From 37230f18b65ae4bcab7e735045128403fa702887 Mon Sep 17 00:00:00 2001
From: m-hume <github@monkeyr.com>
Date: Mon, 6 Jul 2026 11:49:23 +0100
Subject: [PATCH 1/3] Fix SplObjectStorage::contains() deprecation for PHP 8.5

---
 library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php b/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php
index 42d514447..253ca3e1c 100644
--- a/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php
+++ b/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php
@@ -85,7 +85,7 @@ public function handleElement(&$token)
      */
     public function handleEnd(&$token)
     {
-        if ($this->markForDeletion->contains($token)) {
+        if ($this->markForDeletion->offsetExists($token)) {
             $this->markForDeletion->detach($token);
             $token = false;
         }

From f2fe68e5309ff0df5d0ff7c737e5929f0874cc83 Mon Sep 17 00:00:00 2001
From: m-hume <github@monkeyr.com>
Date: Mon, 6 Jul 2026 11:54:17 +0100
Subject: [PATCH 2/3] Add NEWS changelog entry for v4.19.1

---
 NEWS | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/NEWS b/NEWS
index d69ca2ac3..c6f94bdfc 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,11 @@
+# [4.19.1](https://github.com/ezyang/htmlpurifier/compare/v4.19.0...v4.19.1) (2026-07-06)
+
+
+### Bug Fixes
+
+* fix SplObjectStorage::contains() deprecation for PHP 8.5, use offsetExists() instead
+
+
 # [4.19.0](https://github.com/ezyang/htmlpurifier/compare/v4.18.0...v4.19.0) (2025-10-17)
 
 

From 3304bbd2fde1744eb39a4decaf957c897730e465 Mon Sep 17 00:00:00 2001
From: m-hume <github@monkeyr.com>
Date: Mon, 6 Jul 2026 11:59:59 +0100
Subject: [PATCH 3/3] Fix all SplObjectStorage deprecations and null array
 offset for PHP 8.5

---
 NEWS                                                          | 3 ++-
 .../HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php    | 4 ++--
 library/HTMLPurifier/URISchemeRegistry.php                    | 1 +
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/NEWS b/NEWS
index c6f94bdfc..f1e7caaf7 100644
--- a/NEWS
+++ b/NEWS
@@ -3,7 +3,8 @@
 
 ### Bug Fixes
 
-* fix SplObjectStorage::contains() deprecation for PHP 8.5, use offsetExists() instead
+* fix SplObjectStorage deprecated methods for PHP 8.5: attach()→offsetSet(), detach()→offsetUnset(), contains()→offsetExists()
+* fix null array offset deprecation in URISchemeRegistry for PHP 8.5
 
 
 # [4.19.0](https://github.com/ezyang/htmlpurifier/compare/v4.18.0...v4.19.0) (2025-10-17)
diff --git a/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php b/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php
index 253ca3e1c..425b28016 100644
--- a/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php
+++ b/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php
@@ -74,7 +74,7 @@ public function handleElement(&$token)
 
         if ($current instanceof HTMLPurifier_Token_End && $current->name === 'span') {
             // Mark closing span tag for deletion
-            $this->markForDeletion->attach($current);
+            $this->markForDeletion->offsetSet($current, null);
             // Delete open span tag
             $token = false;
         }
@@ -86,7 +86,7 @@ public function handleElement(&$token)
     public function handleEnd(&$token)
     {
         if ($this->markForDeletion->offsetExists($token)) {
-            $this->markForDeletion->detach($token);
+            $this->markForDeletion->offsetUnset($token);
             $token = false;
         }
     }
diff --git a/library/HTMLPurifier/URISchemeRegistry.php b/library/HTMLPurifier/URISchemeRegistry.php
index 4ac8a0b76..e0766ebe5 100644
--- a/library/HTMLPurifier/URISchemeRegistry.php
+++ b/library/HTMLPurifier/URISchemeRegistry.php
@@ -40,6 +40,7 @@ public static function instance($prototype = null)
      */
     public function getScheme($scheme, $config, $context)
     {
+        $scheme = (string) $scheme;
         if (!$config) {
             $config = HTMLPurifier_Config::createDefault();
         }