Skip to content

Bump AngleSharp from 0.17.0 to 1.5.0#1807

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/nuget/src/sdk/PnP.Core/AngleSharp-1.5.0
Open

Bump AngleSharp from 0.17.0 to 1.5.0#1807
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/nuget/src/sdk/PnP.Core/AngleSharp-1.5.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 17, 2026

Copy link
Copy Markdown
Contributor

Updated AngleSharp from 0.17.0 to 1.5.0.

Release notes

Sourced from AngleSharp's releases.

1.5.0

Released on Saturday, June 6 2026

  • Fixed vulnerability via annoation-xml elements (GHSA-pgww-w46g-26qg)
  • Updated benchmarks (#​1246) @​jafin
  • Added ability to pass in cookie container to MemoryCookieProvider (#​1249) @​riina
  • Added HTML parser selector optimizations (#​1245) @​jafin

Full Changelog: AngleSharp/AngleSharp@v1.4.0...1.5.0

1.4.0

Released on Wednesday, November 12 2025.

  • Fixed handling of carriage return in text sources
  • Added support for of syntax in :nth-child functions within CSS selectors
  • Added selectedcontent to known elements (#​1230)
  • Added :open, ::checkmark, ::picker-icon, and ::picker(ident) to selector syntax (#​1230)
  • Added parsing for customizable <select> (#​1230)
  • Added .NET 10 as an explicit target

Full Changelog: AngleSharp/AngleSharp@1.3.1...v1.4.0

1.3.1

Released on Saturday, November 8 2025.

New Contributors

Full Changelog: AngleSharp/AngleSharp@1.3.0...1.3.1

1.3.0

Released on Friday, April 18 2025.

  • Fixed DOM exposed type of HasChildNodes (#​1219) @​arekdygas
  • Fixed NodeIterator behavior when nodes are removed (#​1222)
  • Improved form documentation (#​1220) @​RedZone908
  • Updated to NUKE 9 and removed obsolete .NET 6 and 9 targets (#​1216) @​lahma
  • Added GetAttributeNode methods to IElement (#​1223) @​arekdygas
  • Added support for finding targets in browsing contexts (#​1218) @​TheJayMann
  • Added support for targetting iframes (#​1205) @​TheJayMann

Full Changelog: AngleSharp/AngleSharp@1.2.0...1.3.0

1.2.0

Released on Tuesday, December 31 2024.

  • Fixed loading of link element source (#​1184) @​tomvanenckevort
  • Fixed usage of outdated dependency (#​1186)
  • Fixed cookie Expires recognized as local time (#​1212) @​noobow34
  • Fixed validation for problematic decimal step values (#​1210) @​rhuebner76
  • Removed unnecessary references for .NET 6 and higher (#​1187) @​lahma
  • Removed support for .NET 4.6.1 (least version is 4.6.2)
  • Updated to NUKE 8 (#​1188) @​lahma
  • Added new OnToken event for the tokenizer (#​1153) @​schaakverslaafd
  • Added new setting for disabling StringBuilder pooling (#​1203) @​micahbresette
  • Added context to extension methods (#​1194) @​memiamp
  • Added property attribute to meta tags (#​1195) @​hflexgrig

1.1.2

Released on Friday, March 8 2024.

  • Fixed exception when providing wrong response (#​1181)
  • Fixed handling of various inputs leading to timeouts (#​1180)

1.1.1-beta.390

Released on Thursday, February 29 2024.

  • Fixed ISourceReference not using HtmlToken underneath
  • Fixed handling of replacement characters in escaped script blocks (#​1174)
  • Fixed handling of empty template element in SVG foreign mode (#​1176)
  • Improved pre-release version to follow semver (#​1171) @​georg-jung
  • Improved NuGet package with link to repository (#​1168) @​thompson-tomo
  • Added PostAsMultipart helper for multipart/form-data to DocumentRequest (#​1173)

1.1.1-beta.388

Released on Thursday, February 29 2024.

  • Fixed ISourceReference not using HtmlToken underneath
  • Fixed handling of replacement characters in escaped script blocks (#​1174)
  • Improved pre-release version to follow semver (#​1171) @​georg-jung
  • Improved NuGet package with link to repository (#​1168) @​thompson-tomo

1.1.1-beta.387

Released on Tuesday, February 27 2024.

