Patch Changes
-
#3381
bb2441aThanks @DylanPiercey! - Fix attribute escaping only handling fully-formed, semicolon-terminated character references. HTML parsers also decode semicolon-less numeric references (&xparses as&x) and, in attribute values, legacy named references when the next character is not=or alphanumeric (x & yparses asx & y), so several authored values round-tripped to different strings.&is now escaped whenever it starts anything that could parse as a reference (&#or&+ ASCII letter); a bare&still passes through raw. -
#3379
f901f42Thanks @DylanPiercey! - Fix<define>with a destructured tag variable plus body content crashing on the client withReferenceError: $define_content is not defined(also reproducible with an identifier variable whose content is never read). The content section's renderer declaration is elided when nothing reads the content, but thecontent:property still referenced it; both are now elided under the same condition. -
#3376
7c0c0b5Thanks @DylanPiercey! - Fix resume claiming the wrong node for stateful text that serializes empty directly after an element or comment sibling (<div><span>s</span>${text}</div>with empty text bound updates to a.dataexpando on the span, and a preceding<html-comment>'s content was overwritten). Such placeholders now emit the same protective<!>separator used between sibling text. -
#3382
a986ea6Thanks @DylanPiercey! - Fix hydration never completing when an<await>inside streamed content is dropped by a<try>catch. Reorder markers whose content can no longer render now flush as empty reorders so client counters settle. -
#3358
73572f1Thanks @DylanPiercey! - Fix serialized strings corrupting in transit: unpaired surrogates and NUL were emitted raw, so UTF-8 encoding (or the HTML tokenizer inside the inline script) replaced them with U+FFFD before the client could resume them. Both now escape, and a fast-path regex guard skips the escape loop entirely for strings that need no escaping (the common case, measurably faster than before).