[dependabot]

Bumps enshrined/svg-sanitize from 1.0.0 to 1.1.1.

Release notes

Sourced from enshrined/svg-sanitize's releases.

1.1.1

This release fixes a bug that was new in 1.1.0. Everyone using 1.1.0 should upgrade.

It fixes this advisory:

• GHSA-f7cw-vfxq-7ph2: sanitize() could throw on input that ends inside an unclosed tag.

Fixed

• sanitize() no longer throws a ValueError on PHP 8, or raises a warning on PHP 7, when the input ends inside a tag that is never closed. A single < or a truncated upload was enough. It now returns false, as 1.0.0 did. This bug was new in 1.1.0.
• The checks that run before parsing now fail closed too. If one of them ever throws, sanitize() returns false and reports the error in getXmlIssues().

Full changelog: darylldoyle/svg-sanitizer@1.1.0...1.1.1

1.1.0

This is a security release. Everyone using 1.0.0 or earlier should upgrade. The public API has not changed, but some input is now cleaned differently. See "Changed" below before you upgrade.

It fixes these advisories:

• GHSA-q546-85r6-f39q: in Safari, SMIL animations could change a link's href after sanitizing.
• GHSA-3vh3-jf65-656w: remote references could get past removeRemoteReferences(true).
• GHSA-vjg7-f2wj-gqqh: the 1.0.0 DOCTYPE stripping could be avoided, which brought back the DTD-entity XSS.
• GHSA-94x8-pw3c-6qcq: CSS handling under removeRemoteReferences(true) could be slow, and could throw.
• GHSA-hrwm-vcc9-hcm4: the <use> reference graph could take exponential time, and its limits could be avoided.
• GHSA-cgcm-4g72-hfgw: sanitize() could throw instead of returning false.
• GHSA-2v7c-jx29-jprp: stripping PHP tags took quadratic time.

Security

... (truncated)

Changelog

Sourced from enshrined/svg-sanitize's changelog.

[1.1.1] - 2026-10-20

This release fixes a bug that was new in 1.1.0. Everyone using 1.1.0 should upgrade.

It fixes this advisory:

• GHSA-f7cw-vfxq-7ph2: sanitize() could throw on input that ends inside an unclosed tag.

Fixed

• sanitize() no longer throws a ValueError on PHP 8, or raises a warning on PHP 7, when the input ends inside a tag that is never closed. A single < or a truncated upload was enough. It now returns false, as 1.0.0 did. This bug was new in 1.1.0.
• The checks that run before parsing now fail closed too. If one of them ever throws, sanitize() returns false and reports the error in getXmlIssues().

[1.1.0] - 2026-10-19

This is a security release. Everyone using 1.0.0 or earlier should upgrade. The public API has not changed, but some input is now cleaned differently. See "Changed" below before you upgrade.

It fixes these advisories:

• GHSA-q546-85r6-f39q: in Safari, SMIL animations could change a link's href after sanitizing.
• GHSA-3vh3-jf65-656w: remote references could get past removeRemoteReferences(true).
• GHSA-vjg7-f2wj-gqqh: the 1.0.0 DOCTYPE stripping could be avoided, which brought back the DTD-entity XSS.
• GHSA-94x8-pw3c-6qcq: CSS handling under removeRemoteReferences(true) could be slow, and could throw.
• GHSA-hrwm-vcc9-hcm4: the <use> reference graph could take exponential time, and its limits could be avoided.
• GHSA-cgcm-4g72-hfgw: sanitize() could throw instead of returning false.
• GHSA-2v7c-jx29-jprp: stripping PHP tags took quadratic time.

Security

• Animation elements such as <animateTransform> can no longer change a link's href after sanitizing. Any attributeName that targets an href is removed.

... (truncated)

Commits

• 1976ff9 Merge commit from fork
• 840b6c9 Release 1.1.1 in the changelog
• cbd2a12 Run the checks before parsing inside sanitize()'s try block
• 5292b84 Fix sanitize() throwing on input that ends inside a tag
• 9ba9001 Merge commit from fork
• 7889f57 Release 1.1.0 in the changelog
• 6d83781 Scale timing limits to the machine and run CI without Xdebug
• 00944d2 Remove nodes in linear time on PHP before 8.1
• 6df099c Run the test matrix with PCRE JIT both on and off
• f913e7e Add a security policy
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[pirate-bot]

Plugin build for fa88c46 is ready 🛎️!

• Download build
• Download dev