v3.34.4

Security release. Upgrade soon if any label, badge colour or embed icon in your app can come from a user or the database.

Fixed

• Component labels were printed as HTML. A label built from user-entered text, such as <atom:badge :label="$contact->name">, could run script in the page. This affected badge, radio, checkbox, toggle, rating, slider, tab items and the generic mail button. Form field labels (input, textarea, select, date-picker, time-picker, radio.group, tiptap) were safe only through a Laravel side effect, and now escape on their own. (#83)
• A badge color starting with # was written into style unchecked, so a crafted value could add CSS declarations. Only #rgb, #rgba, #rrggbb and #rrggbbaa are accepted now. (#82)
• <atom:embed>'s icon printed any string starting with <svg as markup. It now does so only for an HtmlString. (#83)

What you may notice

• A label that already contains entities (Tom & Jerry) shows literally. Pass the raw text.
• To render markup in a label or an embed icon on purpose, wrap it in Illuminate\Support\HtmlString and escape any user value inside it with e(). t() now passes an HtmlString through.
• A badge colour that isn't a valid hex renders the default grey. Valid hex colours render as before, and 4-digit hex now gets the right shade.

See "Upgrading to 3.34.4" in the README.