fix: preserve raw option values with secure text

[oiahoon]

Issue number: resolves #455

---

What is the current behavior?

When enableSecureText is enabled, option values are converted to HTML entities while options are prepared. A later dataset update preserves that entity string, so selecting a value such as < writes ["<"] to the hidden form input.

What is the new behavior?

• keep option values in their original form for selection, API, and form submission
• escape values only when interpolating them into option HTML attributes
• preserve secure label rendering and attribute-injection protection
• cover existing and dynamically added values with Cypress regression tests

Does this introduce a breaking change?

• Yes
• No

Other information

• npm run build
• npm run validate
• complete Cypress suite: 237 passing tests across 8 specs
• npm pack --dry-run
• browser verification on desktop and 390x844: hidden input contains ["<"], label renders as text, no injected image, no horizontal overflow, and no console errors

[Copilot]

Pull request overview

Fixes an encoding bug when enableSecureText is enabled by preserving raw option values for selection/API/form submission while escaping values only at HTML attribute interpolation time (preventing attribute-breakout injection).

Changes:

• Store option value in its original (raw) form during option preparation and when creating/updating “new” options.
• Escape data-value only when generating option HTML, keeping attribute-injection protection while avoiding double-encoding in state/dataset updates.
• Add Cypress regression coverage for existing unsafe-character values and dynamically added (new) values; update dist/docs bundles accordingly.

Reviewed changes

Copilot reviewed 3 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/virtual-select.js	Keeps raw values in option data, escapes only when interpolating data-value into HTML.
dist/virtual-select.js	Built bundle update reflecting the raw-value + attribute-escape behavior.
dist/virtual-select.min.js	Minified bundle update reflecting the same behavior.
docs/assets/virtual-select.js	Docs bundle update reflecting the raw-value + attribute-escape behavior.
docs/assets/virtual-select.min.js	Minified docs bundle update reflecting the same behavior.
cypress/e2e/secure-option-values.cy.ts	Cypress regression tests for raw hidden-input values and XSS-safe rendering.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.