v0.4.0

Security

• Apply sanitizeHtml hook in plan-based and DOM-patching innerHTML paths (XSS fix)
• Add cross-origin validation to boostForm and popstateHandler
• Mitigate ReDoS in xh-validate-pattern

Fixed

• Evict failed template fetches from cache
• Null-guard closest("[xh-boost]") in boost handlers
• CSP-safe child clearing in router, boost, and popstate
• Router 404 template fetch error handler
• Clear all caches on version switch and destroy()
• Bounds-check navigatePath
• Skip File inputs in formDataToObject
• Clean up WebSocket handlers before reconnect
• Bound triggerSpecCache (500) and validationRegexCache (200) to prevent leaks

Added

• Logo and favicon (X-in-a-Tag design) integrated into docs site
• logos/ directory with dark/light logo, icon, favicon, and social preview SVGs

Changed

• Upgrade React devDependency from 18.3 to 19.2 for benchmarks
• Updated benchmark results across README and docs site

Full changelog: https://github.com/teryxjs/xhtmlx/blob/main/CHANGELOG.md