From d651cfbe2c00d300429af7594c0e8e95a02f8d6b Mon Sep 17 00:00:00 2001
From: Jared Vititoe <jjvititoe1@gmail.com>
Date: Fri, 27 Mar 2026 14:24:10 -0400
Subject: [PATCH] audit pass 15: type=button on JS createElement and innerHTML
 buttons

- Toast close button: set closeEl.type = 'button' on createElement
- Combobox tag remove button: add type="button" to innerHTML string

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 base.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/base.js b/base.js
index 37c4182..b2affb5 100644
--- a/base.js
+++ b/base.js
@@ -100,6 +100,7 @@
     msgEl.textContent = message;
 
     const closeEl = document.createElement('button');
+    closeEl.type = 'button';
     closeEl.className = 'lt-toast-close';
     closeEl.textContent = '✕';
     closeEl.setAttribute('aria-label', 'Dismiss');
@@ -1901,7 +1902,7 @@
           if (!opt) return;
           const tag = document.createElement('span');
           tag.className = 'lt-combobox-tag';
-          tag.innerHTML = `${escHtml(opt.label)}<button class="lt-combobox-tag-remove" data-value="${escHtml(v)}" aria-label="Remove ${escHtml(opt.label)}">✕</button>`;
+          tag.innerHTML = `${escHtml(opt.label)}<button type="button" class="lt-combobox-tag-remove" data-value="${escHtml(v)}" aria-label="Remove ${escHtml(opt.label)}">✕</button>`;
           inputWrap.insertBefore(tag, inputEl);
         });
       }