@artooi/ag-ui-web-component 0.14.0 → 0.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +68 -1
- package/dist/ag-ui-web-component.bundle.js +56 -56
- package/dist/ag-ui-web-component.bundle.js.map +4 -4
- package/dist/index.js +509 -183
- package/dist/index.js.map +4 -4
- package/dist/ui/render_markdown.d.ts.map +1 -1
- package/package.json +5 -3
- package/src/ui/render_markdown.ts +30 -0
- package/src/version.ts +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,71 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [0.15.0] — 2026-08-08
|
|
11
|
+
|
|
12
|
+
### Changed
|
|
13
|
+
|
|
14
|
+
- **Sanitisation is now tested in a real browser.** `vitest.config.ts` defines
|
|
15
|
+
two projects: **happy-dom** for the bulk of the suite, and **Chromium**
|
|
16
|
+
(Playwright) for the tests whose subject is sanitisation. Coverage stays
|
|
17
|
+
unified at 100% across both.
|
|
18
|
+
|
|
19
|
+
⚠ **A correctness requirement, not an optimisation.** DOMPurify 3.4.8+
|
|
20
|
+
silently stops sanitising under happy-dom — `<script>` and `<img>` pass
|
|
21
|
+
straight through, and ordinary markdown loses its `<p>` wrapper. A
|
|
22
|
+
happy-dom-only suite can therefore go green while this component ships no
|
|
23
|
+
sanitisation at all, which is the one failure it must never ship.
|
|
24
|
+
|
|
25
|
+
⭐ **The experiment settles what the pin never could**: dompurify 3.4.13
|
|
26
|
+
sanitises correctly in Chromium. The defect is happy-dom's DOM emulation, not
|
|
27
|
+
a DOMPurify regression — so **consumers were never exposed**, and the risk was
|
|
28
|
+
confined to the test environment the whole time.
|
|
29
|
+
|
|
30
|
+
The browser run also *removes* a workaround instead of carrying it: happy-dom
|
|
31
|
+
eagerly **executed** inline `<script>` while DOMPurify parsed into its scratch
|
|
32
|
+
document, so the suite had to stub `alert`. A real browser parses into an
|
|
33
|
+
inert context.
|
|
34
|
+
|
|
35
|
+
### Security
|
|
36
|
+
|
|
37
|
+
- **`dompurify` is a normal caret range again** (`^3.4.13`), lifting the
|
|
38
|
+
exact-version pin — and with it the **five advisories** that pin was holding
|
|
39
|
+
open (three LOW, two MEDIUM). The browser project is what made that safe, and
|
|
40
|
+
is the standing acceptance check.
|
|
41
|
+
|
|
42
|
+
## [0.14.1] — 2026-08-07
|
|
43
|
+
|
|
44
|
+
### Security
|
|
45
|
+
|
|
46
|
+
- **Five advisories closed**: `vite` → 7.3.6 (HIGH + MEDIUM), `postcss` → 8.5.26
|
|
47
|
+
(HIGH), `brace-expansion` → 2.1.4 (HIGH), `esbuild` → 0.28.1 (LOW). All four
|
|
48
|
+
are transitive, so they are pinned through `overrides` — there is no direct
|
|
49
|
+
dependency to bump.
|
|
50
|
+
|
|
51
|
+
⚠ **`overrides` now live in `pnpm-workspace.yaml`**, not the `pnpm` field in
|
|
52
|
+
`package.json`; pnpm 11 ignores the latter and only warns. And an override
|
|
53
|
+
must be scoped to its major — an unbounded `brace-expansion: ">=2.1.2"`
|
|
54
|
+
resolves to 5.x, whose export shape `minimatch` cannot call, breaking `glob`
|
|
55
|
+
at runtime.
|
|
56
|
+
|
|
57
|
+
- ⛔ **Four `dompurify` advisories are knowingly left open** (three LOW, one
|
|
58
|
+
MEDIUM), and the dependency is now pinned to **exactly `3.4.7`** rather than
|
|
59
|
+
`^3.4.7`.
|
|
60
|
+
|
|
61
|
+
3.4.8 through 3.4.13 **mis-sanitise under happy-dom**: `<script>` and `<img>`
|
|
62
|
+
pass straight through, which `tests/render_markdown.test.ts` catches. Verified
|
|
63
|
+
again against dompurify 3.4.13 with happy-dom 20.11.1 — moving the test DOM
|
|
64
|
+
forward does not fix it.
|
|
65
|
+
|
|
66
|
+
⭐ **The pin was previously a caret range**, so the hold existed only in the
|
|
67
|
+
lockfile and nowhere in the manifest, undocumented — a `pnpm update` would
|
|
68
|
+
have silently disabled sanitisation. It is now exact, explained at the import
|
|
69
|
+
site in `src/ui/render_markdown.ts`, and recorded in `CLAUDE.md`.
|
|
70
|
+
|
|
71
|
+
The trade is deliberate: those advisories describe narrow bypasses, while
|
|
72
|
+
taking them costs *all* sanitisation under the only DOM the suite can run in.
|
|
73
|
+
`tests/render_markdown.test.ts` is the acceptance check for lifting it.
|
|
74
|
+
|
|
10
75
|
## [0.14.0] — 2026-07-28
|
|
11
76
|
|
|
12
77
|
### Added
|
|
@@ -613,7 +678,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
613
678
|
### Notes
|
|
614
679
|
- First release — exercising the automated npm OIDC publish pipeline end-to-end.
|
|
615
680
|
|
|
616
|
-
[Unreleased]: https://github.com/Artui/ag-ui-web-component/compare/v0.
|
|
681
|
+
[Unreleased]: https://github.com/Artui/ag-ui-web-component/compare/v0.15.0...HEAD
|
|
682
|
+
[0.15.0]: https://github.com/Artui/ag-ui-web-component/compare/v0.14.1...v0.15.0
|
|
683
|
+
[0.14.1]: https://github.com/Artui/ag-ui-web-component/compare/v0.14.0...v0.14.1
|
|
617
684
|
[0.14.0]: https://github.com/Artui/ag-ui-web-component/compare/v0.13.0...v0.14.0
|
|
618
685
|
[0.13.0]: https://github.com/Artui/ag-ui-web-component/compare/v0.12.0...v0.13.0
|
|
619
686
|
[0.12.0]: https://github.com/Artui/ag-ui-web-component/compare/v0.11.0...v0.12.0
|