chore(deps): bump ammonia from 4.1.2 to 4.1.4

[dependabot]

Bumps ammonia from 4.1.2 to 4.1.4.

Release notes

Sourced from ammonia's releases.

4.1.4

• fix: SVG animation and set can cause XSS, because attributeName is not checked (reported by Younghun Ko, koyokr)

4.1.3

• fix: unexpected namespace switches after cleanup on MathML annotation-xml can cause mXSS

Special thanks to Ivan Ivančić (ivan0912, YesWeHack) for finding this vulnerability!

Changelog

Sourced from ammonia's changelog.

4.1.4

• fix: SVG animation and set can cause XSS, because attributeName is not checked (reported by Younghun Ko, koyokr)

4.1.3

• fix: unexpected namespace switches after cleanup on MathML annotation-xml can cause mXSS (reported by Ivan Ivančić)

• chore: upgrade to html5ever 0.37.1

• chore: always strip the contents of selectedcontent elements, since the parser will always replace it with the actual contents anyway

Commits

• fba7512 Merge pull request #250 from rust-ammonia/release-4.1.4
• 9e3335e Fix XSS caused by not sanitizing svg animations
• 7c64409 Merge pull request #249 from rust-ammonia/notriddle-patch-1
• 75d58d1 Fix credit in changelog by request
• 06b868a Merge pull request #246 from rust-ammonia/notriddle-patch-1
• 04ea01a Add credit to changelog
• 2c56268 Merge pull request #245 from rust-ammonia/release-4.1.3
• b51bf4f Release 4.1.3 with security fix
• e7bf160 Merge pull request #242 from gghez/worktree-issue-183-doc-document-level-tags
• 4eadffc Document fragment-parsing limit on html/head/body tags (closes #183)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: da7d2af5-06f4-4308-aa7e-3bdb77bc5928

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}