The shared schema wrote its injection filter with `\s`. Engines disagree
on what that covers, so the same definition validated in one language and
failed in another, and on some ports a payload walked through the filter
into the rendered SVG. Schema 1.5.1 spells the class out, so every engine
agrees on its own and the workarounds each port carried are dead.
Go, PHP and Rust drop theirs entirely. Python and C# keep only the `$`
half, because no spelling of "end of input" reads the same everywhere:
`\z` is unknown to ECMA-262, `\Z` means "before a trailing newline" in
those two, and `(?![\s\S])` needs lookahead RE2 and the regex crate lack.
1.5.1 also narrows what counts as a local reference, so
`url(<no-break space>#id)` is rejected now. The parity fixture grew to 70
separator cases and pins both directions, including the inner-separator
position that is the only one reaching the negated class.
The fixture generator gained a guard: it has two inputs, and a run meant
for the core used to absorb whatever the styles repo had done since the
last sync. It now stops before writing when the vendored definitions
moved, with --update-styles to say the styles bump is the point.
Florian Körner
a153f97003