svg_image_field 2.3.8

This release upgrades the SVG sanitizer library to a version without known security advisories, adds a default image fallback for SVG image fields, and improves SVG validation in the Media Library. Run database updates after upgrading (see below).

Important: run database updates after upgrading

This release adds a new logger.channel.svg_image_field service (#3629891). After updating the code, run database updates (drush updb, drush deploy, or /update.php) so Drupal rebuilds its service container. Until you do, pages that display SVG image fields may fail with a ServiceNotFoundException.

Security: enshrined/svg-sanitize 1.x

The required version of enshrined/svg-sanitize changes from ~0.22 to ^1.0 (#3629549). The 0.x versions have known security advisories, which caused Composer to block updates to this module and to modules that depend on it.

Important: Update the module together with its dependencies so Composer can install the new library version:

composer update drupal/svg_image_field -W
# or more explicitly
composer require drupal/svg_image_field:^2.3.8 --with-all-dependencies

For developers: SvgImageFieldFormatter constructor change

SvgImageFieldFormatter now receives the logger.channel.svg_image_field service instead of logger.factory. This fixes a problem where serializing the formatter would also serialize its logger. Log messages are unchanged and still appear under the svg_image_field type.

If you extend SvgImageFieldFormatter and pass logger.factory to its constructor, your code keeps working but triggers a deprecation notice. Passing the factory is deprecated in 2.3.8 and support for it will be removed in 3.0.0, so update your create() method to pass $container->get('logger.channel.svg_image_field') instead.

Contributors (10)

acbramley, aleix, carsteng, jurgenhaas, jwilson3, mably, mandclu, oliveyrc, timohuisman, tonytheferg

Changelog

Issues: 6 issues resolved.

Changes since 2.3.7 (compare):

Bug

• #3567360 by jwilson3: Fix cspell issues (ignored words, yarn 4+ compat)
• #3590084 by jwilson3: Scope Media Library SVG validation to vector images only
• #2987590 by carsteng, oliveyrc, jwilson3: Support default image fallback for SVG image fields
• #3629891 by mandclu: Inject a named logger channel into SvgImageFieldFormatter instead of LoggerChannelFactory

Task

• #3629549 by acbramley, jurgenhaas, mably, timohuisman, aleix, tonytheferg, mandclu: Upgrade to enshrined/svg-sanitize ^1.0
• #3501882 by jwilson3: Validate SVG uploads in Media Library modal