- Core now rejects event attribute bindings in host bindings, enforcing stricter rules (potential breaking change).
- i18n now validates security‑sensitive attributes; Platform Server adds an `allowedHosts` option to renderModule/renderApplication and ensures origin URLs have a trailing slash for safer parsing.