docs: add 2.57 upgrade note for bleach → nh3 migration

Author: valentijnscholten

docs/content/en/open_source/upgrading/2.57.md

@@ -2,6 +2,13 @@
 title: 'Upgrading to DefectDojo Version 2.57.x'
 toc_hide: true
 weight: -20260302
-description: No special instructions.
+description: HTML sanitization library replaced (bleach → nh3).
 ---
-There are no special instructions for upgrading to 2.57.x. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.57.0) for the contents of the release.
+Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.57.0) for the contents of the release.
+
+## HTML sanitization: bleach replaced by nh3
+
+The `bleach` library has been replaced by [`nh3`](https://nh3.readthedocs.io/) for HTML sanitization. This is a drop-in replacement in most cases, but there are two minor behavioral changes to be aware of:
+
+- **`style` attributes are no longer allowed.** `bleach` supported CSS property-level filtering (e.g. allowing only `color` or `font-weight`). `nh3` has no equivalent, so `style` attributes are stripped entirely to avoid allowing arbitrary CSS injection. Content that previously relied on inline styles (e.g. colored text in the login banner, background-color on markdown images) will lose that styling.
+- **Disallowed tags are stripped rather than escaped.** Previously, a tag like `<script>` would be rendered as the literal text `&lt;script&gt;`. Now the tag is removed entirely and only its text content is kept. This is the correct behavior for a sanitizer.