Pull Request resolves # .

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

Fix security vulnerabilities reported by composer audit.

The update of the enshrined/svg-sanitize dependency from 0.22.0 to 1.1.1 is a major update.

Their change log mentions one potentially breaking change for version 1.0.0:

Potentially breaking: an SVG/XML document that references a custom DTD entity is now rejected — sanitize() returns false — instead of being cleaned. Because the DTD is stripped before parsing, the entity reference becomes undefined and libxml rejects the document (fail-safe). A PUBLIC DOCTYPE with no entity references (e.g. a typical Illustrator/Inkscape export) still sanitizes normally.

As we do not sanitize but only validate SVG files in the CMS core, this should not be a problem.

Besides that there are no breaking changes.

Testing Instructions

1. Run composer install and then composer audit and composer audit --no-dev.
2. Check that all CI actions are successful.

Actual result BEFORE applying this Pull Request

1. composer audit and composer audit --no-dev

Found 5 security vulnerability advisories affecting 3 packages:
+-------------------+----------------------------------------------------------------------------------+
| Package           | enshrined/svg-sanitize                                                           |
| Severity          | medium                                                                           |
| Advisory ID       | PKSA-8j6w-3kr7-s9xk                                                              |
| CVE               | CVE-2026-107380                                                                  |
| Title             | enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character        |
|                   | Reference Collision                                                              |
| URL               | https://github.com/advisories/GHSA-9rjx-3jch-6vjf                                |
| Affected versions | <=0.22.0                                                                         |
| Reported at       | 2026-10-08T19:41:15+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | enshrined/svg-sanitize                                                           |
| Severity          | medium                                                                           |
| Advisory ID       | PKSA-6j95-1jtb-x6wc                                                              |
| CVE               | CVE-2026-107381                                                                  |
| Title             | svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Reso |
|                   | lver::processReferences                                                          |
| URL               | https://github.com/advisories/GHSA-m9xh-6747-9r6f                                |
| Affected versions | <=0.22.0                                                                         |
| Reported at       | 2026-10-08T19:41:10+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | enshrined/svg-sanitize                                                           |
| Severity          | medium                                                                           |
| Advisory ID       | PKSA-cbx2-m9db-bmzd                                                              |
| CVE               | CVE-2026-107379                                                                  |
| Title             | enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash    |
| URL               | https://github.com/advisories/GHSA-v383-3rw5-q8rf                                |
| Affected versions | <=0.22.0                                                                         |
| Reported at       | 2026-10-08T19:41:05+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | symfony/yaml                                                                     |
| Severity          |                                                                                  |
| Advisory ID       | PKSA-xz3r-9gp4-4m1z                                                              |
| CVE               | CVE-2026-109413                                                                  |
| Title             | CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single      |
|                   | Document Crash the Process                                                       |
| URL               | https://symfony.com/cve-2026-109413                                              |
| Affected versions | >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2 |
|                   | .0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.54|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,< |
|                   | 6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.45|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3. |
|                   | 0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.18|>=8.0.0,<8.1.0|>=8.1.0,<8.1.6                   |
| Reported at       | 2026-08-30T08:00:00+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | web-auth/webauthn-lib                                                            |
| Severity          | medium                                                                           |
| Advisory ID       | PKSA-3mms-4n3p-ym65                                                              |
| CVE               | CVE-2024-39912                                                                   |
| Title             | The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames  |
| URL               | https://github.com/advisories/GHSA-875x-g8p7-5w27                                |
| Affected versions | >=4.5.0,<4.9.0                                                                   |
| Reported at       | 2024-07-15T16:37:49+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
Found 1 abandoned package:
+---------------------------+----------------------------------------------------------------------------------+
| Abandoned Package         | Suggested Replacement                                                            |
+---------------------------+----------------------------------------------------------------------------------+
| web-auth/metadata-service | web-auth/webauthn-lib                                                            |
+---------------------------+----------------------------------------------------------------------------------+

2. All CI actions are successful.

Expected result AFTER applying this Pull Request

1. composer audit and composer audit --no-dev

Found 1 security vulnerability advisory affecting 1 package:
+-------------------+----------------------------------------------------------------------------------+
| Package           | web-auth/webauthn-lib                                                            |
| Severity          | medium                                                                           |
| Advisory ID       | PKSA-3mms-4n3p-ym65                                                              |
| CVE               | CVE-2024-39912                                                                   |
| Title             | The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames  |
| URL               | https://github.com/advisories/GHSA-875x-g8p7-5w27                                |
| Affected versions | >=4.5.0,<4.9.0                                                                   |
| Reported at       | 2024-07-15T16:37:49+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
Found 1 abandoned package:
+---------------------------+----------------------------------------------------------------------------------+
| Abandoned Package         | Suggested Replacement                                                            |
+---------------------------+----------------------------------------------------------------------------------+
| web-auth/metadata-service | web-auth/webauthn-lib                                                            |
+---------------------------+----------------------------------------------------------------------------------+

2. All CI actions are successful.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed