RS-22478: fix stored XSS in palm tree tooltips

HTML-escape row/column names and label text built into tooltip content
(covers both the tooltip render and its size measurement). Rebuilt the
inst/htmlwidgets bundle.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: chschan

inst/htmlwidgets/rhtmlPalmTrees.js

@@ -1,4 +1,14 @@
 import _ from 'lodash'
+
+function escapeHtml (value) {
+  return String(value)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;')
+}
+
 // tip depends on
 // this.settings.tooltipsHeadingFontFamily
 // this.settings.tooltipsHeadingFontSize
@@ -45,7 +55,7 @@ function makeTipContent ({
     })
   }).join('\n')
 
-  let headingText = `${rowName}${(_.isEmpty(yLabel) ? '' : ` - ${yLabel}`)} ${rowTotal}`
+  let headingText = `${escapeHtml(rowName)}${(_.isEmpty(yLabel) ? '' : ` - ${escapeHtml(yLabel)}`)} ${rowTotal}`
   return `<div class="tipHeading tip-${rowIndex}" style="font-family:${headingFontFamily};font-size:${headingFontSize}px">${headingText}</div>
     <div class="tipTableContainer">
       <table class="tipTable">
@@ -70,8 +80,8 @@ function makeTipContentRow ({
   unselectedColor,
 }) {
   return `<tr class="tip-column tip-column-${columnIndex} ${(valueEnabled) ? '' : 'column-off"'}">
-    <td style="text-align:right;font-family:${fontFamily};font-size:${fontSize}px">${prefix || ''}${value || ''}${suffix || ''}</td>
-    <td style="text-align:left;font-family:${fontFamily};font-size:${fontSize}px">${name}</td>
+    <td style="text-align:right;font-family:${fontFamily};font-size:${fontSize}px">${prefix ? escapeHtml(prefix) : ''}${value || ''}${suffix ? escapeHtml(suffix) : ''}</td>
+    <td style="text-align:left;font-family:${fontFamily};font-size:${fontSize}px">${escapeHtml(name)}</td>
     <td style="text-align:center">
       <div style="width:${barWidth}px;height:8px;background-color:${(valueEnabled) ? barColor : unselectedColor}"></div>
     </td>