See here: https://gitlab.com/gitlab-org/gitlab/-/blob/1301f88369b5f65f668733fcb8e8da95781de094/lib/banzai/filter/placeholders_post_filter.rb#L355 Changing the `href` of an anchor can have security-relevant implications, since the `ReferenceRedactor` relies on it. Verify the target `<a>` has the expected `href` (corresponding with the `<img>` we're changing it from), since while we expect these to be produced by ourselves, there's nothing stopping a user entering this HTML manually.