Problem
lib/components/menu.ex LiveView example (lines 198-199) shows push_navigate(socket, to: value) with no URL validation, while client-side redirect is now guarded.
Proposed fix
Update example to validate value (e.g. must start with /, reject //, reject schemes) or point to VerifiedRoutes / an allowlist helper. Mirror pattern in listbox/combobox/tree-view docs if they show the same anti-pattern.
Problem
lib/components/menu.ex LiveView example (lines 198-199) shows push_navigate(socket, to: value) with no URL validation, while client-side redirect is now guarded.
Proposed fix
Update example to validate value (e.g. must start with /, reject //, reject schemes) or point to VerifiedRoutes / an allowlist helper. Mirror pattern in listbox/combobox/tree-view docs if they show the same anti-pattern.