[dependabot]

Bumps voku/anti-xss from 4.1.44 to 4.1.45.

Release notes

Sourced from voku/anti-xss's releases.

4.1.45

• security: fix an XSS-filter bypass where an evil tag followed by a tab, CR, LF or FF instead of a space (e.g. <style\t>, <svg\n>, <math\r>, <frameset\f>) was emitted unencoded. A raw <style> stayed open (its closing tag is encoded) and allowed CSS injection (@import, url() exfiltration) and swallowed the following page content. Upgrade recommended.
• add OSS Scanner configuration (.oss-scanner/, excluded from Composer dist via export-ignore) and document how to run the tests

Changelog

Sourced from voku/anti-xss's changelog.

4.1.45 (2026-10-09)

• security: fix an XSS-filter bypass where an evil tag followed by a tab, CR, LF or FF instead of a space (e.g. "<style\t>", "<svg\n>", "<math\r>", "<frameset\f>") was emitted unencoded; a raw "" stayed open (its closing tag is encoded) and allowed CSS injection (e.g. "@​import", "url()" exfiltration) and swallowed the following page content
• add OSS Scanner configuration (".oss-scanner/") and document how to run the tests

Commits

• 3f759da Merge pull request #216 from voku/fix/evil-tag-whitespace
• f728711 docs: changelog for 4.1.45
• bd41e08 fix: encode evil tags followed by tab/CR/LF/FF instead of a space
• 8607695 Merge pull request #215 from voku/oss-scanner-phpunit
• ec42349 chore: document how to run the tests for OSS Scanner
• 51f2087 Merge pull request #213 from voku/oss-scanner-config
• aed3f04 chore: add OSS Scanner Dockerfile and threat model (export-ignore'd)
• b3e769f Merge pull request #209 from voku/renovate/voku-agent-loop-0.x
• 38943ea ci: align agent-loop dogfood with 0.20 lifecycle
• 9728b8e Update dependency voku/agent-loop to ^0.20.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

[cakmoel]

Superseded by #151, which was generated from current main and includes this update (with the latest patched version). Closing to avoid downgrading medoo/php-cs-fixer/symfony packages that this stale branch predates.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.