use jquery escaping for class names/category names that otherwise cau…

[719media]

…se problems

use jquery escaping for class names/category names that otherwise cause problems

[tkirda]

Closing — resolved in 2.0.1 as part of GHSA-hvqh-jw65-wcpq.

The advisory addresses exactly this — the default formatGroup (and the early-return branch of formatResult) now build the HTML via document.createElement + textContent, so any HTML in the interpolated input is entity-escaped by the browser. Same root cause you identified in 2017; thanks for the early report.