diff --git a/src/main/webapp/js/app.min.js b/src/main/webapp/js/app.min.js
diff --git a/src/main/webapp/js/diagramly/EditorUi.js b/src/main/webapp/js/diagramly/EditorUi.js
@@ -12237,7 +12237,7 @@
 					}
 					else if (data.action == 'layout')
 					{
-						this.executeLayoutList(data.layouts)
+						this.executeLayouts(this.editor.graph.createLayouts(data.layouts));
 
 						return;
 					}
@@ -13223,35 +13223,6 @@
 		this.showDialog(this.importCsvDialog.container, 640, 520, true, true, null, null, null, null, true);
 		this.importCsvDialog.init();
 	};
-
-
-	/**
-	 * Runs the layout from the given JavaScript array which is of the form [{layout: name, config: obj}, ...]
-	 * where name is the layout constructor name and config contains the properties of the layout instance.
-	 */
-	EditorUi.prototype.executeLayoutList = function(layoutList, done)
-	{
-		var graph = this.editor.graph;
-		var cells = graph.getSelectionCells();
-
-		for (var i = 0; i < layoutList.length; i++)
-		{
-			var layout = new window[layoutList[i].layout](graph);
-
-			if (layoutList[i].config != null)
-			{
-				for (var key in layoutList[i].config)
-				{
-					layout[key] = layoutList[i].config[key];
-				}
-			}
-
-			this.executeLayout(function()
-			{
-				layout.execute(graph.getDefaultParent(), cells.length == 0 ? null : cells);
-			}, i == layoutList.length - 1, done);
-		}
-	};
 
 	/**
 	 *
@@ -13862,11 +13833,13 @@
 			    			// Required for layouts to work with new cells
 							var temp = afterInsert;
 			    			graph.view.validate();
-							this.executeLayoutList(JSON.parse(layout), function()
+
+							this.executeLayouts(graph.createLayouts(JSON.parse(layout)), function()
 							{
 								postProcess();
 								temp();
 							});
+
 							afterInsert = null;
 						}
 						else if (layout == 'circle')

diff --git a/src/main/webapp/js/diagramly/ElectronApp.js b/src/main/webapp/js/diagramly/ElectronApp.js
@@ -668,6 +668,19 @@ mxStencilRegistry.allowEval = false;
 
 				var extPluginsBtn = mxUtils.button(mxResources.get('selectFile') + '...', async function()
 				{
+					var warningMsgs = mxResources.get('pluginWarning').split('\\n');
+					var warningMsg = warningMsgs.pop(); //Last line in the message
+
+					if (!warningMsg) 
+					{
+						warningMsg = warningMsgs.pop();
+					}
+
+					if (!confirm(warningMsg)) 
+					{
+						return;
+					}
+
 					var lastDir = localStorage.getItem('.lastPluginDir');
 
 					var paths = await requestSync({

diff --git a/src/main/webapp/js/diagramly/Menus.js b/src/main/webapp/js/diagramly/Menus.js
@@ -1329,18 +1329,14 @@
 				{
 					try
 					{
-						var layoutList = JSON.parse(newValue);
-						editorUi.executeLayoutList(layoutList)
-						editorUi.customLayoutConfig = layoutList;
+						var list = JSON.parse(newValue);
+						editorUi.executeLayouts(graph.createLayouts(list));
+						editorUi.customLayoutConfig = list;
+						editorUi.hideDialog();
 					}
 					catch (e)
 					{
 						editorUi.handleError(e);
-
-						if (window.console != null)
-						{
-							console.error(e);
-						}
 					}
 				}
 			}, null, null, null, null, null, true, null, null,
@@ -1514,21 +1510,24 @@
 
 				editorUi.showDialog(dlg.container, 355, 140, true, true);
 			}, parent, null, isGraphEnabled());
-						
+
 			menu.addSeparator(parent);
-
+			
 			menu.addItem(mxResources.get('parallels'), null, mxUtils.bind(this, function()
 			{
-				// Keeps parallel edges apart
 				var layout = new mxParallelEdgeLayout(graph);
 				layout.checkOverlap = true;
-				layout.spacing = 20;
+
+				editorUi.prompt(mxResources.get('spacing'), layout.spacing, mxUtils.bind(this, function(newValue)
+				{
+					layout.spacing = newValue;
 
