Remove the temporary CI-only Twig pin and svg-sanitize alias

Problem/Motivation

.gitlab-ci.yml still runs composer require "twig/twig:<3.30" --no-update. It was a temporary CI fix (#3625759, #3625607): Twig 3.30.0 made every page render a fatal TypeError in Drupal core.

Core fixed that in #3625969: Twig's 3.30 TypeError: Twig\Runtime\EscaperRuntime::escape(): Argument #4 ($autoescape) must be of type bool, null given, released in 11.4.8, 11.3.18 and 10.6.18, so every supported core line has it. The pin is no longer needed.

.gitlab-ci.yml still runs composer require "enshrined/svg-sanitize:1.0.0 as 0.22.1" --no-update. It was added on 8 October 2026 because drupal/svg_image 3.x capped svg-sanitize below 1.0, while that day's advisories blocked every 0.x release.

drupal/svg_image 3.2.5 now requires enshrined/svg-sanitize ^1.0, so the alias is no longer needed. It now holds svg_image back at 3.2.4, since the aliased 1.0.0 reports itself as 0.22.1.

Steps to reproduce

Checked on 10 October 2026: a fresh Drupal CMS build of Varbase Starter on core 11.4.8 with twig/twig 3.30.0, no pin and no alias resolves svg-sanitize 1.0.0 with svg_image 3.2.5, installs with drush and renders the public and admin pages (200, no logged errors).

Proposed resolution

Remove the Twig pin and the svg-sanitize alias from .gitlab-ci.yml, with one MR per branch:

• 1.0.x

Until vardot/drupal-core-patches drops the #3465033 patch for core 11.4.9 (being released now), pipelines that resolve core 11.4.9 fail at patching. That is unrelated to this change.

Remaining tasks

• ✅ File an issue
• ❌ Addition/Change/Update/Fix
• ❌ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Update Release Notes
• ❌ Release

User interface changes

• N/A

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• N/A

AI-Generated: Yes