@artooi/ag-ui-web-component 0.14.0 → 0.14.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/CHANGELOG.md +35 -1
  2. package/dist/ag-ui-web-component.bundle.js +1 -1
  3. package/dist/ag-ui-web-component.bundle.js.map +2 -2
  4. package/dist/index.js +1 -1
  5. package/dist/index.js.map +2 -2
  6. package/dist/ui/render_markdown.d.ts.map +1 -1
  7. package/package.json +3 -3
  8. package/src/ui/render_markdown.ts +10 -0
  9. package/src/version.ts +1 -1
package/dist/ui/render_markdown.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"render_markdown.d.ts","sourceRoot":"","sources":["../../src/ui/render_markdown.ts"],"names":[],"mappings":"AA0DA,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAcpF"}
1
+ {"version":3,"file":"render_markdown.d.ts","sourceRoot":"","sources":["../../src/ui/render_markdown.ts"],"names":[],"mappings":"AAoEA,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAcpF"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@artooi/ag-ui-web-component",
3
- "version": "0.14.0",
3
+ "version": "0.14.1",
4
4
  "description": "Framework-free <ag-ui-chat> Web Component over the AG-UI protocol. Drop-in chat sidebar with a pluggable client-side tool registry, DOM driver primitives, animations, and destructive-action confirmation modal.",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",
@@ -56,7 +56,7 @@
56
56
  "dependencies": {
57
57
  "@ag-ui/client": ">=0.0.54 <0.1",
58
58
  "@ag-ui/core": ">=0.0.54 <0.1",
59
- "dompurify": "^3.4.7",
59
+ "dompurify": "3.4.7",
60
60
  "marked": "^18.0.4"
61
61
  },
62
62
  "devDependencies": {
@@ -64,7 +64,7 @@
64
64
  "@types/node": "^26.1.0",
65
65
  "@vitest/coverage-v8": "^3.0.0",
66
66
  "esbuild": "^0.28.1",
67
- "happy-dom": "^20.8.9",
67
+ "happy-dom": "^20.11.1",
68
68
  "typescript": "^5.7.0",
69
69
  "vitest": "^3.0.0"
70
70
  },
package/src/ui/render_markdown.ts CHANGED
@@ -1,3 +1,13 @@
1
+ // ⚠ ``dompurify`` is pinned at exactly 3.4.7 in package.json — not a caret
2
+ // range. 3.4.8 through at least 3.4.13 mis-sanitise under happy-dom: the
3
+ // sanitiser silently passes ``<script>`` and ``<img>`` straight through, which
4
+ // this module's own tests catch. Verified again 2026-08-07 against happy-dom
5
+ // 20.11.1, so it is not fixed by moving the test DOM forward either.
6
+ //
7
+ // That leaves four open dompurify advisories (three LOW, one MEDIUM) knowingly
8
+ // unpatched. The trade is deliberate: those advisories describe narrow bypasses,
9
+ // while taking them costs *all* sanitisation under the only DOM we can test in.
10
+ // Revisit whenever either project moves; the tests are the acceptance check.
1
11
  import DOMPurify from "dompurify";
2
12
  import { Marked } from "marked";
3
13
 
package/src/version.ts CHANGED
@@ -1 +1 @@
1
- export const VERSION: string = "0.14.0";
1
+ export const VERSION: string = "0.14.1";