From what I can tell having upgraded dev from 7.0.0.395 to 7.1.0.204 and again to 7.1.1.3-SNAPSHOT, both times the OWASP/Guard extension also upgraded from v2 to v3.
I know that 2.6.0.1 requires libs with CVEs, but v3 does not appear to support allowing certain commonly used and critical HTML tags such as <img> via HtmlPolicyBuilder.
Yes I know I can “simply” downgrade back to v2, but the last time I did that it was not simple at all due to multiple hidden remnants of v3 which apparently Lucee was accessing and it was a huge pain getting rid of that and finally getting back to a working Lucee server.
This is more than just annoying. It makes me fear what might happen in production. So I now have two reasons (also see Mail spool bug) for not upgrading to 7.1.
Can this policy of forcing OWASP/Guard extension upgrade be made optional?