the optional re2j regular expression
engine, stack overflows caused by complex selector patterns
are now normalized to a ValidationException with a Pattern
complexity error message.</li>
<li>Bugfix: Fixed HTML parsing of mixed-case RCDATA end tags after
tag-shaped text. For example,
&lt;title&gt;&lt;p&gt;Foo&lt;/TiTLE&gt; and
&lt;textarea&gt;&lt;img src=x&gt;&lt;/TeXtArEa&gt; now
keep the tag-shaped
content as text instead of promoting it to markup.</li>
<li>Bugfix: Fixed W3CDom XML conversion so plain XML elements
don&#x27;t serialize with the reserved XML namespace as the default
namespace. Explicit XML namespaces and xml:* attributes are
still preserved.</li>
<li>Bugfix: Preserve control characters in parsed tag names.</li>
<li>Bugfix: Updated HTTP redirects to follow the specification:
307 and 308 preserve the request method and content, 301 and
302 only change POST to GET, and Location is followed only for
301, 302, 303, 307, and 308 responses. Streamed request bodies
are not buffered; if an automatic redirect requires replaying
one, execution fails, so the caller can resend with a fresh
stream.</li>
<li>Bugfix: Corrected the Cleaner&#x27;s same-site link detection to
compare hostnames rather than URL prefixes when applying
rel=nofollow.</li>
<li>Build change: Cleaned up the Maven build for the multi-release
JAR so Java 8 and Java 11+ sources compile as separate source
sets. This avoids spurious Java 8 compiler warnings from
newer-language overlay sources, keeps long-running parser
checks behind an explicit profile, and preserves the same
published artifacts and runtime behavior.</li>
<li>Build change: Improved parallelism and tuned timing in our
integration tests, so that a full mvn clean verify drops from
~ 1m18s to ~ 21 seconds.</li>
<li>Changes of 1.22.2</li>
<li>Improvement: Expanded and clarified NodeTraversor support for
in-place DOM rewrites during NodeVisitor.head(). Current-node
edits such as remove, replace, and unwrap now recover more
predictably, while traversal stays within the original root
subtree. This makes single-pass tree cleanup and normalization
visitors easier to write, for example when unwrapping
presentational elements or replacing text nodes as you walk
the DOM.</li>
<li>Documentation: clarified that a configured Cleaner may be
reused across concurrent threads, and that shared Safelist
instances should not be mutated while in use.</li>
<li>Improvement: Updated the default HTML TagSet for current HTML
elements: added dialog, search, picture, and slot; made ins,
del, button, audio, video, and canvas inline by default
(Tag#isInline(), aligned to phrasing content in the spec); and
added readable Element.text() boundaries for controls and
embedded objects via the new Tag.TextBoundary option. This
improves pretty-printing and keeps normalized text from
running adjacent words together.</li>
<li>Android (R8/ProGuard): added a rule to ignore the optional
re2j dependency when not present.</li>
<li>Bugfix: Fixed a NodeTraversor regression in 1.21.2 where
removing or replacing the current node during head() could
revisit the replacement node and loop indefinitely. The
traversal docs now also clarify which inserted nodes are
visited in the current pass.</li>
<li>Bugfix: Parsing during charset sniffing no longer fails if an
advisory available() call throws IOException, as seen on JDK 8
HttpURLConnection.</li>
<li>Bugfix: Cleaner no longer makes relative URL attributes in the
input document absolute when cleaning or validating a
Document. URL normalization now applies only to the cleaned
output, and Safelist.isSafeAttribute() is side effect free.</li>
<li>Bugfix: Cleaner no longer duplicates enforced attributes when
the input Document preserves attribute case. A case-variant
source attribute is now replaced by the enforced attribute in
the cleaned output.</li>
<li>Bugfix: If a per-request SOCKS proxy is configured, jsoup now
avoids using the JDK HttpClient, because the JDK would
silently ignore that proxy and attempt to connect directly.
Those requests now fall back to the legacy HttpURLConnection
transport instead, which does support SOCKS.</li>
<li>Bugfix: Connection.Response.streamParser() and
DataUtil.streamParser(Path, ...) could fail on small inputs
without a declared charset, if the initial 5 KB charset sniff
fully consumed the input and closed it before the stream parse
began.</li>
<li>Bugfix: In XML mode, doctypes with an internal subset, such as
&lt;!DOCTYPE root [&lt;!ENTITY name
&quot;value&quot;&gt;]&gt;, now round-trip
correctly. The subset is preserved as raw text only; entities
are not expanded and external DTDs are not loaded.</li>
<li>Build change: Migrated the integration test server from Jetty
to Netty, which actively maintains support for our minimum JDK
target (8).</li>
<li>Changes of 1.22.1</li>
<li>Improvement: Added support for using the re2j regular
expression engine for regex-based CSS selectors (e.g.
[attr~=regex], :matches(regex)), which ensures linear-time
performance for regex evaluation. This allows safer handling
of arbitrary user-supplied query regexes. To enable, add the
com.google.re2j dependency to your classpath, e.g.:
&lt;dependency&gt;
&lt;groupId&gt;com.google.re2j&lt;/groupId&gt;
&lt;artifactId&gt;re2j&lt;/artifactId&gt;
&lt;version&gt;1.8&lt;/version&gt;
&lt;/dependency&gt;
(If you already have that dependency in your classpath, but
you want to keep using the Java regex engine, you can disable
re2j via System.setProperty(&quot;jsoup.useRe2j&quot;,
&quot;false&quot;).) You
can confirm that the re2j engine has been enabled correctly by
calling Regex.usingRe2j().</li>
<li>Improvement: Added an instance method Parser#unescape(String,
boolean) that unescapes HTML entities using the parser&#x27;s
configuration (e.g. to support error tracking), complementing
the existing static utility Parser.unescapeEntities(String,
boolean).</li>
<li>Improvement: Added a configurable maximum parser depth (to
limit the number of open elements on stack) to both HTML and
XML parsers. The HTML parser now defaults to a depth of 512 to
match browser behavior, and protect against unbounded stack
