dereuromark/cakephp-tools 3.12.8 on PHP Packagist

Stop rendering the title attribute unescaped in FormatHelper::neighbors(). The link options forced escape => false, which in CakePHP HtmlHelper disables escaping of both the link text and attribute values, so the title attribute rendered raw from arbitrary DB content (XSS surface). Switched to escapeTitle => false so the icon HTML stays in the link text but attributes escape normally. Regression test covers <script> and &" payloads in title-field values.
Tighten the HTTP status check in Tools\Model\Table\Table::_validUrl(). Both ternary branches returned 'HTTP', and the [(200|301|302)] regex used a character class instead of an alternation — so it matched any status line containing one of ( 0 1 2 3 |). Replaced with a hardcoded HTTP/ prefix and real (200|301|302) / (404|999) alternations.

Pagination element is now CSP-compatible. The per-page limit <select> no longer carries an inline onchange="window.location.href=this.value" handler — replaced with a data-paginator-navigate attribute and a small delegated change listener at the bottom of the element. The accompanying <script> block carries a CSP nonce sourced from the cspNonce request attribute, so apps with a strict script-src 'self' 'nonce-...' policy can run it; falls back gracefully when no nonce is set. (Inline event handlers are blocked under strict CSP without unsafe-inline / unsafe-hashes, and the nonce directive does not cover them per the CSP spec — removing the attribute entirely is the only portable fix.)
Switched all remaining bare __() calls in user-facing strings to __d('tools', ...) so translations resolve through the plugin's own i18n domain instead of leaking into the host app's default domain. Affects four static labels in templates/Admin/Helper/{chars,bitmasks}.php and four dynamic title/icon strings in IconCollection, CommonHelper, and FormatHelper. Also refreshes resources/locales/tools.pot (the previous POT was ~6 years stale); existing language files are left for translators to msgmerge against the new POT.

Full Changelog: 3.12.7...3.12.8