NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
Packagist · #243 most downloaded on Packagist
Provides an object-oriented API to sanitize untrusted HTML input for safe insertion into a document's DOM.
Last release 9 days ago
28 Sep 2026
Release timing varies
gaps range from 8 days to 4 months
Some releases are documented
notes for 16 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
5 years old
97 releases · first in 2022
bug #66394 Don't render comments as elements when the default action is Allow ( @nicolas-grekas )
Changelog (v8.1.7...v8.1.8)
Allow (@nicolas-grekas)sanitizeFor() with table-related, image and plaintext contexts (@nicolas-grekas)bug #65843 Drop relative URLs whose first path segment contains a colon instead of throwing ( @nicolas-grekas )
Changelog (v8.1.6...v8.1.7)
One column per quarter.
bug #65702 Compare schemes and hosts case-insensitively ( @nicolas-grekas )
Changelog (v8.1.1...v8.1.6)
minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 ( @nicolas-grekas )
Changelog (v8.1.0...v8.1.1)
Changelog ( v8.1.0-RC1...v8.1.0 )
Changelog (v8.1.0-RC1...v8.1.0)
security # cve-2026-48761 Sanitize URL attributes on , , <iframe>, , and the URL inside content ( @nicolas-grekas ) security # cve-2026-48760 Reject p…
Changelog (v8.1.0-BETA3...v8.1.0-RC1)
security # cve-2026-45753 Sanitize URLs in action, formaction, poster and cite attributes ( @nicolas-grekas )
Changelog (v8.1.0-BETA1...v8.1.0-BETA3)
allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification (@alexandre-daubois)Nothing published for this version
Changelog ( v8.0.13...v8.0.14 )
Changelog (v8.0.13...v8.0.14)
security # cve-2026-48761 Sanitize URL attributes on , , <iframe>, , and the URL inside content ( @nicolas-grekas ) security # cve-2026-48760 Reject p…
Changelog (v8.0.12...v8.0.13)
security # cve-2026-45753 Sanitize URLs in action, formaction, poster and cite attributes ( @nicolas-grekas )
Changelog (v8.0.7...v8.0.12)
allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification (@alexandre-daubois)Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Changelog ( v7.4.19...v7.4.20 )
Changelog (v7.4.19...v7.4.20)
Allow (@nicolas-grekas)sanitizeFor() with table-related, image and plaintext contexts (@nicolas-grekas)Changelog ( v7.4.18...v7.4.19 )
Changelog (v7.4.18...v7.4.19)
Changelog ( v7.4.14...v7.4.18 )
Changelog (v7.4.14...v7.4.18)
Changelog ( v7.4.13...v7.4.14 )
Changelog (v7.4.13...v7.4.14)
security # cve-2026-48761 Sanitize URL attributes on , , <iframe>, , and the URL inside content ( @nicolas-grekas ) security # cve-2026-48760 Reject p…
Changelog (v7.4.12...v7.4.13)
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Changelog ( v6.4.45...v6.4.46 )
Changelog (v6.4.45...v6.4.46)
Changelog ( v6.4.41...v6.4.45 )
Changelog (v6.4.41...v6.4.45)
Your coding agent can read these notes before it upgrades. Set up the MCP server →