  • Fixed ISourceReference not using HtmlToken underneath
  • Improved pre-release version to follow semver (#​1171) @​georg-jung
  • Improved NuGet package with link to repository (#​1168) @​thompson-tomo

1.1.0

Released on Thursday, January 18 2024

  • Fixed priority calculations for selector lists (#​1161)
  • Fixed :where and :is selectors using forgiving lists
  • Added option for read only DOM (#​1154) @​dv00d00
  • Added more optimizations to reduce allocation rate (#​1159) @​dv00d00
  • Added support for nested selectors (&)

1.1.0-beta.384

Released on Thursday, January 18 2024

  • Fixed priority calculations for selector lists (#​1161)
  • Fixed :where and :is selectors using forgiving lists
  • Added option for read only DOM (#​1154) @​dv00d00
  • Added more optimizations to reduce allocation rate (#​1159) @​dv00d00
  • Added support for nested selectors (&)

1.0.7

What's Changed

  • Fixed implementation of IRange using offsets (#​1147) @​zukarusan
  • Improved performance in Node.set_Owner (#​1149) @​campersau
  • Added net8.0 as direct target framework
  • Released 1.0.7 by @​FlorianRappl in Release 1.0.7 AngleSharp/AngleSharp#1150

New Contributors

Full Changelog: AngleSharp/AngleSharp@v1.0.6...1.0.7

1.0.6

What's Changed

  • Fixed case-sensitiveness in virtual responses
  • Fixed warning for outdated actions in CI/CD workflow (#​1145) @​martincostello
  • Fixed AoT warning when trimming (#​1144) @​martincostello
  • Fixed decoding of entities in InnerHtml of <noscript> (#​1139)
  • Updated PrettyMarkupFormatter to keep new lines on demand (#​1131) @​dramlian
  • Released 1.0.6 by @​FlorianRappl in Release 1.0.6 AngleSharp/AngleSharp#1146

New Contributors

Full Changelog: AngleSharp/AngleSharp@v1.0.5...v1.0.6

1.0.6-alpha-328

Released on ???

  • Fixed case-sensitiveness in virtual responses

1.0.6-alpha-325

Released on ???

  • Fixed case-sensitiveness in virtual responses

1.0.5

What's Changed

  • Improved codebase (#​1128, #​1126, #​1133) @​matkoch @​ivandrofly
  • Improved documentation (#​1127)
  • Improved child selector performance (#​1135) @​lahma
  • Improved query selector all performance (#​584, #​1134) @​lahma
  • Fixed issue with foreign content using end tags
  • Fixed typo descendants (#​1136) @​SimonCropp
  • Added a way to resolve symbols by their name to HtmlEntityProvider (#​396)
  • Release 1.0.5 by @​FlorianRappl in Release 1.0.5 AngleSharp/AngleSharp#1137

New Contributors

Full Changelog: AngleSharp/AngleSharp@v1.0.4...v1.0.5

1.0.4

Released on Saturday, June 24 2023

What's Changed

  • Fixed issue with gzip encoding under certain conditions (#​1122)
  • Fixed issue with li scope leading to stack overflow (#​1123)
  • Added more pseudo selectors from Selector L4 spec (#​1121)

Full Changelog: AngleSharp/AngleSharp@1.0.3...v1.0.4

1.0.4-alpha-316

Released on Saturday, June 24 2023

  • Fixed issue with gzip encoding under certain conditions (#​1122)
  • Fixed issue with li scope leading to stack overflow (#​1123)
  • Added more pseudo selectors from Selector L4 spec (#​1121)

1.0.4-alpha-307

Released on Saturday, June 24 2023

  • Fixed issue with gzip encoding under certain conditions (#​1122)
  • Fixed issue with li scope leading to stack overflow (#​1123)
  • Added more pseudo selectors from Selector L4 spec (#​1121)

1.0.4-alpha-300

Released on Saturday, June 24 2023

  • Fixed issue with gzip encoding under certain conditions (#​1122)
  • Fixed issue with li scope leading to stack overflow (#​1123)
  • Added more pseudo selectors from Selector L4 spec (#​1121)

1.0.4-alpha-289

Released on Friday, June 23 2023

  • Added more pseudo selectors from Selector L4 spec (#​1121)

1.0.3

Released on Thursday, June 8 2023

What's Changed

  • Fixed wrong escaping of CSS selector pseudo class functions (#​1069)

