Bump spatie/schema-org from 3.23.1 to 3.23.2

[dependabot]

Bumps spatie/schema-org from 3.23.1 to 3.23.2.

Release notes

Sourced from spatie/schema-org's releases.

3.23.2

What's Changed

Backport of the </script> break-out fix (#242) onto the 3.x line, so projects still on spatie/schema-org 3.x can apply the security patch without upgrading to 4.x.

toScript() now adds JSON_HEX_TAG to the json_encode flags. The < and > characters in property values are now serialized as their JSON unicode escapes instead of raw angle brackets, which is valid JSON-LD but cannot be parsed as an HTML tag. This neutralizes the break-out vector reported in the advisory (affected: 3.23.1 through 4.0.1).

Thanks to @​hacklian for reporting (#243) and supplying the backport patch.

Full Changelog: spatie/schema-org@3.23.1...3.23.2

Changelog

Sourced from spatie/schema-org's changelog.

3.23.2 - 2026-05-29

What's Changed

Backport of the </script> break-out fix (#242) onto the 3.x line, so projects still on spatie/schema-org 3.x can apply the security patch without upgrading to 4.x.

toScript() now adds JSON_HEX_TAG to the json_encode flags, so < and > in property values are serialized as < / >. This is valid JSON-LD but cannot be parsed as an HTML tag, neutralizing the break-out vector reported in the advisory (affected: 3.23.1 through 4.0.1).

Thanks to @​hacklian for reporting (#243) and supplying the backport patch.

Full Changelog: spatie/schema-org@3.23.1...3.23.2

4.0.2 - 2026-04-20

What's Changed

• Escape HTML tags in toScript() output to prevent script break-out by @​freekmurze in spatie/schema-org#242

Values containing </script> passed as schema properties could break out of the generated <script type="application/ld+json"> block and execute injected HTML when the value was attacker-controlled. toScript() now emits < and > as \u003C / \u003E, which is valid JSON-LD and is no longer parsed as an HTML tag by the browser. Affects 3.23.1 through 4.0.1.

Full Changelog: spatie/schema-org@4.0.1...4.0.2

4.0.1 - 2026-04-16

What's Changed

• Resolve @​id without cascading toArray() in ReferencedType by @​freekmurze in spatie/schema-org#241

Full Changelog: spatie/schema-org@4.0.0...4.0.1

4.0.0 - 2026-02-09

What's Changed

• Upgrade schema.org definitions to v29.3 (#238 by @​Soean)
• Drop PHP 8.0 and 8.1 support (now requires PHP ^8.2)
• Add PHP 8.5 support
• Add JSON_UNESCAPED_SLASHES to toScript() output
• Upgrade dev dependencies (Pest 2/3, PHPUnit 10, Symfony 6/7)
• Upgrade phpunit.xml.dist to PHPUnit 10 format
• Add return type declarations to generator commands

Commits

• 85def9a Escape HTML tags in toScript() output to prevent script break-out (backport t...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.