-	    		editorUi.executeLayout(function()
-	    		{
-	    			layout.execute(graph.getDefaultParent(), (!graph.isSelectionEmpty()) ?
-	    				graph.getSelectionCells() : null);
-	    		}, false);
+					editorUi.executeLayout(function()
+					{
+						layout.execute(graph.getDefaultParent(), (!graph.isSelectionEmpty()) ?
+							graph.getSelectionCells() : null);
+					}, false);
+				}));
 			}), parent);
 
 			menu.addSeparator(parent);

diff --git a/src/main/webapp/js/diagramly/Minimal.js b/src/main/webapp/js/diagramly/Minimal.js
@@ -1587,8 +1587,8 @@ EditorUi.initMinimalTheme = function()
 					}
 
 					ui.menus.addMenuItems(menu, ['insertImage', 'insertLink', '-'], parent);
-					ui.menus.addSubmenu('insertLayout', menu, parent, mxResources.get('layout'));
 					ui.menus.addSubmenu('insertAdvanced', menu, parent, mxResources.get('advanced'));
+					ui.menus.addSubmenu('layout', menu, parent);
 				}
 				else
 				{

diff --git a/src/main/webapp/js/grapheditor/EditorUi.js b/src/main/webapp/js/grapheditor/EditorUi.js
@@ -4576,6 +4576,23 @@ EditorUi.prototype.addSplitHandler = function(elt, horizontal, dx, onChange)
 	});	
 };
 
+/**
+ * Translates this point by the given vector.
+ * 
+ * @param {number} dx X-coordinate of the translation.
+ * @param {number} dy Y-coordinate of the translation.
+ */
+EditorUi.prototype.prompt = function(title, defaultValue, fn)
+{
+	var dlg = new FilenameDialog(this, defaultValue, mxResources.get('apply'), function(newValue)
+	{
+		fn(parseFloat(newValue));
+	}, title);
+
+	this.showDialog(dlg.container, 300, 80, true, true);
+	dlg.init();
+};
+
 /**
  * Translates this point by the given vector.
  * 
@@ -5176,6 +5193,22 @@ EditorUi.prototype.save = function(name)
 	}
 };
 
+/**
+ * Executes the given array of graph layouts using executeLayout and
+ * calls done after the last layout has finished.
+ */
+EditorUi.prototype.executeLayouts = function(layouts, post)
+{
+	this.executeLayout(mxUtils.bind(this, function()
+	{
+		var layout = new mxCompositeLayout(this.editor.graph, layouts);
+		var cells = this.editor.graph.getSelectionCells();
+
+		layout.execute(this.editor.graph.getDefaultParent(),
+			cells.length == 0 ? null : cells);
+	}), true, post);
+};
+
 /**
  * Executes the given layout.
  */

diff --git a/src/main/webapp/js/grapheditor/Graph.js b/src/main/webapp/js/grapheditor/Graph.js
@@ -1345,6 +1345,14 @@ Graph.pasteStyles = ['rounded', 'shadow', 'dashed', 'dashPattern', 'fontFamily',
 					'arcSize', 'comic', 'sketch', 'fillWeight', 'hachureGap', 'hachureAngle', 'jiggle', 'disableMultiStroke',
 					'disableMultiStrokeFill', 'fillStyle', 'curveFitting', 'simplification', 'comicStyle'];
 
+/**
+ * Whitelist for known layout names.
+ */
+Graph.layoutNames = ['mxHierarchicalLayout', 'mxCircleLayout',
+	'mxCompactTreeLayout', 'mxEdgeLabelLayout', 'mxFastOrganicLayout',
+	'mxParallelEdgeLayout', 'mxPartitionLayout', 'mxRadialTreeLayout',
+	'mxStackLayout'];
+
 /**
  * Creates a temporary graph instance for rendering off-screen content.
  */
@@ -1753,7 +1761,8 @@ Graph.sanitizeNode = function(value)
 // Allows use tag in SVG with local references only
 DOMPurify.addHook('afterSanitizeAttributes', function(node)
 {
-	if (node.hasAttribute('xlink:href') && !node.getAttribute('xlink:href').match(/^#/))
+	if (node.nodeName == 'use' && node.hasAttribute('xlink:href') &&
+		!node.getAttribute('xlink:href').match(/^#/))
 	{
 		node.remove();
 	} 
@@ -1793,10 +1802,7 @@ Graph.clipSvgDataUri = function(dataUri, ignorePreserveAspect)
 			if (idx >= 0)
 			{
 				// Strips leading XML declaration and doctypes
-				div.innerHTML = data.substring(idx);
-
-				// Removes all attributes starting with on
-				Graph.sanitizeNode(div);
+				div.innerHTML = Graph.sanitizeHtml(data.substring(idx));
 