growth, while the XML parser keeps unlimited depth by default,
but can opt into a limit via Parser.setMaxDepth().</li>
<li>Build: added CI coverage for JDK 25.</li>
<li>Build: added a CI fuzzer for contextual fragment parsing (in
addition to existing full body HTML and XML fuzzers).</li>
<li>Change: Set a removal schedule of jsoup 1.24.1 for previously
deprecated APIs.</li>
<li>Bugfix: Previously cached child Elements of an Element were
not correctly invalidated in Node#replaceWith(Node), which
could lead to incorrect results when subsequently calling
Element#children().</li>
<li>Bugfix: Attribute selector values are now compared literally
without trimming. Previously, jsoup trimmed whitespace from
selector values and from element attribute values, which could
cause mismatches with browser behavior (e.g. [attr=&quot; foo
&quot;]).
Now matches align with the CSS specification and browser
engines.</li>
<li>Bugfix: When using the JDK HttpClient, any system default
proxy (ProxySelector.getDefault()) was ignored. Now, the
system proxy is used if a per-request proxy is not set.</li>
<li>Bugfix: A ValidationException could be thrown in the adoption
agency algorithm with particularly broken input. Now logged as
a parse error.</li>
<li>Bugfix: Null characters in the HTML body were not consistently
removed; and in foreign content were not correctly replaced.</li>
<li>Bugfix: An IndexOutOfBoundsException could be thrown when
parsing a body fragment with crafted input. Now logged as a
parse error.</li>
<li>Bugfix: When using StructuralEvaluators (e.g., a parent child
selector) across many retained threads, their memoized results
could also be retained, increasing memory use. These results
are now cleared immediately after use, reducing overall memory
consumption.</li>
<li>Bugfix: Cloning a Parser now preserves any custom TagSet
applied to the parser.</li>
<li>Bugfix: Custom tags marked as Tag.Void now parse and serialize
like the built-in void elements: they no longer consume
following content, and the XML serializer emits the expected
self-closing form.</li>
<li>Bugfix: The &lt;br&gt; element is once again classified as an
inline
tag (Tag.isBlock() == false), matching common developer
expectations and its role as phrasing content in HTML, while
pretty-printing and text extraction continue to treat it as a
line break in the rendered output.</li>
<li>Bugfix: Fixed an intermittent truncation issue when fetching
and parsing remote documents via Jsoup.connect(url).get(). On
responses without a charset header, the initial charset sniff
could sometimes (depending on buffering / available()
behavior) be mistaken for end-of-stream and a partial parse
reused, dropping trailing content.</li>
<li>Bugfix: TagSet copies no longer mutate their template during
lazy lookups, preventing cross-thread
ConcurrentModificationException when parsing with shared
sessions.</li>
<li>Bugfix: Fixed parsing of &lt;svg&gt; foreignObject content
nested
within a &lt;p&gt;, which could incorrectly move the HTML subtree
outside the SVG.</li>
<li>Change: Deprecated internal helper
org.jsoup.internal.Functions (for removal in v1.23.1). This
was previously used to support older Android API levels
without full java.util.function coverage; jsoup now requires
core library desugaring so this indirection is no longer
necessary.</li>
<li>Changes of 1.21.2</li>
<li>Change: Deprecated internal (yet visible) methods
Normalizer#normalize(String, bool) and
Attribute#shouldCollapseAttribute(Document.OutputSettings).
These will be removed in a future version.</li>
<li>Change: Deprecated
Connection#sslSocketFactory(SSLSocketFactory) in favor of the
new Connection#sslContext(SSLContext). Using sslSocketFactory
will force the use of the legacy HttpUrlConnection
implementation, which does not support HTTP/2.</li>
<li>Improvement: When pretty-printing, if there are consecutive
text nodes (via DOM manipulation), the non-significant
whitespace between them will be collapsed.</li>
<li>Improvement: Updated Connection.Response#statusMessage() to
return a simple loggable string message (e.g. &quot;OK&quot;) when
using
the HttpClient implementation, which doesn&#x27;t otherwise return
any server-set status message.</li>
<li>Improvement: Attributes#size() and Attributes#isEmpty() now
exclude any internal attributes (such as user data) from their
count. This aligns with the attributes&#x27; serialized output and
iterator.</li>
<li>Improvement: Added Connection#sslContext(SSLContext) to
provide a custom SSL (TLS) context to requests, supporting
both the HttpClient and the legacy HttUrlConnection
implementations.</li>
<li>Improvement: Performance optimizations for DOM manipulation
methods including when repeatedly removing an element&#x27;s first
child (element.child(0).remove()), and when using
Parser#parseBodyFragement() to parse a large number of direct
children.</li>
<li>Bugfix: When parsing from an InputStream and a multibyte
character happened to straddle a buffer boundary, the stream
would not be completely read.</li>
<li>Bugfix: In NodeTraversor, if a last child element was removed
during the head() call, the parent would be visited twice.</li>
<li>Bugfix: Cloning an Element that has an Attributes object would
add an empty internal user-data attribute to that clone, which
would cause unexpected results for Attributes#size() and
Attributes#isEmpty().</li>
<li>Bugfix: In a multithreaded application where multiple threads
are calling Element#children() on the same element
concurrently, a race condition could happen when the method
was generating the internal child element cache (a filtered
view of its child nodes). Since concurrent reads of DOM
objects should be threadsafe without external synchronization,
this method has been updated to execute atomically.</li>
<li>Bugfix: When parsing HTML with svg:script elements in SVG
elements, don&#x27;t enter the Text insertion mode, but continue to
parse as foreign content. Otherwise, misnested HTML could then
cause an IndexOutOfBoundsException.</li>
<li>Bugfix: Malformed HTML could throw an
IndexOutOfBoundsException during the adoption agency.</li>
<li>Changes of 1.21.1</li>
