chore(deps): bump voku/anti-xss from 4.1.42 to 4.1.44 in /recovery/common

[dependabot]

Bumps voku/anti-xss from 4.1.42 to 4.1.44.

Changelog

Sourced from voku/anti-xss's changelog.

4.1.44 (2026-07-10)

• add more modern DOM event handlers to the blacklist (e.g. "onAppInstalled", "onBeforeInstallPrompt", "onFormData", "onGamepadConnected/Disconnected", "onMessageError", "onScrollEnd", "onSecurityPolicyViolation", "onSlotChange", "onVRDisplay*", ...)
• harden detection of hyphen-/colon-suffixed event-handler lookalikes (e.g. "onmessageerror-foo") so the whole attribute is removed instead of leaving a broken attribute with leftover payload text
• fix regression: the lookalike-hardening above could also strip the value of unrelated, legitimate compound attributes that merely contain an event name after a hyphen (e.g. "data-onchange-debounce="300""); only real handler-lookalikes are removed now
• harden CSS "expression(...)" detection, incl. escaped and uppercase variants, and fix a regex backtracking risk
• add a hard cap on internal sanitization retry-loops (throws "RuntimeException" instead of looping forever if a loop can't converge)
• preserve custom / removed "_never_allowed_regex" entries across "setReplacement()" calls
• fix: several tag/attribute-stripping steps silently wiped the whole string to "" when "preg_replace()"/"preg_replace_callback()" hit "pcre.backtrack_limit" (or its fallback also failed); they now fail closed via a bounded, non-regex removal of the specific dangerous tag/attribute instead of discarding unrelated content or falling back to the still-dangerous raw input
• add regression test for issue #201 (template + slot "onslotchange" XSS)
• add mutation testing (Infection) to CI with a diff MSI gate

4.1.43 (2026-04-22)

• 10-50% better performance
• add "addNaughtyJavascriptPatterns()"
• add "setKeepPreAndCodeTagContent()" to preserve content inside "pre" and "code" tags
• fix regression when sanitizing text inside "pre" / "code" tags
• fix false-positives for valid "href" / "src" URLs and plain text such as "system (...)", "behavior:", "< abc" and "< 35kg"
• improve detection of obfuscated style / attribute payloads and JSON-escaped HTML attributes
• keep valid base64 payloads ending with "==" and avoid blank output if "preg_replace()" returns "null"
• update "portable-utf8" to "~6.1.0"
• improve CI / test compatibility (incl. PHP 8.5 + PHPUnit 12)

Commits

• fe2bbb7 [*]: update the changelog
• b5177ca Merge remote-tracking branch 'origin/master'
• e78c3fc [+]: Refactor tests to support old+new phpunit stuff :/
• ae5b3cc Merge pull request #199 from voku/renovate/actions-checkout-7.x
• 4cac3a0 Merge pull request #200 from voku/renovate/actions-cache-6.x
• 75c049c [+]: Enhance XSS protection by implementing fail-closed mechanisms for tag an...
• 6a4883b [*]: update the changelog
• 8f36bfe [+]: Fix regex for event handler sanitization and add regression test for hyp...
• 747f0ad Merge pull request #202 from voku/claude/xss-template-slot-vulnerability-cpw61y
• e55e27c Add regression test for issue #201 (template + slot onslotchange XSS)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

	Warnings
⚠️	The Pull Request doesn't contain any changes to the Upgrade file