- Hardened security by using SHA‑256 for cache keys, sanitizing MathML href attributes, stripping sensitive headers on cross‑origin redirects, and rejecting non‑HTTP(S) URLs in JSONP requests; added protections against prototype‑pollution ...
- Deprecated ServerXhr in platform‑server, shifting to native fetch APIs and improving URL handling and origin validation during SSR
- Implemented various bug fixes and stability tweaks such as escaping CSS strings, limiting date format length, exhaustive switch checks, removing animationstart listeners to prevent memory leaks, and ensuring query parameters are inserted...