bleach is deprecated upstream; consider nh3 for HTML sanitization #9974

Disclosure first: I'm the developer of Presend, a small tool that checks package installs. I noticed this while going through dependency manifests in AI-tooling repos.

pyproject.toml lists bleach as a dependency. Bleach's maintainers announced its deprecation in 2023, and PyPI now flags it as "Development Status :: 7 - Inactive" (latest 6.4.0). In Label Studio, bleach sits on the HTML sanitization path, which is exactly where an actively maintained library matters.

The usual replacement is nh3, the Python binding for the Rust ammonia sanitizer. It's maintained, fast, and covers the allowlist-based cleaning bleach is typically used for; the switch is usually local to a helper or two.

Question: is bleach still on a user-facing path (task data, labeling configs), or only in a few internal places? Happy to help with a PR if that's useful.