@wavemaker/angular-codegen 11.14.1-27.647700 → 11.14.1-29.647719

package/dependencies/pipe-provider.cjs.js

@@ -124642,17 +124642,17 @@ var root$1 = freeGlobal$1 || freeSelf$1 || Function('return this')();
 var Symbol$1$1 = root$1.Symbol;
 
 /** Used for built-in method references. */
-var objectProto$h$1 = Object.prototype;
+var objectProto$i$1 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$e$1 = objectProto$h$1.hasOwnProperty;
+var hasOwnProperty$f$1 = objectProto$i$1.hasOwnProperty;
 
 /**
  * Used to resolve the
  * [`toStringTag`](http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
  * of values.
  */
-var nativeObjectToString$1$1 = objectProto$h$1.toString;
+var nativeObjectToString$1$1 = objectProto$i$1.toString;
 
 /** Built-in value references. */
 var symToStringTag$1$1 = Symbol$1$1 ? Symbol$1$1.toStringTag : undefined;
@@ -124665,7 +124665,7 @@ var symToStringTag$1$1 = Symbol$1$1 ? Symbol$1$1.toStringTag : undefined;
  * @returns {string} Returns the raw `toStringTag`.
  */
 function getRawTag$1(value) {
-  var isOwn = hasOwnProperty$e$1.call(value, symToStringTag$1$1),
+  var isOwn = hasOwnProperty$f$1.call(value, symToStringTag$1$1),
       tag = value[symToStringTag$1$1];
 
   try {
@@ -124685,14 +124685,14 @@ function getRawTag$1(value) {
 }
 
 /** Used for built-in method references. */
-var objectProto$g$1 = Object.prototype;
+var objectProto$h$1 = Object.prototype;
 
 /**
  * Used to resolve the
  * [`toStringTag`](http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
  * of values.
  */
-var nativeObjectToString$2 = objectProto$g$1.toString;
+var nativeObjectToString$2 = objectProto$h$1.toString;
 
 /**
  * Converts `value` to a string using `Object.prototype.toString`.
@@ -125158,17 +125158,17 @@ var reIsHostCtor$1 = /^\[object .+?Constructor\]$/;
 
 /** Used for built-in method references. */
 var funcProto$1$1 = Function.prototype,
-    objectProto$f$1 = Object.prototype;
+    objectProto$g$1 = Object.prototype;
 
 /** Used to resolve the decompiled source of functions. */
 var funcToString$1$1 = funcProto$1$1.toString;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$d$1 = objectProto$f$1.hasOwnProperty;
+var hasOwnProperty$e$1 = objectProto$g$1.hasOwnProperty;
 
 /** Used to detect if a method is native. */
 var reIsNative$1 = RegExp('^' +
-  funcToString$1$1.call(hasOwnProperty$d$1).replace(reRegExpChar$1, '\\$&')
+  funcToString$1$1.call(hasOwnProperty$e$1).replace(reRegExpChar$1, '\\$&')
   .replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g, '$1.*?') + '$'
 );
 
@@ -125583,10 +125583,10 @@ function eq$1(value, other) {
 }
 
 /** Used for built-in method references. */
-var objectProto$e$1 = Object.prototype;
+var objectProto$f$1 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$c$1 = objectProto$e$1.hasOwnProperty;
+var hasOwnProperty$d$1 = objectProto$f$1.hasOwnProperty;
 
 /**
  * Assigns `value` to `key` of `object` if the existing value is not equivalent
@@ -125600,7 +125600,7 @@ var hasOwnProperty$c$1 = objectProto$e$1.hasOwnProperty;
  */
 function assignValue$1(object, key, value) {
   var objValue = object[key];
-  if (!(hasOwnProperty$c$1.call(object, key) && eq$1(objValue, value)) ||
+  if (!(hasOwnProperty$d$1.call(object, key) && eq$1(objValue, value)) ||
       (value === undefined && !(key in object))) {
     baseAssignValue$1(object, key, value);
   }
@@ -125806,7 +125806,7 @@ function createAssigner$1(assigner) {
 }
 
 /** Used for built-in method references. */
-var objectProto$d$1 = Object.prototype;
+var objectProto$e$1 = Object.prototype;
 
 /**
  * Checks if `value` is likely a prototype object.
@@ -125817,7 +125817,7 @@ var objectProto$d$1 = Object.prototype;
  */
 function isPrototype$1(value) {
   var Ctor = value && value.constructor,
-      proto = (typeof Ctor == 'function' && Ctor.prototype) || objectProto$d$1;
+      proto = (typeof Ctor == 'function' && Ctor.prototype) || objectProto$e$1;
 
   return value === proto;
 }
@@ -125856,13 +125856,13 @@ function baseIsArguments$1(value) {
 }
 
 /** Used for built-in method references. */
-var objectProto$c$1 = Object.prototype;
+var objectProto$d$1 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$b$1 = objectProto$c$1.hasOwnProperty;
+var hasOwnProperty$c$1 = objectProto$d$1.hasOwnProperty;
 
 /** Built-in value references. */
-var propertyIsEnumerable$1$1 = objectProto$c$1.propertyIsEnumerable;
+var propertyIsEnumerable$1$1 = objectProto$d$1.propertyIsEnumerable;
 
 /**
  * Checks if `value` is likely an `arguments` object.
@@ -125883,7 +125883,7 @@ var propertyIsEnumerable$1$1 = objectProto$c$1.propertyIsEnumerable;
  * // => false
  */
 var isArguments$1 = baseIsArguments$1(function() { return arguments; }()) ? baseIsArguments$1 : function(value) {
-  return isObjectLike$1(value) && hasOwnProperty$b$1.call(value, 'callee') &&
+  return isObjectLike$1(value) && hasOwnProperty$c$1.call(value, 'callee') &&
     !propertyIsEnumerable$1$1.call(value, 'callee');
 };
 
@@ -126056,10 +126056,10 @@ var nodeIsTypedArray$1 = nodeUtil$1 && nodeUtil$1.isTypedArray;
 var isTypedArray$1 = nodeIsTypedArray$1 ? baseUnary$1(nodeIsTypedArray$1) : baseIsTypedArray$1;
 
 /** Used for built-in method references. */
-var objectProto$b$1 = Object.prototype;
+var objectProto$c$1 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$a$1 = objectProto$b$1.hasOwnProperty;
+var hasOwnProperty$b$1 = objectProto$c$1.hasOwnProperty;
 
 /**
  * Creates an array of the enumerable property names of the array-like `value`.
@@ -126079,7 +126079,7 @@ function arrayLikeKeys$1(value, inherited) {
       length = result.length;
 
   for (var key in value) {
-    if ((inherited || hasOwnProperty$a$1.call(value, key)) &&
+    if ((inherited || hasOwnProperty$b$1.call(value, key)) &&
         !(skipIndexes && (
            // Safari 9 has enumerable `arguments.length` in strict mode.
            key == 'length' ||
@@ -126114,10 +126114,10 @@ function overArg$1(func, transform) {
 var nativeKeys$1 = overArg$1(Object.keys, Object);
 
 /** Used for built-in method references. */
-var objectProto$a$1 = Object.prototype;
+var objectProto$b$1 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$9$1 = objectProto$a$1.hasOwnProperty;
+var hasOwnProperty$a$1 = objectProto$b$1.hasOwnProperty;
 
 /**
  * The base implementation of `_.keys` which doesn't treat sparse arrays as dense.
@@ -126132,7 +126132,7 @@ function baseKeys$1(object) {
   }
   var result = [];
   for (var key in Object(object)) {
-    if (hasOwnProperty$9$1.call(object, key) && key != 'constructor') {
+    if (hasOwnProperty$a$1.call(object, key) && key != 'constructor') {
       result.push(key);
     }
   }
@@ -126172,10 +126172,10 @@ function keys$1(object) {
 }
 
 /** Used for built-in method references. */
-var objectProto$9$1 = Object.prototype;
+var objectProto$a$1 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$8$1 = objectProto$9$1.hasOwnProperty;
+var hasOwnProperty$9$1 = objectProto$a$1.hasOwnProperty;
 
 /**
  * Assigns own enumerable string keyed properties of source objects to the
@@ -126215,7 +126215,7 @@ var assign$1 = createAssigner$1(function(object, source) {
     return;
   }
   for (var key in source) {
-    if (hasOwnProperty$8$1.call(source, key)) {
+    if (hasOwnProperty$9$1.call(source, key)) {
       assignValue$1(object, key, source[key]);
     }
   }
@@ -126241,10 +126241,10 @@ function nativeKeysIn$1(object) {
 }
 
 /** Used for built-in method references. */
-var objectProto$8$1 = Object.prototype;
+var objectProto$9$1 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$7$1 = objectProto$8$1.hasOwnProperty;
+var hasOwnProperty$8$1 = objectProto$9$1.hasOwnProperty;
 
 /**
  * The base implementation of `_.keysIn` which doesn't treat sparse arrays as dense.
@@ -126261,7 +126261,7 @@ function baseKeysIn$1(object) {
       result = [];
 
   for (var key in object) {
-    if (!(key == 'constructor' && (isProto || !hasOwnProperty$7$1.call(object, key)))) {
+    if (!(key == 'constructor' && (isProto || !hasOwnProperty$8$1.call(object, key)))) {
       result.push(key);
     }
   }
@@ -126355,10 +126355,10 @@ function hashDelete$1(key) {
 var HASH_UNDEFINED$2$1 = '__lodash_hash_undefined__';
 
 /** Used for built-in method references. */
-var objectProto$7$1 = Object.prototype;
+var objectProto$8$1 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$6$1 = objectProto$7$1.hasOwnProperty;
+var hasOwnProperty$7$1 = objectProto$8$1.hasOwnProperty;
 
 /**
  * Gets the hash value for `key`.
@@ -126375,14 +126375,14 @@ function hashGet$1(key) {
     var result = data[key];
     return result === HASH_UNDEFINED$2$1 ? undefined : result;
   }
-  return hasOwnProperty$6$1.call(data, key) ? data[key] : undefined;
+  return hasOwnProperty$7$1.call(data, key) ? data[key] : undefined;
 }
 
