svg_image 3.2.5

Security update: svg_image now requires enshrined/svg-sanitize ^1.0, the library that sanitizes inline SVGs. Every 0.x release, up to and including 0.22.0, is covered by security advisories published on 8 October 2026 (a stored XSS through DTD entities and two denial-of-service issues), so Composer refuses to install them and composer require drupal/svg_image failed on a fresh site. Version 1.0.0 fixes them without changing the API svg_image uses.

Before updating: make sure nothing else in your project pins enshrined/svg-sanitize to 0.x, otherwise Composer cannot resolve the update.

This release also makes the responsive image formatter's $logger property protected, like the one in the standard SVG formatter, so subclasses can set it and it survives serialization.

Contributors (5)

andre.bonon, jurgenhaas, mably, mrshowerman, murrow

Changelog

Issues: 2 issues resolved.

Changes since 3.2.4 (compare):

Bug

• #3629505 enshrined/svg-sanitize >=0.15 <1.0 has security advisories

Task

• #3562651 Make logger in responsive image formatter protected