… (S3)

Option classNames were concatenated into the class attribute unescaped, so a
consumer-provided value containing a double quote could break out of the attribute
and inject markup/handlers.

Add Utils.sanitizeClassNames() which strips the only characters that can break out
of a double-quoted attribute (" < >). Valid CSS class tokens never contain these,
so legitimate class names are unaffected (covered by a no-regression test).

Adds cypress regression spec security-classnames-xss.cy.ts.

…wrappers (P1)

The window 'resize' listener ran onResizeMethod on every tick, which queried all
.vscomp-ele-wrapper elements and recomputed each instance's options-container
height - O(instances) layout work per resize event during a drag. It also assumed
every wrapper's parent had a .virtualSelect and threw otherwise.

- Add Utils.throttle and wrap the resize listener (~100ms) so the per-instance
  work runs at most ~10x/sec.
- Guard onResizeMethod against wrappers whose instance is missing (teardown races).

Closed instances are still updated (opening does not recompute height, so skipping
them could leave a stale height on reopen) - throttling delivers the win without
that regression risk.

Adds cypress spec perf-resize-throttle.cy.ts (throttling, no-regression, guard).

…ent (S4/P3/P4)

P4: route fire-and-forget setTimeout calls through setManagedTimeout, whose ids are
tracked and cleared in destroy(). Prevents callbacks (e.g. renderOptions, focus)
from running against a destroyed instance.

P3: document the intentional forced reflow in openDropbox so it is not removed as a
no-op.

S4: document that the search-highlight regex relies on enableSecureText for escaping
and is not an additional injection vector (input is already regex-escaped).

Adds cypress spec timer-cleanup.cy.ts.

…ed + document XSS trade-off (S1)

enableSecureText is OFF by default and option label/value are rendered as raw HTML.
Rather than change the default (disruptive, and escaping is costly on large 10k-100k+
datasets), log a single per-page console.warn when options are rendered while
enableSecureText is disabled, so the XSS trade-off is discoverable. The check is O(1)
and never scans option content.

Also documents the trade-off loudly in docs/properties.md (top-of-page callout +
expanded enableSecureText row).

Adds cypress spec secure-text-warning.cy.ts.

Remove an unnecessary ts-expect-error in the timer cleanup test. In Utils.throttle, add JSDoc typings for timeout and lastArgs, initialize lastArgs as an array, annotate the throttled function args, and replace callback.apply(this, lastArgs) with callback(...lastArgs). These changes improve type-safety and simplify the callback invocation.

Add JSDoc type annotations for timeout and throttle args, initialize lastArgs as an array, and replace callback.apply(this, lastArgs) with callback(...lastArgs) to use spread invocation. Updated corresponding minified and docs assets (dist/virtual-select.js, dist/virtual-select.min.js, docs/assets/virtual-select.js, docs/assets/virtual-select.min.js). These changes improve type clarity and simplify argument handling in Utils.throttle.