 /** Used for built-in method references. */
-var objectProto$6$1 = Object.prototype;
+var objectProto$7$1 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$5$1 = objectProto$6$1.hasOwnProperty;
+var hasOwnProperty$6$1 = objectProto$7$1.hasOwnProperty;
 
 /**
  * Checks if a hash value for `key` exists.
@@ -126395,7 +126395,7 @@ var hasOwnProperty$5$1 = objectProto$6$1.hasOwnProperty;
  */
 function hashHas$1(key) {
   var data = this.__data__;
-  return nativeCreate$1 ? (data[key] !== undefined) : hasOwnProperty$5$1.call(data, key);
+  return nativeCreate$1 ? (data[key] !== undefined) : hasOwnProperty$6$1.call(data, key);
 }
 
 /** Used to stand-in for `undefined` hash values. */
@@ -127040,13 +127040,13 @@ var objectTag$3$1 = '[object Object]';
 
 /** Used for built-in method references. */
 var funcProto$3 = Function.prototype,
-    objectProto$5$1 = Object.prototype;
+    objectProto$6$1 = Object.prototype;
 
 /** Used to resolve the decompiled source of functions. */
 var funcToString$3 = funcProto$3.toString;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$4$1 = objectProto$5$1.hasOwnProperty;
+var hasOwnProperty$5$1 = objectProto$6$1.hasOwnProperty;
 
 /** Used to infer the `Object` constructor. */
 var objectCtorString$1 = funcToString$3.call(Object);
@@ -127087,7 +127087,7 @@ function isPlainObject$1(value) {
   if (proto === null) {
     return true;
   }
-  var Ctor = hasOwnProperty$4$1.call(proto, 'constructor') && proto.constructor;
+  var Ctor = hasOwnProperty$5$1.call(proto, 'constructor') && proto.constructor;
   return typeof Ctor == 'function' && Ctor instanceof Ctor &&
     funcToString$3.call(Ctor) == objectCtorString$1;
 }
@@ -127892,10 +127892,10 @@ function stubArray$1() {
 }
 
 /** Used for built-in method references. */
-var objectProto$4$1 = Object.prototype;
+var objectProto$5$1 = Object.prototype;
 
 /** Built-in value references. */
-var propertyIsEnumerable$2 = objectProto$4$1.propertyIsEnumerable;
+var propertyIsEnumerable$2 = objectProto$5$1.propertyIsEnumerable;
 
 /* Built-in method references for those with the same name as other `lodash` methods. */
 var nativeGetSymbols$1$1 = Object.getOwnPropertySymbols;
@@ -128058,10 +128058,10 @@ if ((DataView$1$1 && getTag$1(new DataView$1$1(new ArrayBuffer(1))) != dataViewT
 }
 
 /** Used for built-in method references. */
-var objectProto$3$1 = Object.prototype;
+var objectProto$4$1 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$3$1 = objectProto$3$1.hasOwnProperty;
+var hasOwnProperty$4$1 = objectProto$4$1.hasOwnProperty;
 
 /**
  * Initializes an array clone.
@@ -128075,7 +128075,7 @@ function initCloneArray$1(array) {
       result = new array.constructor(length);
 
   // Add properties assigned by `RegExp#exec`.
-  if (length && typeof array[0] == 'string' && hasOwnProperty$3$1.call(array, 'index')) {
+  if (length && typeof array[0] == 'string' && hasOwnProperty$4$1.call(array, 'index')) {
     result.index = array.index;
     result.input = array.input;
   }
@@ -128536,7 +128536,7 @@ function setCacheAdd$1(value) {
  * @name has
  * @memberOf SetCache
  * @param {*} value The value to search for.
- * @returns {number} Returns `true` if `value` is found, else `false`.
+ * @returns {boolean} Returns `true` if `value` is found, else `false`.
  */
 function setCacheHas$1(value) {
   return this.__data__.has(value);
@@ -128819,10 +128819,10 @@ function equalByTag$1(object, other, tag, bitmask, customizer, equalFunc, stack)
 var COMPARE_PARTIAL_FLAG$3$1 = 1;
 
 /** Used for built-in method references. */
-var objectProto$2$1 = Object.prototype;
+var objectProto$3$1 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$2$1 = objectProto$2$1.hasOwnProperty;
+var hasOwnProperty$3$1 = objectProto$3$1.hasOwnProperty;
 
 /**
  * A specialized version of `baseIsEqualDeep` for objects with support for
@@ -128850,7 +128850,7 @@ function equalObjects$1(object, other, bitmask, customizer, equalFunc, stack) {
   var index = objLength;
   while (index--) {
     var key = objProps[index];
-    if (!(isPartial ? key in other : hasOwnProperty$2$1.call(other, key))) {
+    if (!(isPartial ? key in other : hasOwnProperty$3$1.call(other, key))) {
       return false;
     }
   }
@@ -128911,10 +128911,10 @@ var argsTag$4 = '[object Arguments]',
     objectTag$5 = '[object Object]';
 
 /** Used for built-in method references. */
-var objectProto$1$1 = Object.prototype;
+var objectProto$2$1 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$1$1 = objectProto$1$1.hasOwnProperty;
+var hasOwnProperty$2$1 = objectProto$2$1.hasOwnProperty;
 
 /**
  * A specialized version of `baseIsEqual` for arrays and objects which performs
@@ -128957,8 +128957,8 @@ function baseIsEqualDeep$1(object, other, bitmask, customizer, equalFunc, stack)
       : equalByTag$1(object, other, objTag, bitmask, customizer, equalFunc, stack);
   }
   if (!(bitmask & COMPARE_PARTIAL_FLAG$2$1)) {
-    var objIsWrapped = objIsObj && hasOwnProperty$1$1.call(object, '__wrapped__'),
-        othIsWrapped = othIsObj && hasOwnProperty$1$1.call(other, '__wrapped__');
+    var objIsWrapped = objIsObj && hasOwnProperty$2$1.call(object, '__wrapped__'),
+        othIsWrapped = othIsObj && hasOwnProperty$2$1.call(other, '__wrapped__');
 
     if (objIsWrapped || othIsWrapped) {
       var objUnwrapped = objIsWrapped ? object.value() : object,
@@ -130372,10 +130372,10 @@ var mapTag$7 = '[object Map]',
     setTag$7 = '[object Set]';
 
 /** Used for built-in method references. */
-var objectProto$i = Object.prototype;
+var objectProto$1$1 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$f = objectProto$i.hasOwnProperty;
+var hasOwnProperty$1$1 = objectProto$1$1.hasOwnProperty;
 
 /**
  * Checks if `value` is an empty object, collection, map, or set.
@@ -130427,7 +130427,7 @@ function isEmpty$1(value) {
     return !baseKeys$1(value).length;
   }
   for (var key in value) {
-    if (hasOwnProperty$f.call(value, key)) {
+    if (hasOwnProperty$1$1.call(value, key)) {
       return false;
     }
   }
@@ -130651,6 +130651,12 @@ var merge$2 = createAssigner$1(function(object, source, srcIndex) {
   baseMerge$1(object, source, srcIndex);
 });
 
+/** Used for built-in method references. */
+var objectProto$j = Object.prototype;
+
+/** Used to check objects for own properties. */
+var hasOwnProperty$g = objectProto$j.hasOwnProperty;
+
 /**
  * The base implementation of `_.unset`.
  *
@@ -130661,8 +130667,34 @@ var merge$2 = createAssigner$1(function(object, source, srcIndex) {
  */
 function baseUnset$1(object, path) {
   path = castPath$1(path, object);
-  object = parent$1$1(object, path);
-  return object == null || delete object[toKey$1(last$2(path))];
+
+  // Prevent prototype pollution:
+  // https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
+  // https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
+  var index = -1,
+      length = path.length;
+
+  if (!length) {
+    return true;
+  }
+
+  while (++index < length) {
+    var key = toKey$1(path[index]);
+
+    // Always block "__proto__" anywhere in the path if it's not expected
+    if (key === '__proto__' && !hasOwnProperty$g.call(object, '__proto__')) {
+      return false;
+    }
+
+    // Block constructor/prototype as non-terminal traversal keys to prevent
+    // escaping the object graph into built-in constructors and prototypes.
+    if ((key === 'constructor' || key === 'prototype') && index < length - 1) {
+      return false;
+    }
+  }
+
+  var obj = parent$1$1(object, path);
+  return obj == null || delete obj[toKey$1(last$2(path))];
 }
 
 /**
@@ -131422,6 +131454,13 @@ function requireDom$1 () {
 	 * used for attributes or DocumentType entities
 	 */
 	function NamedNodeMap() {
+		// nodeName -> Attr membership index; lets the parse-time de-duplication in
+		// setNamedItem resolve an existing attribute in O(1) instead of scanning the
+		// list, so building an element with M attributes costs O(M) rather than O(M^2).
+		// The numbered entries and length remain the sole authority for attribute order.
+		// Object.create(null) so an attribute named __proto__ or constructor is an
+		// ordinary key.
+		this._nameIndex = Object.create(null);
 	}
 	function _findNodeIndex(list,node){
 		var i = list.length;
@@ -131430,12 +131469,27 @@ function requireDom$1 () {
 		}
 	}
 
