forked from boos/BoosAPI
3195282c4e
- Escape modelName/siteName in innerHTML to prevent XSS - Use content-based routePatternsKey for cache invalidation instead of length-only keys that miss content changes - Extract shared baseFilteredRoutes to eliminate duplicated filter logic between enabledCounts and filteredRoutes - Add candidatesPromiseRef to deduplicate concurrent loadCandidates calls