3.7.1

• GHSA-q7wv-vg5w-462j Fixed a stored XSS vulnerability: URI schemes from delta attributes (link, image, video) are now validated against an allowlist before being written into rendered href/src attributes. Values with unsafe schemes (like javascript:) are neutralized: links point to #, images and videos are not rendered. If you relied on rendering custom URI schemes (e.g. ftp://), add them to the $safeSchemes property of the corresponding listener:

$link = new Link();
$link->safeSchemes = ['http', 'https', 'mailto', 'tel', 'ftp'];

$lexer->overwriteListener(new Link(), $link);

What's Changed

• Backport URI scheme validation security fix to 3.5.1 by @nadar in #106
• Migrate changelog to GitHub releases and update version references by @nadar in #107
• Bump symfony/process from 5.4.47 to 5.4.51 by @dependabot[bot] in #103
• Bump phpunit/phpunit from 8.5.50 to 8.5.52 by @dependabot[bot] in #102

Full Changelog: 3.7.0...3.7.1