Changelog (v2.35.0...v2.36.0)
- security #557 [LiveComponent] Require X-Requested-With header to prevent CSRF (@Kocal)
- security #cve-2026-49216 [Autocomplete] Fix XSS via unescaped AJAX response data (@Kocal)
- security #cve-2026-49208 [LiveComponent] Parse format-less date LiveProps strictly with RFC 3339 (@Kocal)
- security #cve-2026-49209 [LiveComponent] Cap the number of actions per
_batchrequest (@Kocal) - security #cve-2026-49210 [LiveComponent] Reject malicious child component tags (@Kocal)
- security #cve-2026-49212 [LiveComponent] Bind HMAC checksum to component name and slot (@Kocal)
- security #cve-2026-49211 [Autocomplete] Escape LIKE wildcards in the search query (@Amoifr)