Repository navigation
bleach is deprecated; statement on project going forward (2023-01-23) #698
Description
Summary
As of now, Bleach is deprecated.
We will continue to support Bleach:
- security updates
- support for new Python versions
- fixes for egregious bugs
I figure that's one release a year or something like that.
Why?
Bleach sits on top of--and heavily relies on--html5lib which is no longer in active development. It is increasingly difficult to maintain Bleach in that context and I think it's nuts to build a security library on top of a library that's not in active development. There are some options (switch to something else, take over html5lib, etc), I don't particularly like any of them. I think instead, someone new should explore the options with a brand new library and a fresh start.
Update: 2026-06-05
Bleach 6.4.0 is the final release of Bleach. There will be no future releases including for Python support or security fixes. Thank you for using and contributing to Bleach!
Activity
hugovk commentedon Jan 29, 2023
Thank you for all your work on Bleach, and for announcing this clearly and with plenty of notice!
Lukas-J commentedon Mar 5, 2023
Hi @willkg ,
It seems there is some activity going on in html5lib. So maybe not all hope is lost for bleach. Is there any way it could become un-deprecated sometime?
If not, I'm struggling finding a suitable replacement for bleach to be honest. Does someone have recommendations to safely sanitize html user input?
Cheers!
g1-1-1 commentedon Mar 6, 2023
ammonia has a python binder you can use with similar features + faster speeds
jsocol commentedon Jul 31, 2023
Thank you, @willkg, for your stewardship of Bleach for so long—much longer than I had it or than I bet you expected to 😅
And thank you to all of the other contributors over the past dozen years. It's still amazing to me to see how much this project spread and influenced other libraries. nh3/ammonia look like fantastic, fast alternatives built on a rock solid foundation in html5ever.
qyryq commentedon Aug 18, 2023
What do people think about https://lxml.de/api/lxml.html.clean.Cleaner-class.html ?
Update: this comment links to docs which says:
There are 9 CVEs mentioning
lxmland 5 of them mentionclean.The
Cleanerclass hasallow_tagsandsafe_attrsparameters, so it could be used as an allowlist-based sanitizer, IIUC.Web browser developers are also working on https://wicg.github.io/sanitizer-api/. Chromium already has it. And Firefox has it behind a flag (https://caniuse.com/mdn-api_sanitizer). It's obviously far from being a Python package, but if security is our main concern, what is going to be more robust than a sanitizer built into a web browser?
willkg commentedon Oct 6, 2023
Update: I just pushed out Bleach 6.1.0 which drops Python 3.7 support, picks up Python 3.12 support, and fixes a handful of issues. I also closed out a lot of old issues and issues for things we're not going to fix.
I will continue fixing security issues as they come up.
Barring anything exciting, I'll probably do the next release when Python releases 3.13.
aclark4life commentedon Nov 20, 2023
@willkg Could this library or html5lib-python benefit from any "lifting efforts" as provided by Tidelift? E.g. https://tidelift.com/subscription/pkg/pypi-pillow. I am potentially looking for something new to "lift"… thanks for any info or guidance towards where to put my efforts.
Optimizing document sanitizer
kylepollina commentedon Feb 24, 2024
As of January 2024 there have been 3 commits to the htlm5lib repo: https://github.com/html5lib/html5lib-python/commits/master/
The html5lib is not entirely dead
Alex3917 commentedon Feb 24, 2024
FWIW, I tried nh3 as a replacement and found it to be unusable. I reported one issue here, but I've also found others that are at least as severe and probably much harder to fix:
messense/nh3#36
There also don't seem to be any Python libraries for linkifying HTML documents, only markdown. I understand why maintaining this library is problematic, but the functionality it provides is essential and there doesn't seem to be any viable replacement right now for either sanitization or linkification. I don't know what the right answer is, but wanted to share my experience since I've now put a few hours into trying to find a viable replacement for each set of functionality.
simonw commentedon Mar 16, 2024
html5libdoes have active maintainers at the moment: see this discussion thread for details html5lib/html5lib-python#560MikeHiett commentedon Mar 25, 2024
As @Alex3917 mentions, I've also tried implementing nh3 and the allowlists for tags and attributes does not work as described by the doucmentation for anyone who also may stumble into this problem
2 remaining items
py3-nh3: new package html sanitizer
py-nh3: new package - html santization using ammonia (Rust) (#30652)
Replace bleach with nh3 (mozilla/bleach#698)
GertBurger commentedon Jul 8, 2025
We migrated to
nh3but ended up migrating back tobleach.ammonia(the libnh3wraps) is not nearly as featureful asbleachandnh3doesn't expose all ofammonia's features.We'll stick with
bleachwhilst there isn't a mature alternative 👍 Thanks for the support @willkgankit-231 commentedon Sep 3, 2025
You can use nh3
EmilStenstrom commentedon Dec 12, 2025
@willkg Would you be interested in building bleach on top of https://github.com/EmilStenstrom/justhtml/ instead? Would be happy to add features needed to make bleach integration easier.
willkg commentedon Dec 12, 2025
@EmilStenstrom : That looks like a fascinating project! I don't think I'm interested in working on rewriting Bleach on top of JustHTML, but I definitely think it's a good idea for someone else to write a Bleach clone on top of JustHTML. It looks very promising.
EmilStenstrom commentedon Dec 13, 2025
@willkg Check!
I'm thinking of making sanitization part of the API of JustHTML. The main use-case for a HTML parser is people taking random - sometimes user-generated - HTML from the internet and trying to parse stuff from it. The HTML being untrusted should mean they think about security, but I think many don't. Making a HTML parser "safe by default" feels like a good idea.
Worried about one thing if incorporating something bleach-like into the project: The ongoing maintenance burden. Any tips on how to reduce that as much as possible, perhaps by changing the API surface? Anything you would have done differently?
Question about tests: A large contribution from this project over the years has been ironing out all the special cases and ways that people tried to break things with adversarial examples. Are you OK with other projects taking the tests and making it their own?
willkg commentedon Dec 13, 2025
I don't have anything off the top of my head regarding maintenance burden, reducing the API surface, or doing things differently. Sorry!
Regarding using the test code, all code and tests are distributed under the license text here:
https://github.com/mozilla/bleach/blob/main/LICENSE
As long as you follow the terms of the license, that's fine by me.
EmilStenstrom commentedon Jan 1, 2026
Just for reference, sanitization is now live in JustHTML. I used some bleach tests in the XSS-bench (used for testing the sanitization), with the included license bundled with the tests.
GertBurger commentedon Jan 7, 2026
@EmilStenstrom If you are looking at sanitisation then
dompurifyis kinda the gold standard and matching it would be a great benefit.barseghyanartur commentedon Jan 7, 2026
I'll switch to https://pypi.org/project/nh3/
niccokunzmann commentedon Mar 2, 2026
I found this funding option: https://www.herodevs.com/sustainability-fund It might be interesting.
willkg commentedon Jun 5, 2026
Hello all! I released Bleach 6.4.0 which is the last release of Bleach. There will be no future releases including for Python support or security fixes. This is the end.
Thank you all for using and contributing to Bleach! I wish you the best!