- Added extensive sanitization updates: upper bounds for digitsInfo, normalized tag names, SVG href/xlink sanitization, stripping namespaced SVG script elements, rejecting script elements as component hosts, and synchronized core sanitizat...
- Strengthened security for HTTP handling: excluded withCredentials requests from transfer cache, skipped TransferCache for cookie‑bearing requests, secured ServerPlatformLocation path parsing, protected against SSRF and path hijacking in ...
- Improved i18n handling: compile‑time i18n attribute validation, prefix‑insensitive DOM schema lookups, and wrapping dynamic i18n property updates in active index states.