- Sanitize geocode suggestion rendering to prevent XSS - Add lat/lon validation and cache eviction to weather proxy endpoints - Extract shared fetchWithRetry helper, dedupe retry/timeout logic - Stop leaking upstream error details to clients - Fix radar provider metadata and drop dead nowcast field - Fix missing --surface-radius-sm var and duplicate/conflicting CSS rules