Security fixes

• Convert control characters (backspace particularly) to "?" preventing malicious copy-and-paste situations. (#298) See https://github.com/mozilla/bleach/issues/298 for more details. This affects all previous versions of Bleach. Check the comments on that issue for ways to alleviate the issue if you can't upgrade to Bleach 2.1.

Backwards incompatible changes

• Redid versioning. bleach.VERSION is no longer available. Use the string version at bleach.__version__ and parse it with pkg_resources.parse_version. (#307)

• clean, linkify: linkify and clean should only accept text types; thank you, Janusz! (#292)

• clean, linkify: accept only unicode or utf-8-encoded str (#176)

Features

Bug fixes

• bleach.clean() no longer unescapes entities including ones that are missing a ; at the end which can happen in urls and other places. (#143)

• linkify: fix http links inside of mailto links; thank you, sedrubal! (#300)

• clarify security policy in docs (#303)

• fix dependency specification for html5lib 1.0b8, 1.0b9, and 1.0b10; thank you, Zoltán! (#268)

• add Bleach vs. html5lib comparison to README; thank you, Stu Cox! (#278)

• fix KeyError exceptions on tags without href attr; thank you, Alex Defsen! (#273)

• add test website and scripts to test bleach.clean() output in browser; thank you, Greg Guthe!