[helmipradita]

Fixes #7379.

Description

In @std/html, unescape() previously executed three chained replaceAll() passes (named entities, decimal entities, and hex entities). When a string contained an escaped entity such as A or <, the first pass replaced & with &, leaving A or < which was then unintentionally decoded by subsequent passes (e.g. A became A). This broke round-tripping unescape(escape(s)) for strings containing entity-like patterns.

Changes

1. Combined decimal, hex, and named entity patterns into a single regular expression pass (&#([0-9]+);|&#x(\p{AHex}+);|(${namedPatterns})).
2. Replaced matches in a single pass so decoded characters are never re-evaluated as entity tokens.
3. Added unit tests for round-trips and single-pass unescaping without re-evaluation.

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 95.02%. Comparing base (f834d02) to head (c15b607).

Files with missing lines	Patch %	Lines
html/entities.ts	80.00%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7380      +/-   ##
==========================================
- Coverage   95.04%   95.02%   -0.02%     
==========================================
  Files         619      619              
  Lines       52012    51757     -255     
  Branches     9450     9407      -43     
==========================================
- Hits        49434    49183     -251     
+ Misses       2031     2022       -9     
- Partials      547      552       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.