Remove the temporary CI-only svg-sanitize alias

Problem/Motivation

.gitlab-ci.yml still runs composer require "enshrined/svg-sanitize:1.0.0 as 0.22.1" --no-update. It was added on 8 October 2026 because drupal/svg_image 3.x capped svg-sanitize below 1.0, while that day's advisories blocked every 0.x release.

drupal/svg_image 3.2.5 now requires enshrined/svg-sanitize ^1.0, so the alias is no longer needed. It now holds svg_image back at 3.2.4, since the aliased 1.0.0 reports itself as 0.22.1.

Steps to reproduce

Checked on 10 October 2026: a fresh Drupal CMS build of Varbase Starter without the alias resolves svg-sanitize 1.0.0 with svg_image 3.2.5, installs with drush and renders the public and admin pages (200, no logged errors).

Proposed resolution

Remove the alias from .gitlab-ci.yml, with one MR per branch:

• 1.0.x

Until vardot/drupal-core-patches drops the #3465033 patch for core 11.4.9 (being released now), pipelines that resolve core 11.4.9 fail at patching. That is unrelated to this change.

Remaining tasks

• ✅ File an issue
• ❌ Addition/Change/Update/Fix
• ❌ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Update Release Notes
• ❌ Release

User interface changes

• N/A

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• N/A

AI-Generated: Yes