<li>Change: Removed previously deprecated methods.</li>
<li>Change: Deprecated the :matchText pseduo-selector due to its
side effects on the DOM; use the new ::textnode selector and
the Element#selectNodes(String css, Class&lt;T&gt; type) method
instead.</li>
<li>Change: Deprecated Connection.Response#bufferUp() in lieu of
Connection.Response#readFully() which can throw a checked
IOException.</li>
<li>Change: Deprecated internal methods
Validate#ensureNotNull(Object) (replaced by typed
Validate#expectNotNull(T)); protected HTML appenders from
Attribute and Node.</li>
<li>Change: If you happen to be using any of the deprecated
methods, please take the opportunity now to migrate away from
them, as they will be removed in a future release.</li>
<li>Improvement: Enhanced the Selector to support direct matching
against nodes such as comments and text nodes. For example,
you can now find an element that follows a specific comment:
::comment:contains(prices) + p will select p elements
immediately after a &lt;!-- prices: --&gt; comment. Supported types
include ::node, ::leafnode, ::comment, ::text, ::data, and
::cdata. Node contextual selectors like ::node:contains(text),
:matches(regex), and :blank are also supported. Introduced
Element#selectNodes(String css) and Element#selectNodes(String
css, Class&lt;T&gt; nodeType) for direct node selection.</li>
<li>Improvement: Added TagSet#onNewTag(Consumer&lt;Tag&gt;
customizer):
register a callback that&#x27;s invoked for each new or cloned Tag
when it&#x27;s inserted into the set. Enables dynamic tweaks of tag
options (for example, marking all custom tags as self-closing,
or everything in a given namespace as preserving whitespace).</li>
<li>Improvement: Made TokenQueue and CharacterReader
autocloseable, to ensure that they will release their buffers
back to the buffer pool, for later reuse.</li>
<li>Improvement: Added Selector#evaluatorOf(String css), as a
clearer way to obtain an Evaluator from a CSS query. An alias
of QueryParser.parse(String css).</li>
<li>Improvement: Custom tags (defined via the TagSet) in a foreign
namespace (e.g. SVG) can be configured to parse as data tags.</li>
<li>Improvement: Added NodeVisitor#traverse(Node) to simplify node
traversal calls (vs. importing NodeTraversor).</li>
<li>Improvement: Updated the default user-agent string to improve
compatibility.</li>
<li>Improvement: The HTML parser now allows the specific text-data
type (Data, RcData) to be customized for known tags.
(Previously, that was only supported on custom tags.)</li>
<li>Improvement: Added Connection.Response#readFully() as a
replacement for Connection.Response#bufferUp() with an
explicit IOException. Similarly, added
Connection.Response#readBody() over
Connection.Response#body(). Deprecated
Connection.Response#bufferUp().</li>
<li>Improvement: When serializing HTML, the &lt; and &gt;
characters are
now escaped in attributes. This helps prevent a class of
mutation XSS attacks.</li>
<li>Improvement: Changed Connection to prefer using the JDK&#x27;s
HttpClient over HttpUrlConnection, if available, to enable
HTTP/2 support by default. Users can disable via
-Djsoup.useHttpClient=false.</li>
<li>Bugfix: The contents of a script in a svg foreign context
should be parsed as script data, not text.</li>
<li>Bugfix: Tag#isFormSubmittable() was updating the Tag&#x27;s
options.</li>
<li>Bugfix: The HTML pretty-printer would incorrectly trim
whitespace when text followed an inline element in a block
element.</li>
<li>Bugfix: Custom tags with hyphens or other non-letter
characters in their names now work correctly as Data or RcData
tags. Their closing tags are now tokenized properly.</li>
<li>Bugfix: When cloning an Element, the clone would retain the
source&#x27;s cached child Element list (if any), which could lead
to incorrect results when modifying the clone&#x27;s child
elements.</li>
<li>Changes of 1.20.1</li>
<li>Change: To better follow the HTML5 spec and current browsers,
the HTML parser no longer allows self-closing tags (&lt;foo /&gt;)
to close HTML elements by default. Foreign content (SVG,
MathML), and content parsed with the XML parser, still
supports self-closing tags. If you need specific HTML tags to
support self-closing, you can register a custom tag via the
TagSet configured in Parser.tagSet(), using
Tag#set(Tag.SelfClose). Standard void tags (such as &lt;img&gt;,
&lt;br&gt;, etc.) continue to behave as usual and are not affected
by this change.</li>
<li>Change: The following internal components have been
deprecated. If you do happen to be using any of these, please
take the opportunity now to migrate away from them, as they
will be removed in jsoup 1.21.1.</li>
<li>ChangeNotifyingArrayList,
Document.updateMetaCharsetElement(),
Document.updateMetaCharsetElement(boolean),
HtmlTreeBuilder.isContentForTagData(String),
Parser.isContentForTagData(String),
Parser.setTreeBuilder(TreeBuilder), Tag.formatAsBlock(),
Tag.isFormListed(), TokenQueue.addFirst(String),
TokenQueue.chompTo(String),
TokenQueue.chompToIgnoreCase(String),
TokenQueue.consumeToIgnoreCase(String),
TokenQueue.consumeWord(), TokenQueue.matchesAny(String...)</li>
<li>Improvement: Rebuilt the HTML pretty-printer, to simplify and
consolidate the implementation, improve consistency, support
custom Tags, and provide a cleaner path for ongoing
improvements. The specific HTML produced by the pretty-printer
may be different from previous versions.</li>
<li>Improvement: Added the ability to define custom tags, and to
modify properties of known tags, via the TagSet tag
collection. Their properties can impact both the parse and how
content is serialized (output as HTML or XML).</li>
<li>Improvement: Element.cssSelector() will prefer to return
shorter selectors by using ancestor IDs when available and
unique. E.g. #id &gt; div &gt; p instead of html &gt; body
&gt; div &gt; div
&gt; p.</li>
<li>Improvement: Added Elements.deselect(int index),
Elements.deselect(Object o), and Elements.deselectAll()
methods to remove elements from the Elements list without
removing them from the underlying DOM. Also added
Elements.asList() method to get a modifiable list of elements
