XMF 1.3.2

Security

This release fixes two issues in Xmf\FilterInput. All users should upgrade.
1.2.x users: the same fixes are in 1.2.32.1.

• Request filtering no longer loops forever on certain input (GHSA-8j4x-8r8r-5jgw).
  A value containing <> followed by more text made remove() grow the string on every
  pass until PHP ran out of memory. Filtering now always finishes, with a hard cap of
  10 passes that returns an empty string if the cap is hit.
• Tighter tag and attribute filtering (GHSA-pf53-59r5-mhjv).
  • Tag and attribute name checks are anchored with \z, so a name ending in a newline
    no longer passes the check while missing the blacklist.
  • Attribute names must start with a letter.
  • on* event handlers are matched case-insensitively.
  • javascript:-style schemes are checked with HTML entities decoded and whitespace
    removed, the way a browser reads them.
  • Stripped text no longer keeps a < that could start a tag.

Maintenance

• Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #175
• Bump JetBrains/qodana-action from 2026.1.3 to 2026.2.0 by @dependabot[bot] in #176
• Update squizlabs/php_codesniffer requirement from ^3.11 to ^3.11 || ^4.0 by @dependabot[bot] in #177
• Bump JetBrains/qodana-action from 2026.2.0 to 2026.2.1 by @dependabot[bot] in #178
• fix(StopWords): correct $stopwordList type (unbreaks CI) by @mambax7 in #182
• Bump SonarSource/sonarqube-scan-action from 8.2.1 to 8.2.2 by @dependabot[bot] in #180
• Bump codecov/codecov-action from 7.0.0 to 7.1.1 by @dependabot[bot] in #181
• security(ci): declare least-privilege workflow permissions by @mambax7 in #183
• Bump JetBrains/qodana-action from 2026.2.1 to 2026.2.2 by @dependabot[bot] in #184
• Bump SonarSource/sonarqube-scan-action from 8.2.2 to 8.3.0 by @dependabot[bot] in #185
• chore(ci): correct stale version comments on pinned actions by @mambax7 in #186

Full Changelog: v1.3.1...v1.3.2