- Added comprehensive sanitization and namespace handling: upper‑bounds for digitsInfo, normalized tag names (including custom namespaces) in compiler and runtime, and stripped/filtered unsafe SVG/script elements.
- Strengthened security: rejected script elements as dynamic component hosts, enhanced i18n attribute validation, and protected server‑side rendering against SSRF and path hijacking.
- Updated HTTP and service‑worker behavior: excluded credentialed requests from the transfer cache, preserved redirect policies and credentials mode in reconstructed asset requests, and maintained HTTP cache modes for asset group requests.
