Release v2.14.1

v2.14.1

Changelog

Security: the help modal only processes labels inside a form (no HTML from labels in user content). See UPGRADING.

Security

• Help modal: only labels inside a <form>. help-modal.js turned every label[data-nowo-help-modal] on the
  page into a trigger and inserted its icon_html / title_html / content as HTML, on load and on every DOM
  mutation. HTML sanitizers keep <label> and data-*, so sanitised user content (a comment, rich text) could carry
  a payload that ran script without a click. Labels outside a <form> are now ignored; Symfony form labels are
  always inside one.
• Docs: input_group_prefix / input_group_suffix are trusted HTML; .github/SECURITY.md lists 2.x as supported.

What's Changed

• fix(security): help modal only processes labels inside a form by @HecFranco in #52

Full Changelog: v2.14.0...v2.14.1