Release v3.3.0

[Ostico]

Summary

• Security: Hardened ServiceProvider::markdown() against XSS injection (HTML escaping, dangerous URL scheme blocklist, rel="noopener noreferrer")
• Static Analysis: Full PHPStan level 8 compliance across production and test code, including checked exception annotations
• CI/CD: Migrated from Travis CI to GitHub Actions with PHP 8.3/8.4 matrix, SonarCloud integration, and all actions updated to Node.js 24-compatible versions
• Fixes: Removed ext-xdebug from require-dev, fixed PHP 8.4 implicit nullable deprecation
• Refactoring: Replaced assertTrue(instanceof) with assertInstanceOf(), added proper types to all test methods

Test plan

• All PHPUnit tests pass on PHP 8.3 and 8.4
• PHPStan level 8 reports 0 errors
• SonarCloud analysis passes
• No Node.js deprecation warnings in CI
• XSS test cases cover: script injection, javascript:/data:/vbscript: protocols, attribute breakout, event handler injection

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud