use my fork of sanitize.js for now

the source Sanitize.js doesn’t have any semver tags :’(