--- changelog: category: Release version: blume@1.0.2 date: '2026-07-13T06:38:44Z' seo: description: >- Harden the pre-paint inline scripts and the route-normalizing regexes against the issues CodeQL flagged.The theme and banner scripts in used to be… title: blume@1.0.2 type: changelog --- ### Patch Changes - d62dbd0: Harden the pre-paint inline scripts and the route-normalizing regexes against the issues CodeQL flagged. The theme and banner scripts in `` used to be built by interpolating config values into JavaScript source with `JSON.stringify`. JSON escaping isn't a code-context escape — `` and U+2028/U+2029 pass straight through it — so a crafted `banner.id` or theme value could break out of the script. Both scripts are now constants and take their values from `data-*` attributes on their own `