without affecting the DOM. (Individual Elements remain linked
to the DOM.)</li>
<li>Improvement: Added support for sending a request body from an
InputStream with Connection.requestBodyStream(InputStream
stream).</li>
<li>Improvement: The XML parser now supports scoped xmlns: prefix
namespace declarations, and applies the correct namespace to
Tags and Attributes. Also, added Tag#prefix(),
Tag#localName(), Attribute#prefix(), Attribute#localName(),
and Attribute#namespace() to retrieve these.</li>
<li>Improvement: CSS identifiers are now escaped and unescaped
correctly to the CSS spec. Element#cssSelector() will emit
appropriately escaped selectors, and the QueryParser supports
those. Added Selector.escapeCssIdentifier() and `
Selector.unescapeCssIdentifier().</li>
<li>Improvement: Refactored the CSS QueryParser into a clearer
recursive descent parser.</li>
<li>Improvement: CSS selectors with consecutive combinators (e.g.
div &gt;&gt; p) will throw an explicit parse exception.</li>
<li>Performance: reduced the shallow size of an Element from 40 to
32 bytes, and the NodeList from 32 to 24.</li>
<li>Performance: reduced GC load of new StringBuilders when
tokenizing input HTML.</li>
<li>Improvement: Made Parser instances threadsafe, so that
inadvertent use of the same instance across threads will not
lead to errors. For actual concurrency, use
Parser#newInstance() per thread.</li>
<li>Bugfix: Element names containing characters invalid in XML are
now normalized to valid XML names when serializing.</li>
<li>Bugfix: When serializing to XML, characters that are invalid
in XML 1.0 should be removed (not encoded).</li>
<li>Bugfix: When converting a Document to the W3C DOM in W3CDom,
elements with an attribute in an undeclared namespace now get
a declaration of xmlns:prefix=&quot;undefined&quot;. This allows
subsequent serialization to XML via W3CDom.asString() to
succeed.</li>
<li>Bugfix: The StreamParser could emit the final elements of a
document twice, due to how onNodeCompleted was fired when
closing out the stack.</li>
<li>Bugfix: When parsing with the XML parser and error tracking
enabled, the trailing ? in &lt;?xml
version=&quot;1.0&quot;?&gt; would
incorrectly emit an error.</li>
<li>Bugfix: Calling Element#cssSelector() on an element with
combining characters in the class or ID now produces the
correct output.</li>
<li>Changes of 1.19.1</li>
<li>Change: Added support for http/2 requests in Jsoup.connect(),
when running on Java 11+, via the Java HttpClient
implementation.</li>
<li>In this version of jsoup, the default is to make requests
via the HttpUrlConnection implementation: use
System.setProperty(&quot;jsoup.useHttpClient&quot;,
&quot;true&quot;); to enable
making requests via the HttpClient (if available), which
will enable http/2 support. This will become the default in
a later version of jsoup, so now is a good time to validate
it.</li>
<li>If you are repackaging the jsoup jar in your deployment
(i.e. creating a shaded- or a fat-jar), make sure to specify
that as a Multi-Release JAR.</li>
<li>If the HttpClient impl is not available in your JRE,
requests will continue to be made via HttpURLConnection (in
http/1.1 mode).</li>
<li>Change: Updated the minimum Android API Level validation from
10 to 21. As with previous jsoup versions, Android developers
need to enable core library desugaring. The minimum Java
version remains Java 8.</li>
<li>Change: Removed previously deprecated class:
org.jsoup.UncheckedIOException (replace with
java.io.UncheckedIOException); moved previously deprecated
method Element Element#forEach(Consumer) to void
Element#forEach(Consumer()).</li>
<li>Change: Deprecated the methods
Document#updateMetaCharsetElement(boolean) and
Document#updateMetaCharsetElement(), as the setting had no
effect. When Document#charset(Charset) is called, the
document&#x27;s meta charset or XML encoding instruction is always
set.</li>
<li>Improvement: When cleaning HTML with a Safelist that preserves
relative links, the isValid() method will now consider these
links valid. Additionally, the enforced attribute rel=nofollow
will only be added to external links when configured in the
safelist.</li>
<li>Improvement: Added Element#selectStream(String query) and
Element#selectStream(Evaluator) methods, that return a Stream
of matching elements. Elements are evaluated and returned as
they are found, and the stream can be terminated early.</li>
<li>Improvement: Element objects now implement Iterable, enabling
them to be used in enhanced for loops.</li>
<li>Improvement: Added support for fragment parsing from a Reader
via Parser#parseFragmentInput(Reader, Element, String).</li>
<li>Improvement: Reintroduced CLI executable examples, in
jsoup-examples.jar.</li>
<li>Improvement: Optimized performance of selectors like #id
.class (and other similar descendant queries) by around 4.6x,
by better balancing the Ancestor evaluator&#x27;s cost function in
the query planner.</li>
<li>Improvement: Removed the legacy parsing rules for
&lt;isindex&gt;
tags, which would autovivify a form element with labels. This
is no longer in the spec.</li>
<li>Improvement: Added Elements.selectFirst(String cssQuery) and
Elements.expectFirst(String cssQuery), to select the first
matching element from an Elements list.</li>
<li>Improvement: When parsing with the XML parser, XML
Declarations and Processing Instructions are directly handled,
vs bouncing through the HTML parser&#x27;s bogus comment handler.
Serialization for non-doctype declarations no longer end with
a spurious !.</li>
<li>Improvement: When converting parsed HTML to XML or the W3C
DOM, element names containing &lt; are normalized to _ to ensure
valid XML. For example, &lt;foo&lt;bar&gt; becomes
&lt;foo_bar&gt;, as XML
does not allow &lt; in element names, but HTML5 does.</li>
<li>Improvement: Reimplemented the HTML5 Adoption Agency Algorithm
to the current spec. This handles mis-nested formating /
structural elements.</li>
<li>Bugfix: If an element has an ; in an attribute name, it could
not be converted to a W3C DOM element, and so subsequent XPath
queries could miss that element. Now, the attribute name is
more completely normalized.</li>
