@abgov/jsonforms-components 2.67.6 → 2.67.7

package/index.esm.js

@@ -1,4 +1,3 @@
-import * as runtime from 'react/jsx-runtime';
 import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
 import React, { useContext, useReducer, useMemo, useEffect, createContext, useCallback, useRef, useState, useLayoutEffect } from 'react';
 import { GoabFormItem, GoabDropdown, GoabDropdownItem, GoabInput, GoabTextArea, GoabCallout, GoabRadioGroup, GoabRadioItem, GoabCheckbox, GoabIcon, GoabButton, GoabGrid, GoabIconButton, GoabTable, GoabModal, GoabButtonGroup, GoabContainer, GoabDetails, GoabFormStepper, GoabFormStep, GoabPages, GoabBadge, GoabText, GoabFileUploadInput, GoabCircularProgress, GoabSpinner } from '@abgov/react-components';
@@ -16,7 +15,9 @@ import merge from 'lodash/merge';
 import isEmpty from 'lodash/isEmpty';
 import range from 'lodash/range';
 import pluralize from 'pluralize';
-import { evaluateSync, compileSync } from '@mdx-js/mdx';
+import { compileSync } from '@mdx-js/mdx';
+import ReactMarkdown from 'react-markdown';
+import rehypeSanitize, { defaultSchema } from 'rehype-sanitize';
 import { Parser } from 'expr-eval-fork';
 import addErrors from 'ajv-errors';
 import addFormats from 'ajv-formats';
@@ -13734,13 +13735,24 @@ const RenderLink = props => {
   });
 };
 
-const _excluded$3 = ["isParent", "showLabel"];
+const _excluded$3 = ["node"],
+  _excluded2 = ["isParent", "showLabel"];
 const markdownComponents = {
-  a: props => jsx("a", Object.assign({}, props, {
-    target: "_blank",
-    rel: "noopener noreferrer"
-  }))
+  // Destructure node out (react-markdown internal prop) so it is not forwarded to the DOM element.
+  a: _ref => {
+    let props = _objectWithoutPropertiesLoose(_ref, _excluded$3);
+    return jsx("a", Object.assign({}, props, {
+      target: "_blank",
+      rel: "noopener noreferrer"
+    }));
+  }
 };
+// rehype-sanitize strips dangerous HTML (script tags, event-handler attributes, javascript: hrefs, etc.)
+// from the HAST tree before rendering. defaultSchema allows standard HTML but blocks XSS vectors.
+// Cast required: react-markdown vendors its own copy of unified, causing a type mismatch with the
+// top-level unified package even though the runtime behaviour is identical.
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const rehypePlugins = [[rehypeSanitize, defaultSchema]];
 const HelpContentReviewComponent = () => {
   return jsx(Fragment, {
     children: " "
@@ -13750,7 +13762,11 @@ const checkMarkDownIsValid = markdown => {
   let isValid = true;
   let error = '';
   try {
-    compileSync(markdown, {});
+    // clean-code-ignore: 2.14
+    // to allow testing the compile and catching the error
+    compileSync(markdown, {
+      rehypePlugins: [[rehypeSanitize, defaultSchema]]
+    });
   } catch (err) {
     if (err instanceof Error) {
       error = err.message;
@@ -13768,26 +13784,23 @@ const MarkdownComponent = ({
 }) => {
   const response = checkMarkDownIsValid(markdown);
   if (response.isValid) {
-    const {
-      default: MDXContent
-    } = evaluateSync(markdown, Object.assign({}, runtime, {
-      Fragment: React.Fragment
-    }));
-    return /*#__PURE__*/React.createElement(MDXContent, {
-      components: markdownComponents
+    return jsx(ReactMarkdown, {
+      rehypePlugins: rehypePlugins,
+      components: markdownComponents,
+      children: markdown
     });
   }
   return jsxs(InvalidMarkdown, {
     children: ["Help content markdown is invalid: ", response.error, " "]
   });
 };
-const HelpContentComponent = _ref => {
+const HelpContentComponent = _ref2 => {
   var _uischema$options, _uischema$options$mar, _uischema$options2, _uischema$options3, _uischema$options4, _uischema$options5, _uischema$options6, _uischema$options7, _uischema$options1, _uischema$options10, _uischema$options11, _uischema$options12, _uischema$options13, _uischema$options14, _uischema$options15, _uischema$options16, _uischema$options17, _uischema$elements2, _uischema$options18;
   let {
       isParent = true,
       showLabel = true
-    } = _ref,
-    props = _objectWithoutPropertiesLoose(_ref, _excluded$3);
+    } = _ref2,
+    props = _objectWithoutPropertiesLoose(_ref2, _excluded2);
   const labelClass = isParent ? 'parent-label' : 'child-label';
   const marginClass = isParent ? 'parent-margin' : 'child-margin';
   // eslint-disable-next-line

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abgov/jsonforms-components",
-  "version": "2.67.6",
+  "version": "2.67.7",
   "license": "Apache-2.0",
   "description": "Government of Alberta - React renderers for JSON Forms based on the design system.",
   "repository": "https://github.com/GovAlta/adsp-monorepo",
@@ -17,7 +17,9 @@
     "ajv-formats": "^3.0.1",
     "@mdx-js/mdx": "^3.1.0",
     "expr-eval-fork": "^3.0.1",
-    "pluralize": "^8.0.0"
+    "pluralize": "^8.0.0",
+    "rehype-sanitize": "^6.0.0",
+    "react-markdown": "^8.0.3"
   },
   "dependencies": {
     "axios": "^1.15.2",

package/renderer-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-06-23T21:16:03.119Z",
-  "sourceCommit": "a83b527a2f034d3e3d4699630165799b4f644517",
+  "generatedAt": "2026-06-24T15:43:06.124Z",
+  "sourceCommit": "08d590f507a0d7cc7dfd71287692ce6bc227e6df",
   "sourcePath": "libs/jsonforms-components/src/index.ts",
   "rendererCount": 33,
   "renderers": [

package/src/lib/Additional/HelpContent.d.ts

@@ -1,8 +1,7 @@
 import React from 'react';
 import { RankedTester } from '@jsonforms/core';
 import { ControlProps, ControlElement } from '@jsonforms/core';
-import * as runtime from 'react/jsx-runtime';
-import './HelpContent.css';
+import './HelpContent';
 interface OptionProps {
     ariaLabel?: string;
     help?: string | string[];
@@ -29,7 +28,9 @@ interface MdxMarkdown {
     markdown: string;
 }
 export declare const markdownComponents: {
-    a: (props: React.AnchorHTMLAttributes<HTMLAnchorElement>) => runtime.JSX.Element;
+    a: ({ node, ...props }: React.AnchorHTMLAttributes<HTMLAnchorElement> & {
+        node?: unknown;
+    }) => import("react/jsx-runtime").JSX.Element;
 };
 export declare const MarkdownComponent: ({ markdown }: MdxMarkdown) => JSX.Element;
 export declare const HelpContentComponent: ({ isParent, showLabel, ...props }: CustomControlProps & ExtraHelpContentProps) => JSX.Element;