- Escape forward slashes in TransferState and normalize multiple leading slashes in URL parsing to improve crawler handling and routing consistency.
- Add CSP nonce support to JsonpClientBackend and harden platform-server against SSRF bypasses via protocol‑relative and backslash URLs.
- Adjust Passthru behavior to reject usage outside a reactive context.