fix(packages): escape HTML special chars in serializeAttributes to prevent XSS (#1670)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Wesley Luyten <me@wesleyluyten.com>

packages/icons/scripts/build.ts

@@ -72,12 +72,14 @@ function buildRenderModule(icons: { name: string; content: string }[]): string {
   return [
     `const icons = {\n${entries},\n};`,
     ``,
+    `function esc(v) { return String(v).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'); }`,
+    ``,
     `export function renderIcon(name, attrs) {`,
     `  const svg = icons[name];`,
     `  if (!svg) return '';`,
     `  if (!attrs) return svg;`,
     `  const attrStr = Object.entries(attrs)`,
-    `    .map(([k, v]) => \` \${k}="\${v}"\`)`,
+    `    .map(([k, v]) => \` \${k}="\${esc(v)}"\`)`,
     `    .join('');`,
     `  return svg.replace('<svg', \`<svg\${attrStr}\`);`,
     `}`,