From a27f34244ca66e2922bcef8057fbcf88fe5a0d14 Mon Sep 17 00:00:00 2001 From: Bob van de Vijver Date: Fri, 9 Oct 2026 11:55:01 +0200 Subject: [PATCH 1/2] fix(security): Bump enshrined/svg-sanitize to ^1.0 This is required to resolve CVE-2026-107380 --- composer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/composer.json b/composer.json index fab72f08c..f10c70d7d 100644 --- a/composer.json +++ b/composer.json @@ -26,7 +26,7 @@ "doctrine/orm": "^3.5", "drupol/composer-packages": "^2.0", "embed/embed": "^4.4", - "enshrined/svg-sanitize": "^0.22.0", + "enshrined/svg-sanitize": "^1.0", "erusev/parsedown": "^1.8", "erusev/parsedown-extra": "^0.9", "fakerphp/faker": "^1.16", From 67fa85f34b5f8f5f596b5115081ad918d6fbf947 Mon Sep 17 00:00:00 2001 From: Bob van de Vijver Date: Fri, 9 Oct 2026 11:57:21 +0200 Subject: [PATCH 2/2] Add 6.1.9 release notes --- CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1d98c8eaa..68c493b23 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,12 @@ Changelog ========= +## 6.1.9 + +Released: 2026-10-09 + +This release includes security-related fixes (dependencies only). + ## 6.1.8 Released: 2026-09-09