+	function _nnmIndexAdd(list, attr) {
+		list._nameIndex[attr.nodeName] = attr;
+	}
+	function _nnmIndexRemove(list, attr) {
+		// Only drop the entry if it still points at this attribute; a replacement with
+		// a different nodeName may already have re-keyed it.
+		if (list._nameIndex[attr.nodeName] === attr) {
+			delete list._nameIndex[attr.nodeName];
+		}
+	}
+
 	function _addNamedNode(el,list,newAttr,oldAttr){
 		if(oldAttr){
 			list[_findNodeIndex(list,oldAttr)] = newAttr;
+			// oldAttr leaves the list; drop its index entry (its nodeName may differ
+			// from newAttr's when the replacement came via setNamedItemNS).
+			_nnmIndexRemove(list, oldAttr);
 		}else {
 			list[list.length++] = newAttr;
 		}
+		_nnmIndexAdd(list, newAttr);
 		if(el){
 			newAttr.ownerElement = el;
 			var doc = el.ownerDocument;
@@ -131454,6 +131508,7 @@ function requireDom$1 () {
 				list[i] = list[++i];
 			}
 			list.length = lastIndex;
+			_nnmIndexRemove(list, attr);
 			if(el){
 				var doc = el.ownerDocument;
 				if(doc){
@@ -131487,7 +131542,11 @@ function requireDom$1 () {
 			if(el && el!=this._ownerElement){
 				throw new DOMException(INUSE_ATTRIBUTE_ERR);
 			}
-			var oldAttr = this.getNamedItem(attr.nodeName);
+			// Resolve any existing attribute with the same nodeName through the O(1)
+			// membership index rather than an O(M) scan — this is the parse-dedup hot
+			// path (setAttributeNode per attribute during parse). Absent -> undefined,
+			// matching getNamedItem's contract.
+			var oldAttr = this._nameIndex[attr.nodeName];
 			_addNamedNode(this._ownerElement,this,attr,oldAttr);
 			return oldAttr;
 		},
@@ -131720,9 +131779,38 @@ function requireDom$1 () {
 					while (child) {
 						var next = child.nextSibling;
 						if (next !== null && next.nodeType === TEXT_NODE && child.nodeType === TEXT_NODE) {
-							node.removeChild(next);
-							child.appendData(next.data);
-							// Do not advance child: re-check new nextSibling for another text run
+							// Merge the whole run of adjacent text nodes at once: gather the
+							// following text siblings' data, unlink them in a single pass, and
+							// re-index the child list a single time. Per-sibling `removeChild`
+							// (each an O(K) re-index) plus per-sibling `appendData` (each an O(K)
+							// string rebuild) is O(K^2) over a long run of single-character text
+							// nodes; this keeps it O(K). The first text node of the run survives
+							// and carries the concatenated data, preserving node identity and
+							// locator semantics.
+							var tail = [];
+							var sibling = next;
+							while (sibling !== null && sibling.nodeType === TEXT_NODE) {
+								tail.push(sibling.data);
+								sibling = sibling.nextSibling;
+							}
+							// `sibling` is now the first non-text node after the run, or null.
+							var removed = child.nextSibling;
+							while (removed !== sibling) {
+								var following = removed.nextSibling;
+								removed.parentNode = null;
+								removed.previousSibling = null;
+								removed.nextSibling = null;
+								removed = following;
+							}
+							child.nextSibling = sibling;
+							if (sibling !== null) {
+								sibling.previousSibling = child;
+							} else {
+								node.lastChild = child;
+							}
+							child.appendData(tail.join('')); // single O(K) string rebuild
+							_onUpdateChild(node.ownerDocument, node); // single O(K) re-index
+							child = sibling;
 						} else {
 							child = next;
 						}
@@ -132533,8 +132621,10 @@ function requireDom$1 () {
 		 * - it does not do any input validation on the arguments and doesn't throw "InvalidCharacterError".
 		 *
 		 * Note: When the resulting document is serialized with `requireWellFormed: true`, the
-		 * serializer throws with code `INVALID_STATE_ERR` if `.data` contains `?>` (W3C DOM Parsing
-		 * §3.2.1.7). Without that option the data is emitted verbatim.
+		 * serializer throws with code `INVALID_STATE_ERR` if `.target` is not a valid XML `NCName`
+		 * (a `Name` with no colon) or is an ASCII case-insensitive match for `"xml"`, or if `.data`
+		 * contains `?>` (W3C DOM Parsing §3.2.1.7). Without that option the target and data are
+		 * emitted verbatim.
 		 *
 		 * @param {string} target
 		 * @param {string} data
@@ -132559,7 +132649,27 @@ function requireDom$1 () {
 			node.specified = true;
 			return node;
 		},
+		/**
+		 * Creates an EntityReference object, serialized as `&name;`.
+		 *
+		 * The `name` is validated against the XML `Name` production at creation time; an invalid name
+		 * throws a `DOMException` with code `INVALID_CHARACTER_ERR`. When the resulting node is
+		 * serialized with `requireWellFormed: true`, the serializer re-validates `nodeName` and throws
+		 * a `DOMException` with code `INVALID_STATE_ERR` if a later `nodeName` mutation made it invalid;
+		 * without that option the name is emitted verbatim.
+		 *
+		 * Note: xmldom does not expand entities — the parser resolves entity references inline and never
+		 * constructs `EntityReference` nodes, so this method is the only producer.
+		 *
+		 * @param {string} name The name of the entity to reference.
+		 * @returns {EntityReference}
+		 * @throws {DOMException} With code `INVALID_CHARACTER_ERR` when `name` is not a valid XML `Name`.
+		 * @see https://www.w3.org/TR/DOM-Level-3-Core/core.html#ID-392B75AE
+		 */
 		createEntityReference :	function(name){
+			if (!tagNamePattern.test(name)) {
+				throw new DOMException(INVALID_CHARACTER_ERR, 'not a valid xml name "' + name + '"');
+			}
 			var node = new EntityReference();
 			node.ownerDocument	= this;
 			node.nodeName	= name;
@@ -132771,15 +132881,16 @@ function requireDom$1 () {
 	/**
 	 * Represents a DocumentType node (the `<!DOCTYPE ...>` declaration).
 	 *
-	 * `publicId`, `systemId`, and `internalSubset` are plain own-property assignments.
+	 * `name`, `publicId`, `systemId`, and `internalSubset` are plain own-property assignments.
 	 * xmldom does not enforce the `readonly` constraint declared by the WHATWG DOM spec —
 	 * direct property writes succeed silently. Values are serialized verbatim when
 	 * `requireWellFormed` is false (the default). When the serializer is invoked with
 	 * `requireWellFormed: true` (via the 4th-parameter options object), it validates each
-	 * field and throws `DOMException` with code `INVALID_STATE_ERR` on invalid values.
+	 * field — including `name`, which is checked against the XML `Name` production — and throws
+	 * `DOMException` with code `INVALID_STATE_ERR` on invalid values.
 	 *
 	 * @class
-	 * @see https://developer.mozilla.org/en-US/docs/Web/API/DocumentType MDN
+	 * @see https://developer.mozilla.org/docs/Web/API/DocumentType MDN
 	 */
 	function DocumentType() {
 	}	DocumentType.prototype.nodeType = DOCUMENT_TYPE_NODE;
@@ -132793,6 +132904,20 @@ function requireDom$1 () {
 	}	Entity.prototype.nodeType = ENTITY_NODE;
 	_extends(Entity,Node);
 
+	/**
+	 * Represents an EntityReference node, serialized as `&nodeName;`.
+	 *
+	 * `nodeName` is the referenced entity's name, stored verbatim. When serialized with
+	 * `requireWellFormed: true`, the serializer validates `nodeName` against the XML `Name` production
+	 * and throws a `DOMException` with code `INVALID_STATE_ERR` if it does not match; without that
+	 * option the name is emitted verbatim between `&` and `;`.
+	 *
+	 * Note: xmldom does not expand entities — the parser resolves entity references inline and never
+	 * constructs `EntityReference` nodes, so the only producer is `Document.createEntityReference`.
+	 *
+	 * @class
+	 * @see https://www.w3.org/TR/xml/#NT-Name
+	 */
 	function EntityReference() {
 	}	EntityReference.prototype.nodeType = ENTITY_REFERENCE_NODE;
 	_extends(EntityReference,Node);
@@ -132835,12 +132960,15 @@ function requireDom$1 () {
 	 *   not a valid XML QName,
 	 * - a CDATASection node's data contains `"]]>"`,
 	 * - a Comment node's data contains `"-->"` (bare `"--"` does not throw on this branch),
-	 * - a ProcessingInstruction's data contains `"?>"`,
+	 * - a ProcessingInstruction's target is not a valid XML `NCName` (a `Name` with no colon) or is
+	 *   an ASCII case-insensitive match for `"xml"`, or its data contains `"?>"`,
+	 * - a DocumentType's `name` is not a valid XML `Name` (XML 1.0 production [5]),
 	 * - a DocumentType's `publicId` is non-empty and does not match the XML `PubidLiteral`
 	 *   production,
 	 * - a DocumentType's `systemId` is non-empty and does not match the XML `SystemLiteral`
-	 *   production, or
-	 * - a DocumentType's `internalSubset` contains `"]>"`.
+	 *   production,
+	 * - a DocumentType's `internalSubset` contains `"]>"`, or
+	 * - an EntityReference's `nodeName` is not a valid XML `Name` (XML 1.0 production [5]).
 	 * Note: xmldom does not enforce `readonly` on DocumentType fields — direct property
 	 * writes succeed and are covered by the serializer-level checks above.
 	 * @see https://html.spec.whatwg.org/#dom-xmlserializer-serializetostring
@@ -133095,6 +133223,9 @@ function requireDom$1 () {
 
 					case DOCUMENT_TYPE_NODE:
 						if (requireWellFormed) {
+							if (!tagNamePattern.test(n.name)) {
+								throw new DOMException(INVALID_STATE_ERR, 'The doctype name "' + n.name + '" is not a valid XML Name');
+							}
 							if (n.publicId && !/^("[\x20\r\na-zA-Z0-9\-()+,.\/:=?;!*#@$_%']*"|'[\x20\r\na-zA-Z0-9\-()+,.\/:=?;!*#@$_%'"]*')$/.test(n.publicId)) {
 								throw new DOMException(INVALID_STATE_ERR, 'DocumentType publicId is not a valid PubidLiteral');
 							}
@@ -133126,13 +133257,27 @@ function requireDom$1 () {
 						return null;
 
 					case PROCESSING_INSTRUCTION_NODE:
-						if (requireWellFormed && n.data.indexOf('?>') !== -1) {
-							throw new DOMException(INVALID_STATE_ERR, 'The ProcessingInstruction data contains "?>"');
+						if (requireWellFormed) {
+							if (!tagNamePattern.test(n.target) || n.target.indexOf(':') !== -1 || n.target.toLowerCase() === 'xml') {
+								throw new DOMException(
+									INVALID_STATE_ERR,
+									'The processing instruction target "' + n.target + '" is not a valid XML NCName or is reserved'
+								);
+							}
+							if (n.data.indexOf('?>') !== -1) {
+								throw new DOMException(INVALID_STATE_ERR, 'The ProcessingInstruction data contains "?>"');
+							}
 						}
 						buf.push('<?', n.target, ' ', n.data, '?>');
 						return null;
 
 					case ENTITY_REFERENCE_NODE:
+						if (requireWellFormed && !tagNamePattern.test(n.nodeName)) {
+							throw new DOMException(
+								INVALID_STATE_ERR,
+								'The entity reference name "' + n.nodeName + '" is not a valid XML Name'
+							);
+						}
 						buf.push('&', n.nodeName, ';');
 						return null;
 