Full Changelog: AngleSharp/AngleSharp@v1.0.2...v1.0.3

1.0.2

Released on Tuesday, June 4 2023

What's Changed

  • Improved codebase (#​1091, #​1090, #​1089, #​1088, #​1087, #​1086) @​SimonCropp
  • Fixed potential stack overflow in GetStyleSheets (#​1084) @​bjornri
  • Added public class HtmlTokenizer (#​1113)

Full Changelog: AngleSharp/AngleSharp@v1.0.1...v1.0.2

1.0.2-alpha-282

Released on Tuesday, June 4 2023

  • Improved codebase (#​1091, #​1090, #​1089, #​1088, #​1087, #​1086) @​SimonCropp
  • Fixed potential stack overflow in GetStyleSheets (#​1084) @​bjornri
  • Added public class HtmlTokenizer (#​1113)

1.0.2-alpha-277

Released on Tuesday, Feburary 21 2023

  • Improved codebase (#​1091, #​1090, #​1089, #​1088, #​1087, #​1086) @​SimonCropp
  • Fixed potential stack overflow in GetStyleSheets (#​1084) @​bjornri

1.0.2-alpha-276

Released on Tuesday, Feburary 21 2023

  • Improved codebase (#​1091, #​1090, #​1089, #​1088, #​1087, #​1086) @​SimonCropp
  • Fixed potential stack overflow in GetStyleSheets (#​1084) @​bjornri

1.0.2-alpha-258

Released on Tuesday, Feburary 21 2023

  • Improved codebase (#​1091, #​1090, #​1089, #​1088, #​1087, #​1086) @​SimonCropp
  • Fixed potential stack overflow in GetStyleSheets (#​1084) @​bjornri

1.0.2-alpha-250

Released on Tuesday, Feburary 21 2023

  • Improved codebase (#​1091, #​1090, #​1089, #​1088, #​1087, #​1086) @​SimonCropp
  • Fixed potential stack overflow in GetStyleSheets (#​1084) @​bjornri

1.0.2-alpha-249

Released on Tuesday, Feburary 21 2023

  • Improved codebase (#​1091, #​1090, #​1089, #​1088, #​1087, #​1086) @​SimonCropp
  • Fixed potential stack overflow in GetStyleSheets (#​1084) @​bjornri

1.0.1

Released on Monday, January 16 2023

What's Changed

  • Fixed entities in noscript being double encoded (#​1070)
  • Added previous Event constructor overload for ABI compatibility
  • Added README to NuGet package

Full Changelog: AngleSharp/AngleSharp@v1.0.0...v1.0.1

1.0.1-alpha-248

Released on Monday, January 16 2023

  • Fixed entities in noscript being double encoded (#​1070)
  • Added previous Event constructor overload for ABI compatibility
  • Added README to NuGet package

1.0.0

Released on Tuesday, January 10 2023

What's Changed

  • Updated build system to use NUKE instead of CAKE (#​1075) @​driekus77
  • Updated to support net7.0 by @​driekus77 in Update to net7.0 AngleSharp/AngleSharp#1074
  • Fixed TagClosedWrong error with nested formatting elements (#​1052)
  • Fixed performance issue within deeply nested structures (#​1066) @​heinrich-ulbricht
  • Fixed ISelector.Text escape values by @​MartinWelsch in (#​1069)
  • Fixed decoding of entities in noscript elements without scripting (#​1070)
  • Fixed setting templte content using InnerHtml (#​1072)
  • Fixed TreeWalker throwing NullReferenceException (#​1073)
  • Improved GetItemByIndex performance (#​1050) @​egil
  • Improved nullability (#​1057) @​jodydonetti
  • Improved CSS selectors by counting the specificity properly (#​1080) @​patrikwlund
  • Added GetComposedPath and IsComposed to the Event class (#​1053)
  • Release 1.0.0 by @​FlorianRappl in Release 1.0.0 AngleSharp/AngleSharp#1081

New Contributors

Full Changelog: AngleSharp/AngleSharp@v0.17.1...v1.0.0

1.0.0-alpha-231

Released on Tuesday, January 10 2023

  • Updated build system to use NUKE instead of CAKE (#​1075) @​driekus77
  • Fixed TagClosedWrong error with nested formatting elements (#​1052)
  • Fixed performance issue within deeply nested structures (#​1066) @​heinrich-ulbricht
  • Fixed decoding of entities in noscript elements without scripting (#​1070)
  • Fixed setting templte content using InnerHtml (#​1072)
  • Fixed TreeWalker throwing NullReferenceException (#​1073)
  • Improved GetItemByIndex performance (#​1050) @​egil
  • Improved nullability (#​1057) @​jodydonetti
  • Improved CSS selectors by counting the specificity properly (#​1080) @​patrikwlund
  • Added GetComposedPath and IsComposed to the Event class (#​1053)

