[dependabot]

Bumps floki from 0.38.4 to 0.38.5.

Release notes

Sourced from floki's releases.

v0.38.5

Fixed

• Fix quadratic-time parsing of unbalanced tags in the built-in "mochiweb" parser.

  For every end tag the parser scanned the entire stack of open elements, so malformed input with a deep stack of never-closed tags followed by many non-matching end tags took O(open_depth x end_tags) time. The parser now tracks the names of open elements and rejects a non-matching end tag without scanning the stack, making parsing linear again. The resulting parse tree is unchanged.

• Optimize functional selector matching.

  Instead of generating an+b values until one matches, solve the formula directly with bounds and a remainder check. This turns each match from a stream scan into O(1) arithmetic.

Pull requests

• Optimize functional selector matching by @​preciz in philss/floki#705
• Fix quadratic parsing of unbalanced tags in the Mochiweb parser by @​bmalum in philss/floki#707
• Update hex packages by @​philss in philss/floki#708
• Release v0.38.5 by @​philss in philss/floki#709

New Contributors

• @​bmalum made their first contribution in philss/floki#707

Full Changelog: philss/floki@v0.38.4...v0.38.5

Changelog

Sourced from floki's changelog.

[0.38.5] - 2026-10-29

Fixed

• Fix quadratic-time parsing of unbalanced tags in the built-in "mochiweb" parser. For every end tag the parser scanned the entire stack of open elements, so malformed input with a deep stack of never-closed tags followed by many non-matching end tags took O(open_depth x end_tags) time. The parser now tracks the names of open elements and rejects a non-matching end tag without scanning the stack, making parsing linear again. The resulting parse tree is unchanged.

• Optimize functional selector matching. Instead of generating an+b values until one matches, solve the formula directly with bounds and a remainder check. This turns each match from a stream scan into O(1) arithmetic.

Commits

• 7786ce9 Release v0.38.5 (#709)
• 8dd8340 Update hex packages (#708)
• e29b544 Fix quadratic-time parsing of unbalanced tags in mochiweb parser (#707)
• 22fa6f4 Optimize functional selector matching (#705)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)