ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor (CVE-2026-49208) | HOL Guard CVE