- Security fix/Breaking change (Imagelib): Require allowedImageLibOrigins

config array be set with safe origins or otherwise reject `postMessage`
  messages in case from untrusted sources
- Security fix/Breaking change (xdomain): Namespace xdomain file to avoid
  it being used to modify non-xdomain storage
- Security fix (Imagelib): Expose `dropXMLInternalSubset` to extensions
  for preventing billion laughs attack (and use in Imagelib)

editor/extensions/ext-helloworld.js

@@ -32,7 +32,7 @@ export default {
         // Must match the icon ID in helloworld-icon.xml
         id: 'hello_world',
 
-        // Fallback, e.g., for `file://` access
+        // Fallback, e.g., for `file:///` access
         icon: svgEditor.curConfig.extIconsPath + 'helloworld.png',
 
         // This indicates that the button will be added to the "mode"