1.0.0-alpha-229

Released on Monday, January 9 2023

  • Updated build system to use NUKE instead of CAKE (#​1075) @​driekus77
  • Fixed TagClosedWrong error with nested formatting elements (#​1052)
  • Fixed performance issue within deeply nested structures (#​1066) @​heinrich-ulbricht
  • Fixed decoding of entities in noscript elements without scripting (#​1070)
  • Fixed setting templte content using InnerHtml (#​1072)
  • Fixed TreeWalker throwing NullReferenceException (#​1073)
  • Improved GetItemByIndex performance (#​1050) @​egil
  • Improved nullability (#​1057) @​jodydonetti
  • Improved CSS selectors by counting the specificity properly (#​1080) @​patrikwlund
  • Added GetComposedPath and IsComposed to the Event class (#​1053)

0.17.1

Released on Thursday, June 2 2022

  • Fixed wrong reference to System.Text.Encoding.CodePages (#​1046) @​linkdotnet

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump AngleSharp from 0.17.0 to 1.5.0
117acb5 
---
updated-dependencies:
- dependency-name: AngleSharp
  dependency-version: 1.5.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Jul 17, 2026
@Adam-it

Adam-it commented Jul 20, 2026

Copy link
Copy Markdown
Member

this is a huge bump 😮
and also the security risk is regarding a HTML tag for MathML which I am almost sure we do not use but most probably we use it for some xml validation.
We should really reconsider if it's worth the bump and if so test the solution afterwards in great detail

@Adam-it

Adam-it commented Jul 21, 2026

Copy link
Copy Markdown
Member

lets research if we could drop this dependency maybe 🤔
@pnp/pnp-net-crew what do you think?

@czullu

czullu commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown

lets research if we could drop this dependency maybe 🤔 @pnp/pnp-net-crew what do you think?

The version 0.17.0 has reported vulnerability and needs to be upgraded. I did let GTP 5.6 Analyse the change when upgrade to 1.5.2 (which i use in my case) as the AngelSharp Library did undergo refactoring and there are breaking changes in release logs .
After change to 1.5.2 i did run the Test-Cases and they all complete:
image

As pnp.framework is using angelsharp library as well i will check this next..
.. the pnp.framework uses angleSharp.css as well. For this library exists only a prerelease which is compatible with angleSharp 1.x packages. Testing currently combination AngleSharp 1.5.2 and AngleSharp.Css 1.0.0-beta.224 in pnp.framework together with pnp.core on AngleSharp 1.5.2.

@Adam-it

Adam-it commented Jul 22, 2026

Copy link
Copy Markdown
Member

thanks @czullu for looking into it. Internally we already also discussed this dependency and most probably we will perform the bump in both PnP.Core and Framework.
Nevertheless we consider the vulnerability quite low, for it to happen someone (most probably an internal employee) would need to modify the internal HTML of a SP page (classic in case of Framework and modern in case of Core) and add a mathML tag so that it would get wrongly parsed. TBH seems like a edge scenario for it to happen 🙂

@czullu

czullu commented Jul 22, 2026

Copy link
Copy Markdown

thanks @czullu for looking into it. Internally we already also discussed this dependency and most probably we will perform the bump in both PnP.Core and Framework. Nevertheless we consider the vulnerability quite low, for it to happen someone (most probably an internal employee) would need to modify the internal HTML of a SP page (classic in case of Framework and modern in case of Core) and add a mathML tag so that it would get wrongly parsed. TBH seems like a edge scenario for it to happen 🙂

I agree, but as we have to deliver our solution and fork with Software Bill of Materials it's always better to remove then to justify.

As a followup on: Testing currently combination AngleSharp 1.5.2 and AngleSharp.Css 1.0.0-beta.224 in pnp.framework together with pnp.core on AngleSharp 1.5.2.
-i completed my test successfull with modern pages - i have no testcases for classic pages and they are not used by our customers anymore.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .net code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Adam-it @czullu