<li>Bugfix: For backwards compatibility, reverted the internal
attribute key for doctype names to &quot;name&quot;.</li>
<li>Bugfix: In Connection, skip cookies that have no name, rather
than throwing a validation exception.</li>
<li>Bugfix: When running on JDK 1.8, the error
java.lang.NoSuchMethodError:
java.nio.ByteBuffer.flip()Ljava/nio/ByteBuffer; could be
thrown when calling Response#body() after parsing from a URL
and the buffer size was exceeded.</li>
<li>Bugfix: For backwards compatibility, allow null InputStream
inputs to Jsoup.parse(InputStream stream, ...), by returning
an empty Document.</li>
<li>Bugfix: A template tag containing an li within an open li
would be parsed incorrectly, as it was not recognized as a
&quot;special&quot; tag (which have additional processing rules).
Also,
added the SVG and MathML namespace tags to the list of special
tags.</li>
<li>Bugfix: A template tag containing a button within an open
button would be parsed incorrectly, as the &quot;in button scope&quot;
check was not aware of the template element. Corrected other
instances including MathML and SVG elements, also.</li>
<li>Bugfix: An :nth-child selector with a negative digit-less
step, such as :nth-child(-n+2), would be parsed incorrectly as
a positive step, and so would not match as expected.</li>
<li>Bugfix: Calling doc.charset(charset) on an empty XML document
would throw an IndexOutOfBoundsException.</li>
<li>Bugfix: Fixed a memory leak when reusing a nested
StructuralEvaluator (e.g., a selector ancestor chain like A B
C) by ensuring cache reset calls cascade to inner members.</li>
<li>Bugfix: Concurrent calls to doc.clone().append(html) were not
supported. When a document was cloned, its Parser was not
cloned but was a shallow copy of the original parser.</li>
<li>Changes of 1.18.3</li>
<li>Bugfix: When serializing to XML, attribute names containing -,
., or digits were incorrectly marked as invalid and removed.</li>
<li>Changes of 1.18.2</li>
<li>Improvement: Optimized the throughput and memory use
throughout the input read and parse flows, with heap
allocations and GC down between -6% and -89%, and throughput
improved up to +143% for small inputs. Most inputs sizes will
see throughput increases of ~ 20%. These performance
improvements come through recycling the backing byte[] and
char[] arrays used to read and parse the input.</li>
<li>Improvement: Speed optimized html() and Entities.escape() when
the input contains UTF characters in a supplementary plane, by
around 49%.</li>
<li>Improvement: The form associated elements returned by
FormElement.elements() now reflect changes made to the DOM,
subsequently to the original parse.</li>
<li>Improvement: In the TreeBuilder, the onNodeInserted() and
onNodeClosed() events are now also fired for the outermost /
root Document node. This enables source position tracking on
the Document node (which was previously unset). And it also
enables the node traversor to see the outer Document node.</li>
<li>Improvement: Selected Elements can now be position swapped
inline using Elements#set().</li>
<li>Bugfix: Element.cssSelector() would fail if the element&#x27;s
class contained a * character.</li>
<li>Bugfix: When tracking source ranges, a text node following an
invalid self-closing element may be left untracked.</li>
<li>Bugfix: When a document has no doctype, or a doctype not named
html, it should be parsed in Quirks Mode.</li>
<li>Bugfix: With a selector like div:has(span + a), the has()
component was not working correctly, as the inner combining
query caused the evaluator to match those against the outer&#x27;s
siblings, not children.</li>
<li>Bugfix: A selector query that included multiple :has()
components in a nested :has() might incorrectly execute.</li>
<li>Bugfix: When cookie names in a response are duplicated, the
simple view of cookies available via
Connection.Response#cookies() will provide the last one set.
Generally it is better to use the Jsoup.newSession method to
maintain a cookie jar, as that applies appropriate path
selection on cookies when making requests.</li>
<li>Bugfix: When parsing named HTML entities, base entities should
resolve if they are a prefix of the input token (and not in an
attribute).</li>
<li>Bugfix: Fixed incorrect tracking of source ranges for
attributes merged from late-occurring elements that were
implicitly created (html or body).</li>
<li>Bugfix: Follow the current HTML specification in the tokenizer
to allow &lt; as part of a tag name, instead of emitting it as a
character node.</li>
<li>Bugfix: Similarly, allow a &lt; as the start of an attribute
name, vs creating a new element. The previous behavior was
intended to parse closer to what we anticipated the author&#x27;s
intent to be, but that does not align to the spec or to how
browsers behave.</li>
<li>Changes of 1.18.1</li>
<li>Improvement: Stream Parser: A StreamParser provides a
progressive parse of its input. For URL requests, available
via Connection.Response.streamParser(). As each Element is
completed, it is emitted via a Stream or Iterator interface.
Elements returned will be complete with all their children,
and an (empty) next sibling, if applicable. Elements (or their
children) may be removed from the DOM during the parse, for
e.g. to conserve memory, providing a mechanism to parse an
input document that would otherwise be too large to fit into
memory, yet still providing a DOM interface to the document
and its elements. Additionally, the parser provides a
selectFirst(String query) / selectNext(String query), which
will run the parser until a hit is found, at which point the
parse is suspended. It can be resumed via another select()
call, or via the stream() or iterator() methods.</li>
<li>Improvement: Download Progress: added a Response Progress
event interface, which reports progress and URLs are
downloaded (and parsed). Set via
Connection.onResponseProgress(). Supported on both a session
and a single connection level.</li>
<li>Improvement: Added Path accepting parse methods:
Jsoup.parse(Path), Jsoup.parse(path, charsetName, baseUri,
parser), etc.</li>
<li>Improvement: Updated the button tag configuration to include a