@@ -135625,7 +135770,13 @@ function requireSax$1 () {
 				switch(source.charAt(tagStart+1)){
 				case '/':
 					var end = source.indexOf('>',tagStart+3);
-					var tagName = source.substring(tagStart + 2, end).replace(/[ \t\n\r]+$/g, '');
+					// Anchored trailing-whitespace trim. The former `/[ \t\n\r]+$/g` backtracked
+					// quadratically on a name shaped `whitespace-run + non-whitespace char`
+					// (an end tag `</   …   x>`): from every start position it extended `[ws]+`
+					// to the end and then failed the `$` anchor. This anchored form matches the
+					// whole string once and captures everything up to the last non-whitespace
+					// character, so it trims in linear time with byte-identical output.
+					var tagName = source.substring(tagStart + 2, end).replace(/^([\s\S]*?[^ \t\n\r])?[ \t\n\r]*$/, '$1');
 					var config = parseStack.pop();
 					if(end<0){
 
@@ -135636,6 +135787,14 @@ function requireSax$1 () {
 		        		tagName = tagName.replace(/[\s<].*/,'');
 		        		errorHandler.error("end tag name: "+tagName+' maybe not complete');
 		        		end = tagStart+1+tagName.length;
+					}else if(/[ \t\n\r]/.test(tagName) && tagNamePattern.test(tagName.split(/[ \t\n\r]/)[0])){
+						// The XML `ETag` production is `'</' Name S? '>'`: only optional whitespace may follow
+						// the `Name`. A valid `Name` followed by whitespace and non-whitespace residue (e.g.
+						// `</a\nbogus>` or `</a bogus>`) is not well-formed, but historically it was silently
+						// accepted (the malformed end tag ignored, the residue dropped, the element left on the
+						// stack). Report it as a recoverable `error` (which a custom errorHandler may escalate to
+						// fatal) while keeping the existing recovery so the parsed DOM stays byte-identical.
+						errorHandler.error('end tag name is followed by whitespace and trailing content: "'+tagName+'"');
 					}
 					var localNSMap = config.localNSMap;
 					var endMatch = config.tagName == tagName;
@@ -135759,6 +135918,15 @@ function requireSax$1 () {
 		var s = S_TAG;//status
 		while(true){
 			var c = source.charAt(p);
+			if (s === S_TAG && c === '<') {
+				// A `<` can never occur inside a tag name. Without this guard the scan runs
+				// on to the next `>` (or EOF) before the tag name is rejected, so a document
+				// with many `<` inside a malformed tag makes each one-character recovery step
+				// re-scan to the distant `>` — O(n^2). Stopping at the `<` keeps each recovery
+				// step bounded. The candidate scanned so far is reported raw, consistent with
+				// the sibling invalid-tag-name throw below.
+				throw new Error('unexpected < in tag name: ' + source.slice(start, p));
+			}
 			switch(c){
 			case '=':
 				if(s === S_ATTR){//attrName
@@ -135951,9 +136119,13 @@ function requireSax$1 () {
 			if(nsPrefix !== false){//hack!!
 				if(localNSMap == null){
 					localNSMap = {};
-					//console.log(currentNSMap,0)
-					_copy(currentNSMap,currentNSMap={});
-					//console.log(currentNSMap,1)
+					// Derive the child scope's namespace map by prototype-chain inheritance
+					// instead of a flat copy: lookups inherit ancestor prefixes transparently,
+					// so a document nesting N scopes retains O(N) map entries rather than
+					// sum(1..N) = O(N^2). localNSMap stays a flat own-only record of the
+					// prefixes declared at THIS element, so own-property enumeration
+					// (endPrefixMapping below) still reports only local declarations.
+					currentNSMap = Object.create(currentNSMap);
 				}
 				currentNSMap[nsPrefix] = localNSMap[nsPrefix] = value;
 				a.uri = NAMESPACE.XMLNS;
@@ -148131,13 +148303,13 @@ const FIRST_TIME_WATCH$1 = {};
 Object.freeze(FIRST_TIME_WATCH$1);
 const arrayConsumer$1 = (listenerFn, restExpr, newVal, oldVal) => {
     let data = newVal, formattedData;
-    if (isArray$1(data)) {
+    if (_.isArray(data)) {
         formattedData = data.map(function (datum) {
             return findValueOf$1(datum, restExpr);
         });
         // If resulting structure is an array of array, flatten it
-        if (isArray$1(formattedData[0])) {
-            formattedData = flatten$2(formattedData);
+        if (_.isArray(formattedData[0])) {
+            formattedData = _.flatten(formattedData);
         }
         listenerFn(formattedData, oldVal);
     }
@@ -148182,6 +148354,19 @@ const $watch$1 = (expr, $scope, $locals, listener, identifier = watchIdGenerator
 };
 const $unwatch$1 = identifier => registry$1.delete(identifier);
 window.watchRegistry = registry$1;
+window.__WM_DEBUG_WATCHERS__ = false;
+/*export const $invokeWatchers = (force?: boolean, ignoreMuted?: boolean) => {
+    if (force) {
+        triggerWatchers(ignoreMuted);
+    } else {
+
+        if (skipWatchers) {
+            skipWatchers = false;
+            return;
+        }
+        debouncedTriggerWatchers();
+    }
+};*/
 const $appDigest$1 = (() => {
     return (force) => {
         {
@@ -148244,8 +148429,8 @@ var Operation$1;
 const DataSource$1 = {
     Operation: Operation$1
 };
-class App {
-}
+let App$1 = class App {
+};
 let AbstractI18nService$1 = class AbstractI18nService {
 };
 
@@ -148263,6 +148448,7 @@ const REGEX$1 = {
     SUPPORTED_AUDIO_FORMAT: /\.(mp3|ogg|webm|wma|3gp|wav|m4a)$/i,
     SUPPORTED_VIDEO_FORMAT: /\.(mp4|ogg|webm|wmv|mpeg|mpg|avi|mov)$/i,
     VALID_WEB_URL: /^(http[s]?:\/\/)(www\.){0,1}[a-zA-Z0-9=:?\/\.\-]+(\.[a-zA-Z]{2,5}[\.]{0,1})?/,
+    VALID_IMAGE_URL: /^(https?|blob|data|file|ftp):/i,
     REPLACE_PATTERN: /\$\{([^\}]+)\}/g,
     DATA_URL: /^\s*data:([a-z]+\/[a-z0-9-+.]+(;[a-z-]+=[a-z0-9-]+)?)?(;base64)?,([a-z0-9!$&',()*+;=\-._~:@\/?%\s]*)\s*$/i,
     ISO_DATE_FORMAT: /(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2}:\d{2})(\.\d+)?([+-]\d{2}:?\d{2}|Z)$/
@@ -148485,6 +148671,9 @@ const isVideoFile$1 = (fileName) => {
 const isValidWebURL$1 = (url) => {
     return (REGEX$1.VALID_WEB_URL).test(url);
 };
+const isValidImageUrl$1 = (url) => {
+    return (REGEX$1.VALID_IMAGE_URL).test(url?.trim());
+};
 /*This function returns the url to the resource after checking the validity of url*/
 const getResourceURL$1 = (urlString) => {
     return urlString;
@@ -149738,6 +149927,7 @@ var Utils$1 = /*#__PURE__*/Object.freeze({
     isPageable: isPageable$1,
     isSafari: isSafari$1,
     isTablet: isTablet$1,
+    isValidImageUrl: isValidImageUrl$1,
     isValidWebURL: isValidWebURL$1,
     isVideoFile: isVideoFile$1,
     loadScript: loadScript$1,
@@ -150972,14 +151162,14 @@ class ToDatePipe extends WmPipe {
         }
         return this.returnFn('', arguments, this.app.Variables);
     }
-    constructor(datePipe, i18nService, customPipeManager) {
+    constructor(datePipe, i18nService, app, customPipeManager) {
         super('toDate', customPipeManager);
         this.datePipe = datePipe;
         this.i18nService = i18nService;
+        this.app = app;
         this.customPipeManager = customPipeManager;
-        this.app = inject(App);
     }
-    static { this.ɵfac = function ToDatePipe_Factory(__ngFactoryType__) { return new (__ngFactoryType__ || ToDatePipe)(ɵɵdirectiveInject(DatePipe, 16), ɵɵdirectiveInject(AbstractI18nService$1, 16), ɵɵdirectiveInject(CustomPipeManager$1, 16)); }; }
+    static { this.ɵfac = function ToDatePipe_Factory(__ngFactoryType__) { return new (__ngFactoryType__ || ToDatePipe)(ɵɵdirectiveInject(DatePipe, 16), ɵɵdirectiveInject(AbstractI18nService$1, 16), ɵɵdirectiveInject(App$1, 16), ɵɵdirectiveInject(CustomPipeManager$1, 16)); }; }
     static { this.ɵpipe = /*@__PURE__*/ ɵɵdefinePipe({ name: "toDate", type: ToDatePipe, pure: true, standalone: true }); }
 }
 (() => { (typeof ngDevMode === "undefined" || ngDevMode) && setClassMetadata(ToDatePipe, [{
@@ -150988,7 +151178,7 @@ class ToDatePipe extends WmPipe {
                 standalone: true,
                 name: 'toDate'
             }]
-    }], () => [{ type: DatePipe }, { type: AbstractI18nService$1 }, { type: CustomPipeManager$1 }], null); })();
+    }], () => [{ type: DatePipe }, { type: AbstractI18nService$1 }, { type: App$1 }, { type: CustomPipeManager$1 }], null); })();
 class ToNumberPipe {
     transform(data, fracSize) {
         if (fracSize && !String(fracSize).match(/^(\d+)?\.((\d+)(-(\d+))?)?$/)) {
@@ -151076,9 +151266,9 @@ class SuffixPipe {
  * Custom pipe: It is work as interceptor between the user custom pipe function and angular pipe
  */
 class CustomPipe {
-    constructor(custmeUserPipe) {
+    constructor(app, custmeUserPipe) {
+        this.app = app;
         this.custmeUserPipe = custmeUserPipe;
-        this.app = inject(App);
     }
     transform(data, pipename) {
         let argumentArr = [];
@@ -151098,7 +151288,7 @@ class CustomPipe {
             return data;
         }
     }
-    static { this.ɵfac = function CustomPipe_Factory(__ngFactoryType__) { return new (__ngFactoryType__ || CustomPipe)(ɵɵdirectiveInject(CustomPipeManager$1, 16)); }; }
+    static { this.ɵfac = function CustomPipe_Factory(__ngFactoryType__) { return new (__ngFactoryType__ || CustomPipe)(ɵɵdirectiveInject(App$1, 16), ɵɵdirectiveInject(CustomPipeManager$1, 16)); }; }
     static { this.ɵpipe = /*@__PURE__*/ ɵɵdefinePipe({ name: "custom", type: CustomPipe, pure: true, standalone: true }); }
 }
 (() => { (typeof ngDevMode === "undefined" || ngDevMode) && setClassMetadata(CustomPipe, [{
@@ -151107,7 +151297,7 @@ class CustomPipe {
                 standalone: true,
                 name: 'custom'
             }]
-    }], () => [{ type: CustomPipeManager$1 }], null); })();
+    }], () => [{ type: App$1 }, { type: CustomPipeManager$1 }], null); })();
 class TimeFromNowPipe {
     transform(data) {
         let timestamp;
@@ -181597,17 +181787,17 @@ var root = freeGlobal || freeSelf || Function('return this')();
 var Symbol$1 = root.Symbol;
 
