9.1.19

Bugfix

• [security] Text a form definition places around a field, such as prepend and append labels, spacer titles and section text, is now escaped by default, with a markdown: true option for the fields that genuinely need HTML.
• [security] A select option's label property is now quoted and escaped, so a label containing a space can no longer add its own attributes to the option.