[Soham05Hanchate]

Summary

Fixes a small HTML escaping issue in the “Outdated Version” popup.

The app was showing the GitHub release tag inside an HTML-style message without escaping it first. This could allow a specially written release tag to change how the popup looks. The fix escapes the version text before showing it.

Constitution principle honored

Principle VII — boundary input validation.

The release tag comes from GitHub, which is outside the app, so the app should clean it before displaying it.

Test plan

• Local build passes (cmake --build build)
• Behavior verified on a real radio if applicable
• Existing tests pass (CI)
• Reproduction steps documented if user-reported bug

Checklist

• Commits are signed (docs/COMMIT-SIGNING.md)
• No new flat-key AppSettings calls — use nested-JSON-under-one-key
  (Principle V)
• Code is clean-room — not decompiled, disassembled, or
  reverse-engineered from a proprietary binary (Principle IV)
• All meter UI uses MeterSmoother (AGENTS.md convention)
• Documentation updated if user-visible behavior changed — docs/ and the
  affected READMEs. Not CHANGELOG.md, which is a release-prep file a
  PR must not add to (AGENTS.md); describe it in the Summary above instead
• Security-sensitive changes reference a GHSA if applicable

This is my first contribution is open source. If something is not up to the mark then I apologise in advance and would appreciate any feedback

[aethersdr-agent]

Welcome to AetherSDR, @Soham05Hanchate! Thanks for your first pull request.

A few things that might help:

• Our CONTRIBUTING.md covers coding conventions and the PR process
• CI will run automatically — if it fails, I'll post a comment explaining what went wrong
• Jeremy (KK7GWY) reviews all PRs before merge
• Come say hello on the AetherSDR Discord — most of the community hangs out there, and merged contributors get the Contributors role

If you have questions, feel free to ask here or in Discussions.

— AetherClaude (automated agent for AetherSDR)

---

_{🤖 aethersdr-agent · cost: $25.0489 · model: claude-opus-5}

[rfoust]

Thanks for taking the time to spot and address the release-tag escaping issue, @Soham05Hanchate — and welcome to AetherSDR! No need to apologize for a first contribution.

Another PR for the same issue, #6407, was already in progress and has now merged. It covers this popup and the other update prompt, so I’m closing this PR as a duplicate. We appreciate your contribution and hope you’ll come back with more.