 /** Used for built-in method references. */
-var objectProto$h = Object.prototype;
+var objectProto$i = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$e = objectProto$h.hasOwnProperty;
+var hasOwnProperty$f = objectProto$i.hasOwnProperty;
 
 /**
  * Used to resolve the
  * [`toStringTag`](http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
  * of values.
  */
-var nativeObjectToString$1 = objectProto$h.toString;
+var nativeObjectToString$1 = objectProto$i.toString;
 
 /** Built-in value references. */
 var symToStringTag$1 = Symbol$1 ? Symbol$1.toStringTag : undefined;
@@ -181620,7 +181810,7 @@ var symToStringTag$1 = Symbol$1 ? Symbol$1.toStringTag : undefined;
  * @returns {string} Returns the raw `toStringTag`.
  */
 function getRawTag(value) {
-  var isOwn = hasOwnProperty$e.call(value, symToStringTag$1),
+  var isOwn = hasOwnProperty$f.call(value, symToStringTag$1),
       tag = value[symToStringTag$1];
 
   try {
@@ -181640,14 +181830,14 @@ function getRawTag(value) {
 }
 
 /** Used for built-in method references. */
-var objectProto$g = Object.prototype;
+var objectProto$h = Object.prototype;
 
 /**
  * Used to resolve the
  * [`toStringTag`](http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
  * of values.
  */
-var nativeObjectToString = objectProto$g.toString;
+var nativeObjectToString = objectProto$h.toString;
 
 /**
  * Converts `value` to a string using `Object.prototype.toString`.
@@ -182113,17 +182303,17 @@ var reIsHostCtor = /^\[object .+?Constructor\]$/;
 
 /** Used for built-in method references. */
 var funcProto$1 = Function.prototype,
-    objectProto$f = Object.prototype;
+    objectProto$g = Object.prototype;
 
 /** Used to resolve the decompiled source of functions. */
 var funcToString$1 = funcProto$1.toString;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$d = objectProto$f.hasOwnProperty;
+var hasOwnProperty$e = objectProto$g.hasOwnProperty;
 
 /** Used to detect if a method is native. */
 var reIsNative = RegExp('^' +
-  funcToString$1.call(hasOwnProperty$d).replace(reRegExpChar, '\\$&')
+  funcToString$1.call(hasOwnProperty$e).replace(reRegExpChar, '\\$&')
   .replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g, '$1.*?') + '$'
 );
 
@@ -182538,10 +182728,10 @@ function eq(value, other) {
 }
 
 /** Used for built-in method references. */
-var objectProto$e = Object.prototype;
+var objectProto$f = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$c = objectProto$e.hasOwnProperty;
+var hasOwnProperty$d = objectProto$f.hasOwnProperty;
 
 /**
  * Assigns `value` to `key` of `object` if the existing value is not equivalent
@@ -182555,7 +182745,7 @@ var hasOwnProperty$c = objectProto$e.hasOwnProperty;
  */
 function assignValue(object, key, value) {
   var objValue = object[key];
-  if (!(hasOwnProperty$c.call(object, key) && eq(objValue, value)) ||
+  if (!(hasOwnProperty$d.call(object, key) && eq(objValue, value)) ||
       (value === undefined && !(key in object))) {
     baseAssignValue(object, key, value);
   }
@@ -182761,7 +182951,7 @@ function createAssigner(assigner) {
 }
 
 /** Used for built-in method references. */
-var objectProto$d = Object.prototype;
+var objectProto$e = Object.prototype;
 
 /**
  * Checks if `value` is likely a prototype object.
@@ -182772,7 +182962,7 @@ var objectProto$d = Object.prototype;
  */
 function isPrototype(value) {
   var Ctor = value && value.constructor,
-      proto = (typeof Ctor == 'function' && Ctor.prototype) || objectProto$d;
+      proto = (typeof Ctor == 'function' && Ctor.prototype) || objectProto$e;
 
   return value === proto;
 }
@@ -182811,13 +183001,13 @@ function baseIsArguments(value) {
 }
 
 /** Used for built-in method references. */
-var objectProto$c = Object.prototype;
+var objectProto$d = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$b = objectProto$c.hasOwnProperty;
+var hasOwnProperty$c = objectProto$d.hasOwnProperty;
 
 /** Built-in value references. */
-var propertyIsEnumerable$1 = objectProto$c.propertyIsEnumerable;
+var propertyIsEnumerable$1 = objectProto$d.propertyIsEnumerable;
 
 /**
  * Checks if `value` is likely an `arguments` object.
@@ -182838,7 +183028,7 @@ var propertyIsEnumerable$1 = objectProto$c.propertyIsEnumerable;
  * // => false
  */
 var isArguments = baseIsArguments(function() { return arguments; }()) ? baseIsArguments : function(value) {
-  return isObjectLike(value) && hasOwnProperty$b.call(value, 'callee') &&
+  return isObjectLike(value) && hasOwnProperty$c.call(value, 'callee') &&
     !propertyIsEnumerable$1.call(value, 'callee');
 };
 
@@ -183011,10 +183201,10 @@ var nodeIsTypedArray = nodeUtil && nodeUtil.isTypedArray;
 var isTypedArray = nodeIsTypedArray ? baseUnary(nodeIsTypedArray) : baseIsTypedArray;
 
 /** Used for built-in method references. */
-var objectProto$b = Object.prototype;
+var objectProto$c = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$a = objectProto$b.hasOwnProperty;
+var hasOwnProperty$b = objectProto$c.hasOwnProperty;
 
 /**
  * Creates an array of the enumerable property names of the array-like `value`.
@@ -183034,7 +183224,7 @@ function arrayLikeKeys(value, inherited) {
       length = result.length;
 
   for (var key in value) {
-    if ((inherited || hasOwnProperty$a.call(value, key)) &&
+    if ((inherited || hasOwnProperty$b.call(value, key)) &&
         !(skipIndexes && (
            // Safari 9 has enumerable `arguments.length` in strict mode.
            key == 'length' ||
@@ -183069,10 +183259,10 @@ function overArg(func, transform) {
 var nativeKeys = overArg(Object.keys, Object);
 
 /** Used for built-in method references. */
-var objectProto$a = Object.prototype;
+var objectProto$b = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$9 = objectProto$a.hasOwnProperty;
+var hasOwnProperty$a = objectProto$b.hasOwnProperty;
 
 /**
  * The base implementation of `_.keys` which doesn't treat sparse arrays as dense.
@@ -183087,7 +183277,7 @@ function baseKeys(object) {
   }
   var result = [];
   for (var key in Object(object)) {
-    if (hasOwnProperty$9.call(object, key) && key != 'constructor') {
+    if (hasOwnProperty$a.call(object, key) && key != 'constructor') {
       result.push(key);
     }
   }
@@ -183127,10 +183317,10 @@ function keys(object) {
 }
 
 /** Used for built-in method references. */
-var objectProto$9 = Object.prototype;
+var objectProto$a = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$8 = objectProto$9.hasOwnProperty;
+var hasOwnProperty$9 = objectProto$a.hasOwnProperty;
 
 /**
  * Assigns own enumerable string keyed properties of source objects to the
@@ -183170,7 +183360,7 @@ var assign = createAssigner(function(object, source) {
     return;
   }
   for (var key in source) {
-    if (hasOwnProperty$8.call(source, key)) {
+    if (hasOwnProperty$9.call(source, key)) {
       assignValue(object, key, source[key]);
     }
   }
@@ -183196,10 +183386,10 @@ function nativeKeysIn(object) {
 }
 
 /** Used for built-in method references. */
-var objectProto$8 = Object.prototype;
+var objectProto$9 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$7 = objectProto$8.hasOwnProperty;
+var hasOwnProperty$8 = objectProto$9.hasOwnProperty;
 
