2.7.1

Security Fix + Docs Update

Dynamic attribute values containing quotes could break out of the HTML attribute and inject arbitrary attributes (XSS). ensure_quoted() now picks the appropriate wrapping quote or escapes inner quotes when both types are present.

• Fix HTML attribute injection in dynamic attributes (#361) by @wrabit in #362
• Docs: Restructure, Htmx samples by @wrabit in #360

Full Changelog: 2.7.0...2.7.1