- Escape variant name in Responsive.Render HTML attribute (XSS fix)
- Rewrite StripTags to single-pass O(n) space collapsing
- Document Raw() security contract in WASM entry point
- Add TestAttr_NonElement coverage
- Fix Makefile WASM target to rebuild on source changes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The 2.8MB raw binary exceeds the original 2MB target, but Go WASM has
a ~2MB runtime floor that cannot be reduced without tinygo. The gzip'd
transfer size is 823KB — well under 1MB.
Update the Makefile size check to measure both raw and gzip'd sizes:
- Gzip transfer limit: 1MB (hard fail — what users download)
- Raw binary limit: 3MB (warning — accounts for Go runtime floor)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
