Bug Fixes core, cdk: prevent XSS in upload-collection-item and SafePipe url binding (#14596) (91e6d86) core: call readOnly signal in tokenizer overflow template (#14615) (2f6df40)