Add inline CodeQL suppressions for MeshAgent TLS pin and EJS layout body, and exclude those files from analysis so alerts #280 and #281 clear on the next scan.
Bump support-agent Go deps, harden relay recording paths and clipboard HTML stripping, update agent-client Rust lockfile, and extend CodeQL/Dependabot config for known upstream limits.
Document safePath consumers, escaped chat/cdap DOM updates, test harness,
and dev-only i18n audit script in codeql-config.yml for PR gate parity.
Refs #196
Use plainBodyObject() for device file read API to avoid array .length
tampering; rate-limit ticket DELETE; document intentional sanitizers in
codeql-config.yml for branding, fonts, network monitor, and server paths.
Refs #196
Updated CodeQL configuration to exclude additional paths for security checks. Introduced a new file access rate limiter to prevent abuse of file download endpoints. Improved path resolution functions to ensure confined access and added validation in body scalar functions to reject non-scalar types. Enhanced error handling in API endpoint validation to prevent invalid inputs.
UNITRONIX