diff --git a/.github/workflows/test-results.yml b/.github/workflows/test-results.yml
index f7185957..56dc11a5 100644
--- a/.github/workflows/test-results.yml
+++ b/.github/workflows/test-results.yml
@@ -25,7 +25,7 @@ jobs:
 
     steps:
        - name: Download and Extract Artifacts
-         uses: dawidd6/action-download-artifact@8a338493df3d275e4a7a63bcff3b8fe97e51a927
+         uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732
          with:
           run_id: ${{ github.event.workflow_run.id }}
           path: artifacts
diff --git a/CHANGELOG.md b/CHANGELOG.md
index af2026dd..4a2450a2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,8 @@
 * ADDED: Translations for Swedish & Persian
 * CHANGED: Deduplicate JSON error message translations
 * CHANGED: Refactored translation of exception messages
-* CHANGED: Upgrading libraries to: DOMpurify 3.3.2, ip-lib 1.22.0, polyfill-php80 1.33.0 & zlib 1.3.2
+* CHANGED: Upgrading libraries to: DOMpurify 3.3.2, ip-lib 1.22.0, polyfill-php80 1.34.0 & zlib 1.3.2
+* CHANGED: Remove obsolete X-XSS-Protection header (#1825)
 * FIXED: Some exceptions not getting translated
 * FIXED: Attachment disappears after a "paste" in the message area (#1731)
 * FIXED: The content format is not reset when creating a new document (#1707)
diff --git a/composer.json b/composer.json
index 92a0b996..36ce0c4e 100644
--- a/composer.json
+++ b/composer.json
@@ -27,7 +27,7 @@
 		"php": "^7.4 || ^8.0",
 		"jdenticon/jdenticon": "2.0.0",
 		"mlocati/ip-lib": "1.22.0",
-		"symfony/polyfill-php80": "1.33.0",
+		"symfony/polyfill-php80": "1.34.0",
 		"yzalis/identicon": "2.0.0"
 	},
 	"suggest" : {
diff --git a/composer.lock b/composer.lock
index f1ff020b..b6197f7d 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "ff9fb51d6276695418293a61dd81f489",
+    "content-hash": "93df7ad74baea1e462b30852a480707d",
     "packages": [
         {
             "name": "jdenticon/jdenticon",
@@ -128,16 +128,16 @@
         },
         {
             "name": "symfony/polyfill-php80",
-            "version": "v1.33.0",
+            "version": "v1.34.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-php80.git",
-                "reference": "0cc9dd0f17f61d8131e7df6b84bd344899fe2608"
+                "reference": "dfb55726c3a76ea3b6459fcfda1ec2d80a682411"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-php80/zipball/0cc9dd0f17f61d8131e7df6b84bd344899fe2608",
-                "reference": "0cc9dd0f17f61d8131e7df6b84bd344899fe2608",
+                "url": "https://api.github.com/repos/symfony/polyfill-php80/zipball/dfb55726c3a76ea3b6459fcfda1ec2d80a682411",
+                "reference": "dfb55726c3a76ea3b6459fcfda1ec2d80a682411",
                 "shasum": ""
             },
             "require": {
@@ -188,7 +188,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-php80/tree/v1.33.0"
+                "source": "https://github.com/symfony/polyfill-php80/tree/v1.34.0"
             },
             "funding": [
                 {
@@ -208,7 +208,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2025-01-02T08:10:11+00:00"
+            "time": "2026-04-10T16:19:22+00:00"
         },
         {
             "name": "yzalis/identicon",
@@ -2079,5 +2079,5 @@
     "platform-overrides": {
         "php": "7.4"
     },
-    "plugin-api-version": "2.6.0"
+    "plugin-api-version": "2.9.0"
 }
diff --git a/lib/Controller.php b/lib/Controller.php
index cef82a61..4672c3c2 100644
--- a/lib/Controller.php
+++ b/lib/Controller.php
@@ -416,7 +416,6 @@ class Controller
         header('Referrer-Policy: no-referrer');
         header('X-Content-Type-Options: nosniff');
         header('X-Frame-Options: deny');
-        header('X-XSS-Protection: 1; mode=block');
 
         // label all the expiration options
         $expire = array();