 /**
  * The base implementation of `_.keysIn` which doesn't treat sparse arrays as dense.
@@ -183216,7 +183406,7 @@ function baseKeysIn(object) {
       result = [];
 
   for (var key in object) {
-    if (!(key == 'constructor' && (isProto || !hasOwnProperty$7.call(object, key)))) {
+    if (!(key == 'constructor' && (isProto || !hasOwnProperty$8.call(object, key)))) {
       result.push(key);
     }
   }
@@ -183310,10 +183500,10 @@ function hashDelete(key) {
 var HASH_UNDEFINED$2 = '__lodash_hash_undefined__';
 
 /** Used for built-in method references. */
-var objectProto$7 = Object.prototype;
+var objectProto$8 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$6 = objectProto$7.hasOwnProperty;
+var hasOwnProperty$7 = objectProto$8.hasOwnProperty;
 
 /**
  * Gets the hash value for `key`.
@@ -183330,14 +183520,14 @@ function hashGet(key) {
     var result = data[key];
     return result === HASH_UNDEFINED$2 ? undefined : result;
   }
-  return hasOwnProperty$6.call(data, key) ? data[key] : undefined;
+  return hasOwnProperty$7.call(data, key) ? data[key] : undefined;
 }
 
 /** Used for built-in method references. */
-var objectProto$6 = Object.prototype;
+var objectProto$7 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$5 = objectProto$6.hasOwnProperty;
+var hasOwnProperty$6 = objectProto$7.hasOwnProperty;
 
 /**
  * Checks if a hash value for `key` exists.
@@ -183350,7 +183540,7 @@ var hasOwnProperty$5 = objectProto$6.hasOwnProperty;
  */
 function hashHas(key) {
   var data = this.__data__;
-  return nativeCreate ? (data[key] !== undefined) : hasOwnProperty$5.call(data, key);
+  return nativeCreate ? (data[key] !== undefined) : hasOwnProperty$6.call(data, key);
 }
 
 /** Used to stand-in for `undefined` hash values. */
@@ -183995,13 +184185,13 @@ var objectTag$3 = '[object Object]';
 
 /** Used for built-in method references. */
 var funcProto = Function.prototype,
-    objectProto$5 = Object.prototype;
+    objectProto$6 = Object.prototype;
 
 /** Used to resolve the decompiled source of functions. */
 var funcToString = funcProto.toString;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$4 = objectProto$5.hasOwnProperty;
+var hasOwnProperty$5 = objectProto$6.hasOwnProperty;
 
 /** Used to infer the `Object` constructor. */
 var objectCtorString = funcToString.call(Object);
@@ -184042,7 +184232,7 @@ function isPlainObject(value) {
   if (proto === null) {
     return true;
   }
-  var Ctor = hasOwnProperty$4.call(proto, 'constructor') && proto.constructor;
+  var Ctor = hasOwnProperty$5.call(proto, 'constructor') && proto.constructor;
   return typeof Ctor == 'function' && Ctor instanceof Ctor &&
     funcToString.call(Ctor) == objectCtorString;
 }
@@ -184847,10 +185037,10 @@ function stubArray() {
 }
 
 /** Used for built-in method references. */
-var objectProto$4 = Object.prototype;
+var objectProto$5 = Object.prototype;
 
 /** Built-in value references. */
-var propertyIsEnumerable = objectProto$4.propertyIsEnumerable;
+var propertyIsEnumerable = objectProto$5.propertyIsEnumerable;
 
 /* Built-in method references for those with the same name as other `lodash` methods. */
 var nativeGetSymbols$1 = Object.getOwnPropertySymbols;
@@ -185013,10 +185203,10 @@ if ((DataView$1 && getTag(new DataView$1(new ArrayBuffer(1))) != dataViewTag$3)
 }
 
 /** Used for built-in method references. */
-var objectProto$3 = Object.prototype;
+var objectProto$4 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$3 = objectProto$3.hasOwnProperty;
+var hasOwnProperty$4 = objectProto$4.hasOwnProperty;
 
 /**
  * Initializes an array clone.
@@ -185030,7 +185220,7 @@ function initCloneArray(array) {
       result = new array.constructor(length);
 
   // Add properties assigned by `RegExp#exec`.
-  if (length && typeof array[0] == 'string' && hasOwnProperty$3.call(array, 'index')) {
+  if (length && typeof array[0] == 'string' && hasOwnProperty$4.call(array, 'index')) {
     result.index = array.index;
     result.input = array.input;
   }
@@ -185491,7 +185681,7 @@ function setCacheAdd(value) {
  * @name has
  * @memberOf SetCache
  * @param {*} value The value to search for.
- * @returns {number} Returns `true` if `value` is found, else `false`.
+ * @returns {boolean} Returns `true` if `value` is found, else `false`.
  */
 function setCacheHas(value) {
   return this.__data__.has(value);
@@ -185774,10 +185964,10 @@ function equalByTag(object, other, tag, bitmask, customizer, equalFunc, stack) {
 var COMPARE_PARTIAL_FLAG$3 = 1;
 
 /** Used for built-in method references. */
-var objectProto$2 = Object.prototype;
+var objectProto$3 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$2 = objectProto$2.hasOwnProperty;
+var hasOwnProperty$3 = objectProto$3.hasOwnProperty;
 
 /**
  * A specialized version of `baseIsEqualDeep` for objects with support for
@@ -185805,7 +185995,7 @@ function equalObjects(object, other, bitmask, customizer, equalFunc, stack) {
   var index = objLength;
   while (index--) {
     var key = objProps[index];
-    if (!(isPartial ? key in other : hasOwnProperty$2.call(other, key))) {
+    if (!(isPartial ? key in other : hasOwnProperty$3.call(other, key))) {
       return false;
     }
   }
@@ -185866,10 +186056,10 @@ var argsTag = '[object Arguments]',
     objectTag = '[object Object]';
 
 /** Used for built-in method references. */
-var objectProto$1 = Object.prototype;
+var objectProto$2 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty$1 = objectProto$1.hasOwnProperty;
+var hasOwnProperty$2 = objectProto$2.hasOwnProperty;
 
 /**
  * A specialized version of `baseIsEqual` for arrays and objects which performs
@@ -185912,8 +186102,8 @@ function baseIsEqualDeep(object, other, bitmask, customizer, equalFunc, stack) {
       : equalByTag(object, other, objTag, bitmask, customizer, equalFunc, stack);
   }
   if (!(bitmask & COMPARE_PARTIAL_FLAG$2)) {
-    var objIsWrapped = objIsObj && hasOwnProperty$1.call(object, '__wrapped__'),
-        othIsWrapped = othIsObj && hasOwnProperty$1.call(other, '__wrapped__');
+    var objIsWrapped = objIsObj && hasOwnProperty$2.call(object, '__wrapped__'),
+        othIsWrapped = othIsObj && hasOwnProperty$2.call(other, '__wrapped__');
 
     if (objIsWrapped || othIsWrapped) {
       var objUnwrapped = objIsWrapped ? object.value() : object,
@@ -187327,10 +187517,10 @@ var mapTag = '[object Map]',
     setTag = '[object Set]';
 
 /** Used for built-in method references. */
-var objectProto = Object.prototype;
+var objectProto$1 = Object.prototype;
 
 /** Used to check objects for own properties. */
-var hasOwnProperty = objectProto.hasOwnProperty;
+var hasOwnProperty$1 = objectProto$1.hasOwnProperty;
 
 /**
  * Checks if `value` is an empty object, collection, map, or set.
@@ -187382,7 +187572,7 @@ function isEmpty(value) {
     return !baseKeys(value).length;
   }
   for (var key in value) {
-    if (hasOwnProperty.call(value, key)) {
+    if (hasOwnProperty$1.call(value, key)) {
       return false;
     }
   }
@@ -187606,6 +187796,12 @@ var merge = createAssigner(function(object, source, srcIndex) {
   baseMerge(object, source, srcIndex);
 });
 
+/** Used for built-in method references. */
+var objectProto = Object.prototype;
+
+/** Used to check objects for own properties. */
+var hasOwnProperty = objectProto.hasOwnProperty;
+
 /**
  * The base implementation of `_.unset`.
  *
@@ -187616,8 +187812,34 @@ var merge = createAssigner(function(object, source, srcIndex) {
  */
 function baseUnset(object, path) {
   path = castPath(path, object);
-  object = parent$1(object, path);
-  return object == null || delete object[toKey(last(path))];
+
+  // Prevent prototype pollution:
+  // https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
+  // https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
+  var index = -1,
+      length = path.length;
+
+  if (!length) {
+    return true;
+  }
+
+  while (++index < length) {
+    var key = toKey(path[index]);
+
+    // Always block "__proto__" anywhere in the path if it's not expected
+    if (key === '__proto__' && !hasOwnProperty.call(object, '__proto__')) {
+      return false;
+    }
+
+    // Block constructor/prototype as non-terminal traversal keys to prevent
+    // escaping the object graph into built-in constructors and prototypes.
+    if ((key === 'constructor' || key === 'prototype') && index < length - 1) {
+      return false;
+    }
+  }
+
+  var obj = parent$1(object, path);
+  return obj == null || delete obj[toKey(last(path))];
 }
 
 /**
@@ -188377,6 +188599,13 @@ function requireDom () {
 	 * used for attributes or DocumentType entities
 	 */
 	function NamedNodeMap() {
+		// nodeName -> Attr membership index; lets the parse-time de-duplication in
+		// setNamedItem resolve an existing attribute in O(1) instead of scanning the
+		// list, so building an element with M attributes costs O(M) rather than O(M^2).
+		// The numbered entries and length remain the sole authority for attribute order.
+		// Object.create(null) so an attribute named __proto__ or constructor is an
+		// ordinary key.
+		this._nameIndex = Object.create(null);
 	}
 	function _findNodeIndex(list,node){
 		var i = list.length;
@@ -188385,12 +188614,27 @@ function requireDom () {
 		}
 	}
 
