fix: #3631526 Require svg-sanitize ^1.0, 0.22.0 has advisories

Rajab Natshahrequested to merge
issue/ai_media-3631526:3631526-svg-sanitize-1x into 1.0.x

Follow-up for #3631526. Issue: https://www.drupal.org/project/ai_media/issues/3631526

enshrined/svg-sanitize 0.22.0 is itself affected by three advisories (<=0.22.0, one a stored XSS in the sanitizer), and there is no later 0.x. So ^0.22 admits only a vulnerable release. Composer's advisory block hides it by default, not when blocking is off. Now ^1.0.

Tested on a fresh Drupal 11.4.10, PHP 8.4: resolves to 1.0.0, composer audit clean, the SVG cleaner still strips onload, <script> and a remote href.

AI-Generated: Yes

Checkpoints:

  • File an issue
  • Addition/Change/Update/Fix
  • Testing to ensure no regression
  • Automated unit testing coverage
  • Automated functional testing coverage
  • UX/UI designer responsibilities
  • Readability
  • Accessibility
  • Performance
  • Security
  • Developer Documentation
  • User Guide Documentation
  • Reviewed by human
  • Code review by maintainers
  • Full testing and approval
  • Credit contributors
  • Review with the product owner
  • Release notes snippet
  • Release

🤖 Generated with Claude Code

Edited by Rajab Natshah

Merge request reports