space between multiple button elements in the Element.text()
method.</li>
<li>Improvement: Added support for the ns|* all elements in
namespace Selector.</li>
<li>Improvement: When normalising attribute names during
serialization, invalid characters are now replaced with _, vs
being stripped. This should make the process clearer, and
generally prevent an invalid attribute name being coerced
unexpectedly.</li>
<li>Change: Removed previously deprecated internal classes and
methods.</li>
<li>Build change: the built jar&#x27;s OSGi manifest no longer
imports
itself.</li>
<li>Bugfix: When tracking source positions, if the first node was
a TextNode, its position was incorrectly set to -1.</li>
<li>Bugfix: When connecting (or redirecting) to URLs with
characters such as {, } in the path, a Malformed URL exception
would be thrown (if in development), or the URL might
otherwise not be escaped correctly (if in production). The URL
encoding process has been improved to handle these characters
correctly.</li>
<li>Bugfix: When using W3CDom with a custom output Document, a
Null Pointer Exception would be thrown.</li>
<li>Bugfix: The :has() selector did not match correctly when using
sibling combinators (like e.g.: h1:has(+h2)).</li>
<li>Bugfix: The :empty selector incorrectly matched elements that
started with a blank text node and were followed by non-empty
nodes, due to an incorrect short-circuit.</li>
<li>Bugfix: Element.cssSelector() would fail with &quot;Did not find
balanced marker&quot; when building a selector for elements that
had a ( or [ in their class names. And selectors with those
characters escaped would not match as expected.</li>
<li>Bugfix: Updated Entities.escape(string) to make the escaped
text suitable for both text nodes and attributes (previously
was only for text nodes). This does not impact the output of
Element.html() which correctly applies a minimal escape
depending on if the use will be for text data or in a quoted
attribute.</li>
<li>Fuzz: a Stack Overflow exception could occur when resolving a
crafted &lt;base href&gt; URL, in the normalizing regex.</li>
<li>Changes of 1.17.2</li>
<li>Improvement: Attribute object accessors: Added
Element.attribute(String) and Attributes.attribute(String) to
more simply obtain an Attribute object.</li>
<li>Improvement: Attribute source tracking: If source tracking is
on, and an Attribute&#x27;s key is changed (via
Attribute.setKey(String)), the source range is now still
tracked in Attribute.sourceRange().</li>
<li>Improvement: Wildcard attribute selector: Added support for
the [*] element with any attribute selector. And also restored
support for selecting by an empty attribute name prefix ([^]).</li>
<li>Bugfix: Mixed-cased source position: When tracking the source
position of attributes, if the source attribute name was
mix-cased but the parser was lower-case normalizing attribute
names, the source position for that attribute was not tracked</li>
<li>Bugfix: Source position NPE: When tracking the source position
of a body fragment parse, a null pointer exception was thrown.</li>
<li>Bugfix: Multi-point emoji entity: A multi-point encoded emoji
entity may be incorrectly decoded to the replacement character</li>
<li>Bugfix: Selector sub-expressions: (Regression) in a selector
like parent [attr=va], other, the , OR was binding to
[attr=va] instead of parent [attr=va], causing incorrect
selections. The fix includes a EvaluatorDebug class that
generates a sexpr to represent the query, allowing simpler and
more thorough query parse tests.</li>
<li>Bugfix: XML CData output: When generating XML-syntax output
from parsed HTML, script nodes containing (pseudo) CData
sections would have an extraneous CData section added, causing
script execution errors. Now, the data content is emitted in a
HTML/XML/XHTML polyglot format, if the data is not already
within a CData section.</li>
<li>Bugfix: Thread safety: The :has evaluator held a
non-thread-safe Iterator, and so if an Evaluator object was
shared across multiple concurrent threads, a NoSuchElement
exception may be thrown, and the selected results may be
incorrect. Now, the iterator object is a thread-local.</li>
<li>Changes of 1.17.1</li>
<li>Improvement: in Jsoup.connect(), added support for
request-level authentication, supporting authentication to
proxies and to servers.</li>
<li>Improvement: in the Elements list, added direct support for
<code>#set(index, element)</code>,
<code>#remove(index)</code>, <code>#remove(object)</code>,
<code>#clear()</code>,
<code>#removeAll(collection)</code>,
<code>#retainAll(collection)</code>,
<code>#removeIf(filter)</code>,
<code>#replaceAll(operator)</code>. These methods update the
original
DOM, as well as the Elements list.</li>
<li>Improvement: added the NodeIterator class, to efficiently
traverse a node tree using the Iterator interface. And
added Stream Element#stream() and Node#nodeStream() methods,
to enable fluent composable stream pipelines of node
traversals.</li>
<li>Improvement: when changing the OutputSettings syntax to XML,
the xhtml EscapeMode is automatically set by default.</li>
<li>Improvement: added the <code>:is(selector list)</code>
pseudo-selector,
which finds elements that match any of the selectors in the
selector list. Useful for making large ORed selectors more
readable.</li>
<li>Improvement: repackaged the library with native (vs automatic)
JPMS module support.</li>
<li>Improvement: better fidelity of source positions when tracking
is enabled. And implicitly created or closed elements are
tracked and detectable via Range.isImplicit().</li>
<li>Improvement: when source tracking is enabled, the source
position for attribute names and values is now available.
Attribute#sourceRange() provides the ranges.</li>
<li>Improvement: when running concurrently under Java 21+ Virtual
Threads, virtual threads could be pinned to their carrier
platform thread when parsing an input stream. To improve
performance, particularly when parsing fetched URLs, the
internal ConstrainableInputStream has been replaced by
ControllableInputStream, which avoids the locking which caused
that pinning.</li>
