[dependabot]

Bumps the rust-patch group with 2 updates in the / directory: ammonia and getrandom.

Updates ammonia from 4.1.2 to 4.1.3

Release notes

Sourced from ammonia's releases.

4.1.3

• fix: unexpected namespace switches after cleanup on MathML annotation-xml can cause mXSS

Special thanks to Ivan Ivančić (ivan0912, YesWeHack) for finding this vulnerability!

Changelog

Sourced from ammonia's changelog.

4.1.3

• fix: unexpected namespace switches after cleanup on MathML annotation-xml can cause mXSS (reported by Ivan Ivančić (ivan0912, YesWeHack))

• chore: upgrade to html5ever 0.37.1

• chore: always strip the contents of selectedcontent elements, since the parser will always replace it with the actual contents anyway

Commits

• 2c56268 Merge pull request #245 from rust-ammonia/release-4.1.3
• b51bf4f Release 4.1.3 with security fix
• e7bf160 Merge pull request #242 from gghez/worktree-issue-183-doc-document-level-tags
• 4eadffc Document fragment-parsing limit on html/head/body tags (closes #183)
• 82955e7 Merge pull request #239 from gghez/worktree-issue-190-fix-to-dom-node-doc
• 879997e Merge pull request #238 from gghez/worktree-issue-211-rename-stack-overflow-t...
• e9d22b0 Fix to_dom_node doctest by wrapping Handle in SerializableHandle
• bf1de31 Rename deeply_nested_* tests to express stack-overflow regression intent
• 186f7b7 Merge pull request #235 from rust-ammonia/macros
• f7e2213 Disable cssparser proc macros
• Additional commits viewable in compare view

Updates getrandom from 0.4.2 to 0.4.3

Changelog

Sourced from getrandom's changelog.

0.4.3 - 2026-06-17

Added

• wasm64-unknown-unknown target support for wasm_js backend #848

Changed

• Drop wasip2 and wasip3 dependencies in favor of manual bindings #830

#830: rust-random/getrandom#830 #848: rust-random/getrandom#848

Commits

• 5e7cd57 Release v0.4.3 (#853)
• 1ea268a Use manual bindings for WASIp2/3 (#830)
• f7290b0 Update Cargo.lock (#852)
• 16ce801 Update Cargo.lock (#850)
• e5adfca Add wasm64-unknown-unknown support for wasm_js backend (#848)
• 626df8d Update Cargo.lock (#846)
• 4a01cb2 Update Cargo.lock (#841)
• f87bf39 Update Cargo.lock (#836)
• eadb879 ci: re-enable build job for x86_64-pc-cygwin (#832)
• d715d73 CI: Reduce the number of packages that are updated for wasip2 MSRV test (#825)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.