@@ -13,6 +13,8 @@ subscribers:
 settings:
   auto-labeler:
     sync_labels: true
+    sync_exempt:
+      - enhancement
     rules:
       - label: '4.8' # @todo change value whenever the next minor version is changed
         base_branch: ['^4\.8$']
@@ -66,7 +68,7 @@ settings:
   pr-title-linter:
     name: 'Carson / pr-title-linter'
     rules:
-      - pattern: '^(\[\d+\.\d+\]\s{1})?(feat|fix|chore|docs|perf|refactor|style|test|config|revert)(\([\-.@:`a-zA-Z0-9]+\))?!?:\s{1}\S.+\S|Prep for \d\.\d\.\d release|\d\.\d\.\d (Ready|Merge) code$'
+      - pattern: '^(?:(?:\[\d+\.\d+\] )?(?:feat|fix|chore|docs|perf|refactor|style|test|config|revert)(?:\([\-.@:`a-zA-Z0-9]+\))?!?: \S.+\S|Prep for \d+\.\d+\.\d+ release|\d+\.\d+\.\d+ (?:Ready|Merge) code)$'
         description: 'PR title must include the type (feat, fix, chore, docs, perf, refactor, style, test, config, revert) of the commit per Conventional Commits specification. See https://www.conventionalcommits.org/en/v1.0.0/ for the discussion.'
         level: error
   signed-commits:
 
@@ -28,6 +28,7 @@ permissions: {}
 
 jobs:
   carson:
+    if: github.repository == 'codeigniter4/CodeIgniter4'
     runs-on: ubuntu-24.04
     steps:
       - name: Run Carson
 
@@ -26,6 +26,12 @@ of time that a page should remain cached before being refreshed.
     request is also taken into account. This means that the same URI will be
     cached separately if the HTTP method is different.
 
+.. warning:: Web Page Caching is shared between requests with the same HTTP
+    method and URI. Its cache key does not vary by authenticated user, cookies,
+    authorization headers, ``Cache-Control``, or ``Vary``. Do not use it for
+    protected or personalized responses, as cached responses may be returned
+    before authentication and authorization filters run.
+
 When a page is loaded for the first time, the page will be cached using the
 currently configured cache engine. On subsequent page loads, the cache
 will be retrieved and sent to the requesting user's browser.
 
@@ -320,16 +320,25 @@ In this case, you will write code in your template::
 Escaping Data
 =============
 
-By default, all variable substitution is escaped to help prevent XSS attacks on your pages. CodeIgniter's ``esc()`` method
-supports several different contexts, like general ``html``, when it's in an HTML ``attr``, in ``css``, etc. If nothing
-else is specified, the data will be assumed to be in an HTML context. You can specify the context used by using the ``esc()``
-filter::
+Variable substitutions without filters are escaped by default to help prevent XSS attacks on your pages.
+CodeIgniter's ``esc()`` method supports several contexts, such as ``html``, ``attr``, and ``css``.
+If no context is specified, the Parser uses ``html``. You can specify the context with the ``esc`` filter::
 
     { user_styles | esc(css) }
     <a href="{ user_link | esc(attr) }">{ title }</a>
 
-There will be times when you absolutely need something to used and NOT escaped. You can do this by adding exclamation
-marks to the opening and closing braces::
+When a substitution uses one or more filters, the Parser does not add an ``esc`` filter automatically.
+This also applies when a context is specified with ``setData()`` or ``setVar()``.
+Add ``esc`` explicitly when filtering untrusted data. Filters run from left to right, so its position matters::
+
+    { title|capitalize|esc }
+    { body|esc|nl2br }
+
+In the second example, ``esc`` escapes the input before ``nl2br`` adds HTML ``<br>`` tags.
+Escaping after ``nl2br`` would display those tags as text.
+Unknown filter names are ignored, but still prevent automatic escaping; check filter names carefully.
+
+To disable automatic escaping for a substitution without filters, add exclamation marks to its delimiters::
 
     {! unescaped_var !}