diff --git a/README.md b/README.md
index 17375e1..ef80e03 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@ whatwg-url is a full implementation of the WHATWG [URL Standard](https://url.spe
 
 ## Specification conformance
 
-whatwg-url is currently up to date with the URL spec up to commit [e5b1dd7](https://github.com/whatwg/url/commit/e5b1dd76df13183b7f123d15880dbdc6a2f37c71).
+whatwg-url is currently up to date with the URL spec up to commit [302ba41](https://github.com/whatwg/url/commit/302ba419cb3248568243aaf7b5aca9003694d5c3).
 
 For `file:` URLs, whose [origin is left unspecified](https://url.spec.whatwg.org/#concept-url-origin), whatwg-url chooses to use a new opaque origin (which serializes to `"null"`).
 
diff --git a/scripts/get-latest-platform-tests.js b/scripts/get-latest-platform-tests.js
index 23e49ed..101bc9e 100644
--- a/scripts/get-latest-platform-tests.js
+++ b/scripts/get-latest-platform-tests.js
@@ -23,7 +23,7 @@ process.on("unhandledRejection", err => {
 // 1. Go to https://github.com/w3c/web-platform-tests/tree/master/url
 // 2. Press "y" on your keyboard to get a permalink
 // 3. Copy the commit hash
-const commitHash = "c390f441840c65b55f014a34ef0459853709286b";
+const commitHash = "9ffe8f26432649d02eb81add2816dd5394f57a8c";
 
 const urlPrefix = `https://raw.githubusercontent.com/web-platform-tests/wpt/${commitHash}/url/`;
 const targetDir = path.resolve(__dirname, "..", "test", "web-platform-tests");
diff --git a/src/url-state-machine.js b/src/url-state-machine.js
index 597095d..8547cc3 100644
--- a/src/url-state-machine.js
+++ b/src/url-state-machine.js
@@ -51,11 +51,11 @@ function isNormalizedWindowsDriveLetterString(string) {
 }
 
 function containsForbiddenHostCodePoint(string) {
-  return string.search(/\u0000|\u0009|\u000A|\u000D|\u0020|#|%|\/|:|\?|@|\[|\\|\]/) !== -1;
+  return string.search(/\u0000|\u0009|\u000A|\u000D|\u0020|#|%|\/|:|<|>|\?|@|\[|\\|\]|\^/) !== -1;
 }
 
 function containsForbiddenHostCodePointExcludingPercent(string) {
-  return string.search(/\u0000|\u0009|\u000A|\u000D|\u0020|#|\/|:|\?|@|\[|\\|\]/) !== -1;
+  return string.search(/\u0000|\u0009|\u000A|\u000D|\u0020|#|\/|:|<|>|\?|@|\[|\\|\]|\^/) !== -1;
 }
 
 function isSpecialScheme(scheme) {