[nimbly1]

Bug

removeScripts collapses an <a> whose href or xlink:href is javascript:, legacy vbscript:, or an executable data: URL, and moves the anchor's children up to the parent. It did that splice during the anchor's exit, while the parent was still being walked.

Two cases follow from that:

• SVG anchors often repeat the URL on both href and xlink:href. The plugin unwrapped once per attribute. After the first splice the anchor is no longer a child, so the second indexOf is -1. splice(-1, 1, ...children) replaces the parent's last child.
• Removing an anchor shortens the live child list, so the walk skips the next sibling. An empty javascript: anchor left the following anchor, still pointing at javascript:, in the document.

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
  <a href="javascript:alert(1)" xlink:href="javascript:alert(2)">
    <rect id="kept"/>
  </a>
  <circle id="sibling"/>
  <a href="javascript:alert(1)"/>
  <a href="javascript:alert(2)"><rect id="next"/></a>
</svg>

Before this change the <circle> is removed and the second anchor is left in place. A safe href paired with an executable xlink:href still unwraps once. Nested executable anchors still unwrap from the inside out.

Fixes #2295.

Verification

• The new removeScripts.12 fixture failed before the fix and passes after it. All 12 removeScripts cases pass.
• pnpm test: 521 passed, 3 skipped, no type errors.
• pnpm lint, pnpm typecheck, and pnpm spellcheck passed.

The regression and browser-bundle jobs were not run locally. removeScripts is not part of preset-default; this applies when that plugin is enabled.