Chat message text, contact names and last-message previews were concatenated into HTML and inserted via .html()/.append(), so markup in a message executed in the sender's and receiver's browsers. These values are now HTML-encoded on output (escapeHtml, or .text() where a DOM node is updated).

Closes VolosoftWorkspace#1864

11.0.0-rc.2 12 November, 2026 No labels