Update dependency bleach to v6.4.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
bleach	==6.3.0 → ==6.4.0

---

Release Notes

mozilla/bleach (bleach)

v6.4.0

Compare Source

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future
releases including for security issues.
See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

• Dropped support for pypy 3.10. (#​764)

Security fixes

• Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

  Fix XSS issue with sanitize_uri_value where disallowed schemes with
  Unicode invisible characters wouldn't be rejected.

  For example::

  import bleach
  payload1 = 'Click'
  result1 = bleach.clean(payload1)
  print(repr(result1))

  outputs::

  'Click'

  See the advisory for details.

• Fix GHSA-gj48-438w-jh9v.

  Fix issue where URI sanitization wasn't happening in formaction attributes.

  See the advisory for details.

Bug fixes

• Add support for pypy 3.11. (#​764)

• Drop version max in tinycss2 pin. (#​772)

  This removes one of the things we had to keep checking and updating. Users
  now own the responsibility for correctness with the version of tinycss2
  they're using.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.