[kevindb]

Phase 10 of docs/plans/modernization.md: the public part of the security and bug fixes.

Review findings (docs/research/security-review.md)

• Finding 4: the Rails CSRF token is added only to same-origin iframe uploads.
• Finding 6: controls named like form members (elements, setAttribute, removeAttribute, action) no longer break formToArray or the iframe transport. The clk expandos stay on the form until 5.x.
• Finding 7: hasOwnProperty is called through the prototype. This clears the three no-prototype-builtins warnings, and the rule is now an error.
• Finding 8: clicks on orphan submit controls no longer throw. Fragment-only actions and hashed GET urls keep the form data. data: {} no longer adds an empty FormData field, and FormData uploads honor the global traditional setting.

Issues

• <button> elements with no "type" don't send their value on submit #588: a <button> without a type attribute is captured as the submitter.
• TagName in Element Undefined #600: resetForm, clearFields, fieldValue and selected accept nodes without a tag name.
• Enable AND disable the consistent-this rule #553: dist/ no longer ships /* eslint */ or /* global */ comments.

Iframe transport (docs/research/coverage-findings.md)

• An emulated 2xx status no longer turns a parser error into success.
• An abort completes the upload once, rejects the returned Deferred, and fires ajaxComplete and ajaxStop.

Verification

• 7 it.fails records are now it, and every fix has new tests.
• Coverage stays at 100%. The jQuery 1.7.2, 3.7.1 and 4.0.0 matrix passes locally.
• A local CodeQL run reports the same 3 alerts as main.
• Consumer-visible changes are in docs/research/4x-behavior-changes.md, and the Phase 10 column is in docs/metrics.md. The CI and CodeQL cells are filled in after this PR's run.

The label lookup record and #597 land with the remaining Phase 10 items on release day.

🤖 Generated with Claude Code