HTML Purifier 4.0 released

Posted 7:46 PM EDT on Wednesday, July 8, 2009

HTML Purifier 4.0 is a major feature release focused on configuration It deprecates the $config->set('Ns', 'Directive', $value) syntax for $config->set('Ns.Directive', $value); both syntaxes work but the former will throw errors. There are also some new features: robust support for name/id, configuration inheritance, remove nbsp in the RemoveEmpty autoformatter, userland configuration directives and configuration serialization.

You can find full information on how to perform the migration at dev-config-bcbreaks.txt, although the transforms are very simple and the error messages should tell you what you need to do.

Having not performed an HTML Purifier release in so long, I have unfortunately forgotten the passphrase on my original private key. Furthermore, you may have noticed that commit messages are now showing up as instead of While not intentional, this is a good time to switch my GnuPG signing key. The new key you should verify against is 0x1E1C674B. Those of you who are paranoid should directly use the Git repository, which is tagged with the correct key (yes, muscle memory worked once, and then fled from me), although all future releases will be tagged with the new key. The key is also locally stored on

See NEWS for a complete changelog.

Update: I have remembered my password, and have resigned all of the releases with the old key. I still plan on going forward with the transition to the new GnuPG signing key (as it has a much larger key size and should be resilient in the face of nascent attacks against SHA-1). Check the download page for more information.