<li>Improvement: in Jsoup.Connect, allow any XML mimetype as a
supported mimetype. Was previously limited to
<code>{application|text}/xml</code>. This enables for e.g.
fetching SVGs
with a image/svg+xml mimetype, without having to disable
mimetype validation.</li>
<li>Bugfix: when outputting with XML syntax, HTML elements that
were parsed as data nodes (&lt;script&gt; and &lt;style&gt;)
should be
emitted as CDATA nodes, so that they can be parsed correctly
by an XML parser.</li>
<li>Bugfix: the Immediate Parent selector
<code>&amp;gt;</code> could match elements
above the root context element, causing incorrect elements to
be returned when used on elements other than the root document</li>
<li>Bugfix: in a sub-query such as <code>p:has(&amp;gt; span,
&amp;gt; i)</code>,
combinators following the <code>,</code> Or combinator would be
incorrectly skipped, such that the sub-query was parsed as
<code>i</code>
instead of <code>&amp;gt; i</code>.</li>
<li>Bugfix: in W3CDom, if the jsoup input document contained an
empty doctype, the conversion would fail with a DOMException.
Now, said doctype is discarded, and the conversion continues.</li>
<li>Bugfix: when cleaning a document containing SVG elements (or
other foreign elements that have preserved case names),
the cleaned output would be incorrectly nested if the safelist
had a different case than the input document.</li>
<li>Bugfix: when cleaning a document, the output style of unknown
self-closing tags from the input was not preserved in the
output. (So a &lt;foo /&gt; in the input, if safe-listed, would be
output as &lt;foo&gt;&lt;/foo&gt;.)</li>
<li>Build Improvement: added a local test proxy implementation,
for proxy integration tests.</li>
<li>Build Improvement: added tests for HTTPS request support,
using a local self-signed cert. Includes proxy tests.</li>
<li>Change: the InputStream returned in Connection.Response
.bodyStream() is no longer a ConstrainedInputStream, and so is
not subject to settings such as timeout or maximum size. It is
now a plain BufferedInputStream around the response stream.
Whilst this behaviour was not documented, you may have been
inadvertently relying on those constraints. The constraints
are still applied to other methods such as .parse() and
.bufferUp(). So if you do want a constrained
BufferedInputStream, you may do Connection.Response.bufferUp()
.bodyStream().</li>
<li>Changes of 1.16.2</li>
<li>Improvement: optimized the performance of complex CSS
selectors, by adding a cost-based query planner. Evaluators
are sorted by their relative execution cost, and executed in
order of lower to higher cost. This speeds the matching
process by ensuring that simpler evaluations (such as a tag
name match) are conducted prior to more complex evaluations
(such as an attribute regex, or a deep child scan with a
:has).</li>
<li>Improvement: added support for &lt;svg&gt; and
&lt;math&gt; tags (and
their children). This includes tag namespaces and case
preservation on applicable tags and attributes.</li>
<li>Improvement: when converting jsoup Documents to W3C Documents
in W3CDom, HTML documents will be placed in the
<code>http://www.w3.org/1999/xhtml</code> namespace by default, per the
HTML5 spec. This can be controlled by setting
<code>W3CDom#namespaceAware(false)</code>.</li>
<li>Improvement: speed optimized the Structural Evaluators by
memoizing previous evaluations. Particularly the <code>~</code>
(any
preceding sibling) and <code>:nth-of-type</code> selectors are
improved.</li>
<li>Improvement: tweaked the performance of the Element
nextElementSibling, previousElementSibling,
firstElementSibling, lastElementSibling, firstElementChild,
and lastElementChild. They now inplace filter/skip in the
child-node list, vs having to allocate and scan a complete
Element filtered list.</li>
<li>Improvement: optimized internal methods that previously called
Element.children() to use filter/skip child-node list
accessors instead, reducing new Element List allocations.</li>
<li>Improvement: tweaked the performance of parsing :pseudo
selectors.</li>
<li>Improvement: when using the <code>:empty</code>
pseudo-selector, blank
textnodes are now considered empty. Previously, an element
containing any whitespace was not considered empty.</li>
<li>Improvement: in forms, &lt;input
type=&quot;image&quot;&gt; should be excluded
from formData() (and hence from form submissions).</li>
<li>Improvement: in Safelist, made isSafeTag and isSafeAttribute
public methods, for extensibility.</li>
<li>Bugfix: <code>form</code> elements and empty elements
(such as <code>img</code>) did
not have their attributes de-duplicated.</li>
<li>Bugfix: if Document.OutputSettings was cloned from a clone, an
NPE would be thrown when used.</li>
<li>Bugfix: in Jsoup.connect(url), URL paths containing a %2B were
incorrectly recoded to a &#x27;+&#x27;, or a &#x27;+&#x27; was
recoded to a &#x27; &#x27;.
Fixed by reverting to the previous behavior of not encoding
supplied paths, other than normalizing to ASCII.</li>
<li>Bugfix: in Jsoup.connect(url), strings containing supplemental
characters (e.g. emoji) were not URL escaped correctly.</li>
<li>Bugfix: in Jsoup.connect(url), the ConstrainableInputStream
would clear Thread interrupts when reading the body. This
precluded callers from spawning a thread, running a number of
requests for a length of time, then joining that thread after
interrupting it.</li>
<li>Bugfix: when tracking HTML source positions, the closing tags
for H1...H6 elements were not tracked correctly.</li>
<li>Bugfix: in Jsoup.connect(), a DELETE method request did not
support a request body.</li>
<li>Bugfix: when calling Element.cssSelector() on an extremely
deeply nested element, a StackOverflowError could occur.
Further, a StackOverflowError may occur when running the query</li>
<li>Bugfix: appending a node back to its original Element after
empty() would throw an Index out of bounds exception. Also,
now the child nodes that were removed have their parent node
cleared, fully detaching them from the original parent.</li>
<li>Bugfix: in Jsoup.Connection when adding headers, the value may
have been assumed to be an incorrectly decoded ISO_8859_1