+	function _nnmIndexAdd(list, attr) {
+		list._nameIndex[attr.nodeName] = attr;
+	}
+	function _nnmIndexRemove(list, attr) {
+		// Only drop the entry if it still points at this attribute; a replacement with
+		// a different nodeName may already have re-keyed it.
+		if (list._nameIndex[attr.nodeName] === attr) {
+			delete list._nameIndex[attr.nodeName];
+		}
+	}
+
 	function _addNamedNode(el,list,newAttr,oldAttr){
 		if(oldAttr){
 			list[_findNodeIndex(list,oldAttr)] = newAttr;
+			// oldAttr leaves the list; drop its index entry (its nodeName may differ
+			// from newAttr's when the replacement came via setNamedItemNS).
+			_nnmIndexRemove(list, oldAttr);
 		}else {
 			list[list.length++] = newAttr;
 		}
+		_nnmIndexAdd(list, newAttr);
 		if(el){
 			newAttr.ownerElement = el;
 			var doc = el.ownerDocument;
@@ -188409,6 +188653,7 @@ function requireDom () {
 				list[i] = list[++i];
 			}
 			list.length = lastIndex;
+			_nnmIndexRemove(list, attr);
 			if(el){
 				var doc = el.ownerDocument;
 				if(doc){
@@ -188442,7 +188687,11 @@ function requireDom () {
 			if(el && el!=this._ownerElement){
 				throw new DOMException(INUSE_ATTRIBUTE_ERR);
 			}
-			var oldAttr = this.getNamedItem(attr.nodeName);
+			// Resolve any existing attribute with the same nodeName through the O(1)
+			// membership index rather than an O(M) scan — this is the parse-dedup hot
+			// path (setAttributeNode per attribute during parse). Absent -> undefined,
+			// matching getNamedItem's contract.
+			var oldAttr = this._nameIndex[attr.nodeName];
 			_addNamedNode(this._ownerElement,this,attr,oldAttr);
 			return oldAttr;
 		},
@@ -188675,9 +188924,38 @@ function requireDom () {
 					while (child) {
 						var next = child.nextSibling;
 						if (next !== null && next.nodeType === TEXT_NODE && child.nodeType === TEXT_NODE) {
-							node.removeChild(next);
-							child.appendData(next.data);
-							// Do not advance child: re-check new nextSibling for another text run
+							// Merge the whole run of adjacent text nodes at once: gather the
+							// following text siblings' data, unlink them in a single pass, and
+							// re-index the child list a single time. Per-sibling `removeChild`
+							// (each an O(K) re-index) plus per-sibling `appendData` (each an O(K)
+							// string rebuild) is O(K^2) over a long run of single-character text
+							// nodes; this keeps it O(K). The first text node of the run survives
+							// and carries the concatenated data, preserving node identity and
+							// locator semantics.
+							var tail = [];
+							var sibling = next;
+							while (sibling !== null && sibling.nodeType === TEXT_NODE) {
+								tail.push(sibling.data);
+								sibling = sibling.nextSibling;
+							}
+							// `sibling` is now the first non-text node after the run, or null.
+							var removed = child.nextSibling;
+							while (removed !== sibling) {
+								var following = removed.nextSibling;
+								removed.parentNode = null;
+								removed.previousSibling = null;
+								removed.nextSibling = null;
+								removed = following;
+							}
+							child.nextSibling = sibling;
+							if (sibling !== null) {
+								sibling.previousSibling = child;
+							} else {
+								node.lastChild = child;
+							}
+							child.appendData(tail.join('')); // single O(K) string rebuild
+							_onUpdateChild(node.ownerDocument, node); // single O(K) re-index
+							child = sibling;
 						} else {
 							child = next;
 						}
@@ -189488,8 +189766,10 @@ function requireDom () {
 		 * - it does not do any input validation on the arguments and doesn't throw "InvalidCharacterError".
 		 *
 		 * Note: When the resulting document is serialized with `requireWellFormed: true`, the
-		 * serializer throws with code `INVALID_STATE_ERR` if `.data` contains `?>` (W3C DOM Parsing
-		 * §3.2.1.7). Without that option the data is emitted verbatim.
+		 * serializer throws with code `INVALID_STATE_ERR` if `.target` is not a valid XML `NCName`
+		 * (a `Name` with no colon) or is an ASCII case-insensitive match for `"xml"`, or if `.data`
+		 * contains `?>` (W3C DOM Parsing §3.2.1.7). Without that option the target and data are
+		 * emitted verbatim.
 		 *
 		 * @param {string} target
 		 * @param {string} data
@@ -189514,7 +189794,27 @@ function requireDom () {
 			node.specified = true;
 			return node;
 		},
+		/**
+		 * Creates an EntityReference object, serialized as `&name;`.
+		 *
+		 * The `name` is validated against the XML `Name` production at creation time; an invalid name
+		 * throws a `DOMException` with code `INVALID_CHARACTER_ERR`. When the resulting node is
+		 * serialized with `requireWellFormed: true`, the serializer re-validates `nodeName` and throws
+		 * a `DOMException` with code `INVALID_STATE_ERR` if a later `nodeName` mutation made it invalid;
+		 * without that option the name is emitted verbatim.
+		 *
+		 * Note: xmldom does not expand entities — the parser resolves entity references inline and never
+		 * constructs `EntityReference` nodes, so this method is the only producer.
+		 *
+		 * @param {string} name The name of the entity to reference.
+		 * @returns {EntityReference}
+		 * @throws {DOMException} With code `INVALID_CHARACTER_ERR` when `name` is not a valid XML `Name`.
+		 * @see https://www.w3.org/TR/DOM-Level-3-Core/core.html#ID-392B75AE
+		 */
 		createEntityReference :	function(name){
+			if (!tagNamePattern.test(name)) {
+				throw new DOMException(INVALID_CHARACTER_ERR, 'not a valid xml name "' + name + '"');
+			}
 			var node = new EntityReference();
 			node.ownerDocument	= this;
 			node.nodeName	= name;
@@ -189726,15 +190026,16 @@ function requireDom () {
 	/**
 	 * Represents a DocumentType node (the `<!DOCTYPE ...>` declaration).
 	 *
-	 * `publicId`, `systemId`, and `internalSubset` are plain own-property assignments.
+	 * `name`, `publicId`, `systemId`, and `internalSubset` are plain own-property assignments.
 	 * xmldom does not enforce the `readonly` constraint declared by the WHATWG DOM spec —
 	 * direct property writes succeed silently. Values are serialized verbatim when
 	 * `requireWellFormed` is false (the default). When the serializer is invoked with
 	 * `requireWellFormed: true` (via the 4th-parameter options object), it validates each
-	 * field and throws `DOMException` with code `INVALID_STATE_ERR` on invalid values.
+	 * field — including `name`, which is checked against the XML `Name` production — and throws
+	 * `DOMException` with code `INVALID_STATE_ERR` on invalid values.
 	 *
 	 * @class
-	 * @see https://developer.mozilla.org/en-US/docs/Web/API/DocumentType MDN
+	 * @see https://developer.mozilla.org/docs/Web/API/DocumentType MDN
 	 */
 	function DocumentType() {
 	}	DocumentType.prototype.nodeType = DOCUMENT_TYPE_NODE;
@@ -189748,6 +190049,20 @@ function requireDom () {
 	}	Entity.prototype.nodeType = ENTITY_NODE;
 	_extends(Entity,Node);
 
+	/**
+	 * Represents an EntityReference node, serialized as `&nodeName;`.
+	 *
+	 * `nodeName` is the referenced entity's name, stored verbatim. When serialized with
+	 * `requireWellFormed: true`, the serializer validates `nodeName` against the XML `Name` production
+	 * and throws a `DOMException` with code `INVALID_STATE_ERR` if it does not match; without that
+	 * option the name is emitted verbatim between `&` and `;`.
+	 *
+	 * Note: xmldom does not expand entities — the parser resolves entity references inline and never
+	 * constructs `EntityReference` nodes, so the only producer is `Document.createEntityReference`.
+	 *
+	 * @class
+	 * @see https://www.w3.org/TR/xml/#NT-Name
+	 */
 	function EntityReference() {
 	}	EntityReference.prototype.nodeType = ENTITY_REFERENCE_NODE;
 	_extends(EntityReference,Node);
@@ -189790,12 +190105,15 @@ function requireDom () {
 	 *   not a valid XML QName,
 	 * - a CDATASection node's data contains `"]]>"`,
 	 * - a Comment node's data contains `"-->"` (bare `"--"` does not throw on this branch),
-	 * - a ProcessingInstruction's data contains `"?>"`,
+	 * - a ProcessingInstruction's target is not a valid XML `NCName` (a `Name` with no colon) or is
+	 *   an ASCII case-insensitive match for `"xml"`, or its data contains `"?>"`,
+	 * - a DocumentType's `name` is not a valid XML `Name` (XML 1.0 production [5]),
 	 * - a DocumentType's `publicId` is non-empty and does not match the XML `PubidLiteral`
 	 *   production,
 	 * - a DocumentType's `systemId` is non-empty and does not match the XML `SystemLiteral`
-	 *   production, or
-	 * - a DocumentType's `internalSubset` contains `"]>"`.
+	 *   production,
+	 * - a DocumentType's `internalSubset` contains `"]>"`, or
+	 * - an EntityReference's `nodeName` is not a valid XML `Name` (XML 1.0 production [5]).
 	 * Note: xmldom does not enforce `readonly` on DocumentType fields — direct property
 	 * writes succeed and are covered by the serializer-level checks above.
 	 * @see https://html.spec.whatwg.org/#dom-xmlserializer-serializetostring
@@ -190050,6 +190368,9 @@ function requireDom () {
 
 					case DOCUMENT_TYPE_NODE:
 						if (requireWellFormed) {
+							if (!tagNamePattern.test(n.name)) {
+								throw new DOMException(INVALID_STATE_ERR, 'The doctype name "' + n.name + '" is not a valid XML Name');
+							}
 							if (n.publicId && !/^("[\x20\r\na-zA-Z0-9\-()+,.\/:=?;!*#@$_%']*"|'[\x20\r\na-zA-Z0-9\-()+,.\/:=?;!*#@$_%'"]*')$/.test(n.publicId)) {
 								throw new DOMException(INVALID_STATE_ERR, 'DocumentType publicId is not a valid PubidLiteral');
 							}
@@ -190081,13 +190402,27 @@ function requireDom () {
 						return null;
 
 					case PROCESSING_INSTRUCTION_NODE:
-						if (requireWellFormed && n.data.indexOf('?>') !== -1) {
-							throw new DOMException(INVALID_STATE_ERR, 'The ProcessingInstruction data contains "?>"');
+						if (requireWellFormed) {
+							if (!tagNamePattern.test(n.target) || n.target.indexOf(':') !== -1 || n.target.toLowerCase() === 'xml') {
+								throw new DOMException(
+									INVALID_STATE_ERR,
+									'The processing instruction target "' + n.target + '" is not a valid XML NCName or is reserved'
+								);
+							}
+							if (n.data.indexOf('?>') !== -1) {
+								throw new DOMException(INVALID_STATE_ERR, 'The ProcessingInstruction data contains "?>"');
+							}
 						}
 						buf.push('<?', n.target, ' ', n.data, '?>');
 						return null;
 
 					case ENTITY_REFERENCE_NODE:
+						if (requireWellFormed && !tagNamePattern.test(n.nodeName)) {
+							throw new DOMException(
+								INVALID_STATE_ERR,
+								'The entity reference name "' + n.nodeName + '" is not a valid XML Name'
+							);
+						}
 						buf.push('&', n.nodeName, ';');
 						return null;
 
