Prepare 4.0.0 release

[djc]

Since html5ever appears in the public API, this needs a semver-incompatible version bump.

[notriddle]

Since html5ever appears in the public API

It’s not supposed to. Which function does that?

[djc]

Ah, sorry -- I misread, was looking at the SanitizationTokenizer's TokenSink impl but that is a private type.

So this can just be 3.4.0 I guess?

[notriddle]

Preferably, yes. We want people to immediately update to the newest ammonia as soon as we release it, so we need to have a more stable API than html5ever has.

[djc]

Don't get me wrong, I'm a fan! I've just seen that many maintainers aren't quite so careful about hiding private dependencies.

But, what about the notice in the changelog that says "breaking change" (change lifetimes on UrlRelative)? That's from 32e12a0 (which doesn't seem to carry an affiliation with any PR).

[notriddle]

You're right. I had forgotten about that.

It's going to be 4.0 after all, then.