GHSA-hqmv-v56g-4m47: Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers

The source proposes filtering `javascript:` URIs before rendering anchor tags using this function: `const safeUrl = (url: string) => /^javascript:/i.test(url.trim()) ? '#' : url`, then use `<a href={safeUrl(elementDescendant.url as string)} ...>`. Alternatively, the source recommends using a URL allowlist that only permits `https:`, `http:`, `mailto:`, and `tel:` schemes.