Switch from bleach to nh3

panel/tests/pane/test_markup.py

@@ -234,16 +234,16 @@ def test_html_pane(document, comm):
     assert pane._models == {}
 
 def test_html_pane_sanitize_html(document, comm):
-    pane = HTML("<h1><strong>HTML</h1></strong>", sanitize_html=True)
+    pane = HTML("<h1><strong>HTML</h1></strong><script></script>", sanitize_html=True)
 
     # Create pane
     model = pane.get_root(document, comm=comm)
     assert pane._models[model.ref['id']][0] is model
-    assert model.text.endswith("&lt;strong&gt;HTML&lt;/strong&gt;")
+    assert model.text.endswith("&lt;h1&gt;&lt;strong&gt;HTML&lt;/strong&gt;&lt;/h1&gt;")
 
     pane.sanitize_html = False
 
-    assert model.text.endswith('&lt;h1&gt;&lt;strong&gt;HTML&lt;/h1&gt;&lt;/strong&gt;')
+    assert model.text.endswith('&lt;h1&gt;&lt;strong&gt;HTML&lt;/h1&gt;&lt;/strong&gt;&lt;script&gt;&lt;/script&gt;')
 
 def test_dataframe_pane_pandas(document, comm):
     pane = DataFrame(pd.DataFrame({"A": [1, 2, 3]}))

panel/util/__init__.py

@@ -54,19 +54,19 @@
 
 class LazyHTMLSanitizer:
     """
-    Wraps bleach.sanitizer.Cleaner lazily importing it on the first
-    call to the clean method.
+    Wraps nh3.clean lazily importing it on the first call to clean.
     """
 
     def __init__(self, **kwargs):
-        self._cleaner = None
+        self._sanitize = None
+        kwargs.pop("strip", None)
         self._kwargs = kwargs
 
     def clean(self, text):
-        if self._cleaner is None:
-            import bleach
-            self._cleaner = bleach.sanitizer.Cleaner(**self._kwargs)
-        return self._cleaner.clean(text)
+        if self._sanitize is None:
+            import nh3
+            self._sanitize = partial(nh3.clean, **self._kwargs)
+        return self._sanitize(text)
 
 HTML_SANITIZER = LazyHTMLSanitizer(strip=True)
 

pixi.toml

@@ -85,7 +85,7 @@ esbuild = "*"
 nomkl = "*"
 pip = "*"
 # Required
-bleach = "*"
+nh3 = "*"
 bokeh = ">=3.7.0,<3.10.0a0"
 linkify-it-py = "*"
 markdown = "*"
@@ -267,7 +267,6 @@ depends-on = ["_install-ui"]
 mypy = "*"
 pytest = "*"
 pandas-stubs = "*"
-types-bleach = "*"
 types-croniter = "*"
 types-Markdown = "*"
 types-psutil = "*"

pyproject.toml

@@ -57,7 +57,7 @@ dependencies = [
     'mdit-py-plugins',
     'narwhals >=2',
     'requests',
-    'bleach',
+    'nh3',
     'typing_extensions',
     'pandas >=1.2',
     'packaging',
@@ -94,7 +94,6 @@ tests = [
 mypy = [
     "mypy",
     "pandas-stubs",
-    "types-bleach",
     "types-croniter",
     "types-Markdown",
     "types-psutil",