21.2.16

Summary

• Stripped literal “/index.html” suffix from URLs in the common module (minor/bugfix).
• Moved projection attributes to constants in the compiler and hardened core inheritance using Object.create(null) for locale data to prevent prototype pollution (security).
• Server now throws on suspicious URLs and blocks protocol‑relative URLs; updated Domino dependency to the latest version (security, breaking).