 				// Gets the size and removes from DOM
 				var svgs = div.getElementsByTagName('svg');
@@ -3201,12 +3207,61 @@ Graph.prototype.initLayoutManager = function()
 			{
 				return new TableLayout(this.graph);
 			}
+			else if (style['childLayout'] != null && style['childLayout'].charAt(0) == '[')
+			{
+				try
+				{
+					return new mxCompositeLayout(this.graph,
+						this.graph.createLayouts(JSON.parse(
+							style['childLayout'])));
+				}
+				catch (e)
+				{
+					if (window.console != null)
+					{
+						console.error(e);
+					}
+				}
+			}
 		}
 
 		return null;
 	};
 };
 
+/**
+ * Creates an array of graph layouts from the given array of the form [{layout: name, config: obj}, ...]
+ * where name is the layout constructor name and config contains the properties of the layout instance.
+ */
+Graph.prototype.createLayouts = function(list)
+{
+	var layouts = [];
+
+	for (var i = 0; i < list.length; i++)
+	{
+		if (mxUtils.indexOf(Graph.layoutNames, list[i].layout) >= 0)
+		{
+			var layout = new window[list[i].layout](this);
+
+			if (list[i].config != null)
+			{
+				for (var key in list[i].config)
+				{
+					layout[key] = list[i].config[key];
+				}
+			}
+
+			layouts.push(layout);
+		}
+		else
+		{
+			throw Error(mxResources.get('invalidCallFnNotFound', [list[i].layout]));
+		}
+	}
+
+	return layouts;
+};
+
 /**
  * Returns the metadata of the given cells as a JSON object.
  */

diff --git a/src/main/webapp/js/grapheditor/Init.js b/src/main/webapp/js/grapheditor/Init.js
@@ -9,7 +9,7 @@ window.urlParams = window.urlParams || {};
 // Public global variables
 window.DOM_PURIFY_CONFIG = window.DOM_PURIFY_CONFIG ||
     {ADD_TAGS: ['use'], ADD_ATTR: ['target'], FORBID_TAGS: ['form'],
-    ALLOWED_URI_REGEXP: /^(?:(?:https?|mailto|tel|callto|data):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i};
+    ALLOWED_URI_REGEXP: /^((?!javascript:).)*$/i};
 window.MAX_REQUEST_SIZE = window.MAX_REQUEST_SIZE  || 10485760;
 window.MAX_AREA = window.MAX_AREA || 15000 * 15000;
 

diff --git a/src/main/webapp/js/grapheditor/Menus.js b/src/main/webapp/js/grapheditor/Menus.js
@@ -311,12 +311,7 @@ Menus.prototype.init = function()
 	{
 		var promptSpacing = mxUtils.bind(this, function(defaultValue, fn)
 		{
-			var dlg = new FilenameDialog(this.editorUi, defaultValue, mxResources.get('apply'), function(newValue)
-			{
-				fn(parseFloat(newValue));
-			}, mxResources.get('spacing'));
-			this.editorUi.showDialog(dlg.container, 300, 80, true, true);
-			dlg.init();
+			this.editorUi.prompt(mxResources.get('spacing'), defaultValue, fn);
 		});
 
 		var runTreeLayout = mxUtils.bind(this, function(layout)

diff --git a/src/main/webapp/js/integrate.min.js b/src/main/webapp/js/integrate.min.js
diff --git a/src/main/webapp/js/viewer-static.min.js b/src/main/webapp/js/viewer-static.min.js
diff --git a/src/main/webapp/js/viewer.min.js b/src/main/webapp/js/viewer.min.js
diff --git a/src/main/webapp/mxgraph/mxClient.js b/src/main/webapp/mxgraph/mxClient.js
diff --git a/src/main/webapp/service-worker.js b/src/main/webapp/service-worker.js
diff --git a/src/main/webapp/service-worker.js.map b/src/main/webapp/service-worker.js.map