unjs unhead

• CVE-2026-39315 Medium 6.1 Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() 0.3%
• CVE-2026-31873 None 0.0 Unhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity 0.2%
• CVE-2026-31860 Medium 5.3 Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check 0.3%