From bc820cd44f2ea65478d4413a3990aa3dd4ff79f9 Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <xamidimura@gmail.com>
Date: Wed, 11 Nov 2026 22:54:02 +0700
Subject: [PATCH 1/2] chore: bump laminas/laminas-escaper to ^2.19 as minimum

---
 admin/framework/composer.json | 2 +-
 composer.json                 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/admin/framework/composer.json b/admin/framework/composer.json
index ab34d89fd260..5a3d1996a840 100644
--- a/admin/framework/composer.json
+++ b/admin/framework/composer.json
@@ -13,7 +13,7 @@
         "php": "^8.2",
         "ext-intl": "*",
         "ext-mbstring": "*",
-        "laminas/laminas-escaper": "^2.18",
+        "laminas/laminas-escaper": "^2.19",
         "psr/log": "^3.0"
     },
     "require-dev": {
diff --git a/composer.json b/composer.json
index 1ff6b168bed2..8f16ff4058eb 100644
--- a/composer.json
+++ b/composer.json
@@ -13,7 +13,7 @@
         "php": "^8.2",
         "ext-intl": "*",
         "ext-mbstring": "*",
-        "laminas/laminas-escaper": "^2.18",
+        "laminas/laminas-escaper": "^2.19",
         "psr/log": "^3.0"
     },
     "require-dev": {

From 1f945a0ab5b1da601153e73a7e9b8e738904024d Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <xamidimura@gmail.com>
Date: Wed, 11 Nov 2026 22:55:56 +0700
Subject: [PATCH 2/2] chore: run composer update

---
 system/ThirdParty/Escaper/Escaper.php | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/system/ThirdParty/Escaper/Escaper.php b/system/ThirdParty/Escaper/Escaper.php
index 25119a0e5158..fc7a264f5637 100644
--- a/system/ThirdParty/Escaper/Escaper.php
+++ b/system/ThirdParty/Escaper/Escaper.php
@@ -162,15 +162,9 @@ public function __construct(?string $encoding = null)
         $this->htmlSpecialCharsFlags = ENT_QUOTES | ENT_SUBSTITUTE;
 
         // set matcher callbacks
-        $this->htmlAttrMatcher =
-            /** @param array<array-key, string> $matches */
-            fn(array $matches): string => $this->htmlAttrMatcher($matches);
-        $this->jsMatcher       =
-            /** @param array<array-key, string> $matches */
-            fn(array $matches): string => $this->jsMatcher($matches);
-        $this->cssMatcher      =
-            /** @param array<array-key, string> $matches */
-            fn(array $matches): string => $this->cssMatcher($matches);
+        $this->htmlAttrMatcher = $this->htmlAttrMatcher(...);
+        $this->jsMatcher       = $this->jsMatcher(...);
+        $this->cssMatcher      = $this->cssMatcher(...);
     }
 
     /**
@@ -197,7 +191,7 @@ public function escapeHtmlAttr(string $string)
             return $string;
         }
 
-        $result = preg_replace_callback('/[^a-z0-9,\.\-_]/iSu', $this->htmlAttrMatcher, $string);
+        $result = preg_replace_callback('/[^a-z0-9,\.\-_]/iu', $this->htmlAttrMatcher, $string);
         assert(is_string($result));
 
         return $this->fromUtf8($result);
@@ -211,7 +205,7 @@ public function escapeJs(string $string)
             return $string;
         }
 
-        $result = preg_replace_callback('/[^a-z0-9,\._]/iSu', $this->jsMatcher, $string);
+        $result = preg_replace_callback('/[^a-z0-9,\._]/iu', $this->jsMatcher, $string);
         assert(is_string($result));
 
         return $this->fromUtf8($result);
@@ -231,7 +225,7 @@ public function escapeCss(string $string)
             return $string;
         }
 
-        $result = preg_replace_callback('/[^a-z0-9]/iSu', $this->cssMatcher, $string);
+        $result = preg_replace_callback('/[^a-z0-9]/iu', $this->cssMatcher, $string);
         assert(is_string($result));
 
         return $this->fromUtf8($result);