string, and re-encoded as UTF-8. The value is now left as-is.</li>
<li>Change: removed previously deprecated methods
Document#normalise, Element#forEach(org.jsoup.helper
.Consumer&lt;&gt;),
Node#forEach(org.jsoup.helper.Consumer&lt;&gt;), and
the org.jsoup.helper.Consumer interface; the latter being a
previously required compatibility shim prior to Android&#x27;s
de-sugaring support.</li>
<li>Change: the previous compatibility shim
org.jsoup.UncheckedIOException is deprecated in favor of the
now supported java.io.UncheckedIOException. If you are
catching the former, modify your code to catch the latter</li>
<li>Change: blocked noscript tags from being added to Safelists,
due to incompatibilities between parsers with and without
script-mode enabled.</li>
<li>Changes of 1.16.1</li>
<li>Improvement: in Jsoup.connect(url), natively support URLs with
Unicode characters in the path or query string, without having
to be escaped by the caller.</li>
<li>Improvement: Calling Node.remove() on a node with no parent is
now a no-op, vs a validation error.</li>
<li>Bugfix: aligned the HTML Tree Builder processing steps for
AfterBody and AfterAfterBody to the updated WHATWG standard,
to not pop the stack to close &lt;body&gt; or &lt;html&gt;
elements. This
prevents an errant &lt;/html&gt; closing preceding structure. Also
added appropriate error message outputs in this case.</li>
<li>Bugfix: Corrected support for ruby elements (&lt;ruby&gt;,
&lt;rp&gt;,
&lt;rt&gt;, and &lt;rtc&gt;) to current spec.</li>
<li>Bugfix: When using Node.before(node) or Node.after(node), if
the incoming node was a sibling of the context node, the
incoming node may be inserted into the wrong relative location</li>
<li>Bugfix: In Jsoup.connect(url), if the input URL had components
that were already % escaped, they would be escaped again,
causing errors when fetched.</li>
<li>Bugfix: when tracking input source positions, text in tables
that was fostered had invalid positions.</li>
<li>Bugfix: If the Document.OutputSettings class was initialized,
and then Entities.escape(String) called, an NPE may be thrown
due to a class loading circular dependency.</li>
<li>Bugfix: when pretty-printing, the first inline Element or
Comment in a block would not be wrap-indented if it were
preceded by a blank text node.</li>
<li>Bugfix: when pretty-printing a &lt;pre&gt; containing block
tags,
those tags were incorrectly indented.</li>
<li>Bugfix: when pretty-printing nested inlineable blocks (such as
a &lt;p&gt; in a &lt;td&gt;), the inner element should be
indented.</li>
<li>Bugfix: &lt;br&gt; tags should be wrap-indented when in block
tags
(and not when in inline tags).</li>
<li>Bugfix: the contents of a sufficiently large &lt;textarea&gt;
with
un-escaped HTML closing tags may be incorrectly parsed to an
empty node.</li>
<li>Changes of 1.15.4</li>
<li>Improvement: added the ability to escape CSS selectors (tags,
IDs, classes) to match elements that don&#x27;t follow regular CSS
syntax. For example, to match by classname
&lt;p class=&quot;one.two&quot;&gt;, use
document.select(&quot;p.one\.two&quot;);</li>
<li>Improvement: when pretty-printing, wrap text that follows a
&lt;br&gt; tag.</li>
<li>Improvement: when pretty-printing, normalize newlines that
follow self-closing tags in custom tags.</li>
<li>Improvement: when pretty-printing, collapse non-significant
whitespace between a block and an inline tag.</li>
<li>Improvement: in Element#forEach and Node#forEachNode, use
java.util.function.Consumer instead of the previous Android
compatibility shim org.jsoup.helper.Consumer. Subsequently,
the latter has been deprecated.</li>
<li>Improvement: added a new method Document#forms(), to
conveniently retrieve a List&lt;FormElement&gt; containing the
&lt;form&gt; elements in a document.</li>
<li>Improvement: added a new method Document#expectForm(query),
to find the first matching FormElement, or blow up trying.</li>
<li>Bugfix: URLs containing characters such as [ and ] were not
escaped correctly, and would throw a MalformedURLException
when fetched.</li>
<li>Bugfix: Element.cssSelector would create invalid selectors for
elements where the tag name, ID, or classnames needed to be
escaped (e.g. if a class name contained a &#x27;:&#x27; or
&#x27;.&#x27;).</li>
<li>Bugfix: element.text() should have a space between a block and
an inline element.</li>
<li>Bugfix: if a Node or an Element was replaced with itself, that
node would incorrectly be orphaned.</li>
<li>Bugfix: form data on a previous request was copied to a new
request in newRequest(), resulting in an accumulation of form
data when executing multi-step form submissions, or data sent
to later requests incorrectly. Now, newRequest() only copies
session related settings (cookies, proxy settings, user-agent,
etc) but not the request data nor the body.</li>
<li>Bugfix: fixed an issue in Safelist.removeAttributes which
could throw a ConcurrentModificationException when using the
&quot;:all&quot; pseudo-attribute.</li>
<li>Bugfix: given extremely deeply nested HTML, a number of
methods in Element could throw a StackOverflowError due to
excessive recursion. Namely: #data(), #hasText(), #parents(),
and #wrap(html).</li>
<li>Change: deprecated the unused Document#normalise() method.
Normalization occurs during the HTML tree construction, and no
longer as a distinct phase.</li>
</ul>

<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper
patch".<br/>

Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">

<li class="list-group-item">
SUSE Linux Enterprise Server 16.0

<br/>
<code>zypper in -t patch
SUSE-SLES-16.0-1728</code>

</li>

</ul>

<h2>Package List:</h2>
<ul>

<li>
SUSE Linux Enterprise Server 16.0 (noarch)
<ul>

<li>jsoup-1.23.2-160000.1.1</li>

<li>jsoup-javadoc-1.23.2-160000.1.1</li>

</ul>
</li>

</ul>

<h2>References:</h2>
<ul>

<li>
<a href="https://www.suse.com/security/cve/CVE-2026-75140.html">https://www.suse.com/security/cve/CVE-2026-75140.html</a>
</li>

<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1275912">https://bugzilla.suse.com/show_bug.cgi?id=1275912</a>
</li>

</ul>

</div>

--===============8878067578371777259==--