Merge branch 'release/2.0.17'

Author: rhukster

CHANGELOG.md

@@ -1,3 +1,9 @@
+# v2.0.17
+## 08/07/2026
+
+1. [](#bugfix)
+    * [security] Updated the bundled DOM sanitizer to 1.0.13, which stops CSS comments from hiding dangerous values and covers image loading through `image-set()`, so untrusted SVG or HTML can no longer reference external resources those ways ([GHSA-ww22-4mqv-x5w3](https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-ww22-4mqv-x5w3)).
+
 # v2.0.16
 ## 08/07/2026
 

composer.json

@@ -47,7 +47,7 @@
         "composer/semver": "^3.4",
         "dragonmantank/cron-expression": "^3.3",
         "willdurand/negotiation": "^3.1",
-        "rhukster/dom-sanitizer": "^1.0",
+        "rhukster/dom-sanitizer": "^1.0.13",
         "tubalmartin/cssmin": "^4.1",
         "tedivm/jshrink": "^1.7",
         "donatj/phpuseragentparser": "~1.9",

composer.lock

@@ -9,7 +9,7 @@
 
 // Some standard defines
 define("GRAV", true);
-define("GRAV_VERSION", "2.0.16");
+define("GRAV_VERSION", "2.0.17");
 define("GRAV_SCHEMA", "1.8.0_2026-06-09_0");
 define("GRAV_TESTING", false);