v2.2.10

🐞 Bug fixes

• Fixed fields with when-based validation dependencies to skip evaluating non-when validation rules during conditional validation
• Fixed image-upload's matches validation rule incorrectly blocking valid file
  submissions
• Removed error state styling for toggle variant of checkbox-group
• Updated location-field set-current-location when reCAPTCHA becomes ready so current-location handling initialises at the right time

🛡️ Security hardening

• button: restrict href to http, https, mailto, and tel schemes only
• iframe: validate postMessage origin against the iframe's src by default
• location-field: escape search queries before use in regular expressions to prevent excessive processing time (ReDoS)
• sanitize-html: restrict allowed attributes to safe defaults (no wildcard)
• Schema-authored CSS (cssText) now strips @import and url() to prevent loading of arbitrary external resources

Full Changelog: v2.2.9...v2.2.10