@@ -192580,7 +192915,13 @@ function requireSax () {
 				switch(source.charAt(tagStart+1)){
 				case '/':
 					var end = source.indexOf('>',tagStart+3);
-					var tagName = source.substring(tagStart + 2, end).replace(/[ \t\n\r]+$/g, '');
+					// Anchored trailing-whitespace trim. The former `/[ \t\n\r]+$/g` backtracked
+					// quadratically on a name shaped `whitespace-run + non-whitespace char`
+					// (an end tag `</   …   x>`): from every start position it extended `[ws]+`
+					// to the end and then failed the `$` anchor. This anchored form matches the
+					// whole string once and captures everything up to the last non-whitespace
+					// character, so it trims in linear time with byte-identical output.
+					var tagName = source.substring(tagStart + 2, end).replace(/^([\s\S]*?[^ \t\n\r])?[ \t\n\r]*$/, '$1');
 					var config = parseStack.pop();
 					if(end<0){
 
@@ -192591,6 +192932,14 @@ function requireSax () {
 		        		tagName = tagName.replace(/[\s<].*/,'');
 		        		errorHandler.error("end tag name: "+tagName+' maybe not complete');
 		        		end = tagStart+1+tagName.length;
+					}else if(/[ \t\n\r]/.test(tagName) && tagNamePattern.test(tagName.split(/[ \t\n\r]/)[0])){
+						// The XML `ETag` production is `'</' Name S? '>'`: only optional whitespace may follow
+						// the `Name`. A valid `Name` followed by whitespace and non-whitespace residue (e.g.
+						// `</a\nbogus>` or `</a bogus>`) is not well-formed, but historically it was silently
+						// accepted (the malformed end tag ignored, the residue dropped, the element left on the
+						// stack). Report it as a recoverable `error` (which a custom errorHandler may escalate to
+						// fatal) while keeping the existing recovery so the parsed DOM stays byte-identical.
+						errorHandler.error('end tag name is followed by whitespace and trailing content: "'+tagName+'"');
 					}
 					var localNSMap = config.localNSMap;
 					var endMatch = config.tagName == tagName;
@@ -192714,6 +193063,15 @@ function requireSax () {
 		var s = S_TAG;//status
 		while(true){
 			var c = source.charAt(p);
+			if (s === S_TAG && c === '<') {
+				// A `<` can never occur inside a tag name. Without this guard the scan runs
+				// on to the next `>` (or EOF) before the tag name is rejected, so a document
+				// with many `<` inside a malformed tag makes each one-character recovery step
+				// re-scan to the distant `>` — O(n^2). Stopping at the `<` keeps each recovery
+				// step bounded. The candidate scanned so far is reported raw, consistent with
+				// the sibling invalid-tag-name throw below.
+				throw new Error('unexpected < in tag name: ' + source.slice(start, p));
+			}
 			switch(c){
 			case '=':
 				if(s === S_ATTR){//attrName
@@ -192906,9 +193264,13 @@ function requireSax () {
 			if(nsPrefix !== false){//hack!!
 				if(localNSMap == null){
 					localNSMap = {};
-					//console.log(currentNSMap,0)
-					_copy(currentNSMap,currentNSMap={});
-					//console.log(currentNSMap,1)
+					// Derive the child scope's namespace map by prototype-chain inheritance
+					// instead of a flat copy: lookups inherit ancestor prefixes transparently,
+					// so a document nesting N scopes retains O(N) map entries rather than
+					// sum(1..N) = O(N^2). localNSMap stays a flat own-only record of the
+					// prefixes declared at THIS element, so own-property enumeration
+					// (endPrefixMapping below) still reports only local declarations.
+					currentNSMap = Object.create(currentNSMap);
 				}
 				currentNSMap[nsPrefix] = localNSMap[nsPrefix] = value;
 				a.uri = NAMESPACE.XMLNS;
@@ -204021,13 +204383,13 @@ const FIRST_TIME_WATCH = {};
 Object.freeze(FIRST_TIME_WATCH);
 const arrayConsumer = (listenerFn, restExpr, newVal, oldVal) => {
     let data = newVal, formattedData;
-    if (isArray(data)) {
+    if (_.isArray(data)) {
         formattedData = data.map(function (datum) {
             return findValueOf(datum, restExpr);
         });
         // If resulting structure is an array of array, flatten it
-        if (isArray(formattedData[0])) {
-            formattedData = flatten(formattedData);
+        if (_.isArray(formattedData[0])) {
+            formattedData = _.flatten(formattedData);
         }
         listenerFn(formattedData, oldVal);
     }
@@ -204072,6 +204434,19 @@ const $watch = (expr, $scope, $locals, listener, identifier = watchIdGenerator.n
 };
 const $unwatch = identifier => registry.delete(identifier);
 window.watchRegistry = registry;
+window.__WM_DEBUG_WATCHERS__ = false;
+/*export const $invokeWatchers = (force?: boolean, ignoreMuted?: boolean) => {
+    if (force) {
+        triggerWatchers(ignoreMuted);
+    } else {
+
+        if (skipWatchers) {
+            skipWatchers = false;
+            return;
+        }
+        debouncedTriggerWatchers();
+    }
+};*/
 const $appDigest = (() => {
     return (force) => {
         {
@@ -204134,6 +204509,8 @@ var Operation;
 const DataSource = {
     Operation
 };
+class App {
+}
 class AbstractI18nService {
 }
 
@@ -204151,6 +204528,7 @@ const REGEX = {
     SUPPORTED_AUDIO_FORMAT: /\.(mp3|ogg|webm|wma|3gp|wav|m4a)$/i,
     SUPPORTED_VIDEO_FORMAT: /\.(mp4|ogg|webm|wmv|mpeg|mpg|avi|mov)$/i,
     VALID_WEB_URL: /^(http[s]?:\/\/)(www\.){0,1}[a-zA-Z0-9=:?\/\.\-]+(\.[a-zA-Z]{2,5}[\.]{0,1})?/,
+    VALID_IMAGE_URL: /^(https?|blob|data|file|ftp):/i,
     REPLACE_PATTERN: /\$\{([^\}]+)\}/g,
     DATA_URL: /^\s*data:([a-z]+\/[a-z0-9-+.]+(;[a-z-]+=[a-z0-9-]+)?)?(;base64)?,([a-z0-9!$&',()*+;=\-._~:@\/?%\s]*)\s*$/i,
     ISO_DATE_FORMAT: /(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2}:\d{2})(\.\d+)?([+-]\d{2}:?\d{2}|Z)$/
@@ -204373,6 +204751,9 @@ const isVideoFile = (fileName) => {
 const isValidWebURL = (url) => {
     return (REGEX.VALID_WEB_URL).test(url);
 };
+const isValidImageUrl = (url) => {
+    return (REGEX.VALID_IMAGE_URL).test(url?.trim());
+};
 /*This function returns the url to the resource after checking the validity of url*/
 const getResourceURL = (urlString) => {
     return urlString;
@@ -205626,6 +206007,7 @@ var Utils = /*#__PURE__*/Object.freeze({
     isPageable: isPageable,
     isSafari: isSafari,
     isTablet: isTablet,
+    isValidImageUrl: isValidImageUrl,
     isValidWebURL: isValidWebURL,
     isVideoFile: isVideoFile,
     loadScript: loadScript,
@@ -208465,7 +208847,7 @@ class PipeProvider {
             this.preparePipeMeta(CurrencyPipe$1, 'currency', true, [this._locale]),
             this.preparePipeMeta(DatePipe$1, 'date', true, [this._locale]),
             this.preparePipeMeta(ToDatePipe, 'toDate', true, [
-                new DatePipe$1(this._locale), undefined, this.injector.get(CustomPipeManager)
+                new DatePipe$1(this._locale), undefined, this.injector.get(App), this.injector.get(CustomPipeManager)
             ]),
             this.preparePipeMeta(ToNumberPipe, 'toNumber', true, [
                 new DecimalPipe$1(this._locale),
@@ -208482,7 +208864,7 @@ class PipeProvider {
                 new DecimalPipe$1(this._locale)
             ]),
             this.preparePipeMeta(StringToNumberPipe, 'stringToNumber', true),
-            this.preparePipeMeta(CustomPipe, 'custom', true, [this.injector.get(CustomPipeManager)]),
+            this.preparePipeMeta(CustomPipe, 'custom', true, [this.injector.get(App), this.injector.get(CustomPipeManager)]),
             this.preparePipeMeta(TrustAsPipe, 'trustAs', true, [this.domSanitizer]),
             this.preparePipeMeta(SanitizePipe, 'sanitize', true, [this.domSanitizer]),
             this.preparePipeMeta(TemplateReplacePipe, 'templateReplace', true),