Security: Instruction does not escape html

The source of instruction rendering code says it escaped html previously, but it does not escape html.

the file path of the screenshot above `C:\Users\kmfoysal06\Herd\batexpert\wp-content\plugins\secure-custom-fields\includes\acf-field-functions.php` SCF version: latest aka 6.9.1 WP Version: 7.0.1

I am reporting this because my current acf field group from tab broke because its allowing html. and if I remove the tag and use > and < it works perfectly. I am also creating a PR to escape in the mentioned screenshot. please let me know if it helps.

the screenshots of broken and fixed after using > and <
before:

after using > and <

I am including the php import to help for debugging.

add_action( 'acf/include_fields', function() {
	if ( ! function_exists( 'acf_add_local_field_group' ) ) {
		return;
	}

	acf_add_local_field_group( array(
	'key' => 'group_6a5755f7c5bc8',
	'title' => 'tab test',
	'fields' => array(
		array(
			'key' => 'field_6a5755f829a60',
			'label' => 'testsssssssssssss',
			'name' => '',
			'aria-label' => '',
			'type' => 'tab',
			'instructions' => '',
			'required' => 0,
			'conditional_logic' => 0,
			'wrapper' => array(
				'width' => '',
				'class' => '',
				'id' => '',
			),
			'placement' => 'top',
			'endpoint' => 0,
			'selected' => 0,
		),
		array(
			'key' => 'field_6a57560529a61',
			'label' => 'test',
			'name' => 'test',
			'aria-label' => '',
			'type' => 'image',
			'instructions' => 'Keep the complete heading in this field. Optional inline HTML such as <em> or <strong> may be used for emphasis.',
			'required' => 0,
			'conditional_logic' => 0,
			'wrapper' => array(
				'width' => '',
				'class' => '',
				'id' => '',
			),
			'return_format' => 'array',
			'library' => 'all',
			'min_width' => '',
			'min_height' => '',
			'min_size' => '',
			'max_width' => '',
			'max_height' => '',
			'max_size' => '',
			'mime_types' => '',
			'allow_in_bindings' => 0,
			'preview_size' => 'medium',
		),
		array(
			'key' => 'field_6a57560b29a62',
			'label' => 'teset 2',
			'name' => '',
			'aria-label' => '',
			'type' => 'tab',
			'instructions' => '',
			'required' => 0,
			'conditional_logic' => 0,
			'wrapper' => array(
				'width' => '',
				'class' => '',
				'id' => '',
			),
			'placement' => 'top',
			'endpoint' => 0,
			'selected' => 0,
		),
		array(
			'key' => 'field_6a57561429a63',
			'label' => 'test 3',
			'name' => 'test_3',
			'aria-label' => '',
			'type' => 'text',
			'instructions' => '',
			'required' => 0,
			'conditional_logic' => 0,
			'wrapper' => array(
				'width' => '',
				'class' => '',
				'id' => '',
			),
			'default_value' => '',
			'maxlength' => '',
			'allow_in_bindings' => 0,
			'placeholder' => '',
			'prepend' => '',
			'append' => '',
		),
	),
	'location' => array(
		array(
			array(
				'param' => 'post_type',
				'operator' => '==',
				'value' => 'post',
			),
		),
	),
	'menu_order' => 0,
	'position' => 'normal',
	'style' => 'default',
	'label_placement' => 'top',
	'instruction_placement' => 'label',
	'hide_on_screen' => '',
	'active' => true,
	'description' => '',
	'show_in_rest' => 0,
	'display_title' => '',
	'allow_ai_access' => false,
	'ai_description' => '',
) );
} );

Start with the mentioned includes/acf-field-functions.php file and trace the instruction rendering path for the tab and image fields. Reproduce the behavior with the supplied field-group import, comparing raw HTML with > and < entities. Done means HTML in instructions is handled as intended without breaking valid field-group rendering.