@artooi/ag-ui-web-component 0.14.1 → 0.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +34 -1
- package/dist/ag-ui-web-component.bundle.js +56 -56
- package/dist/ag-ui-web-component.bundle.js.map +4 -4
- package/dist/index.js +509 -183
- package/dist/index.js.map +4 -4
- package/dist/ui/render_markdown.d.ts.map +1 -1
- package/package.json +4 -2
- package/src/ui/render_markdown.ts +29 -9
- package/src/version.ts +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [0.15.0] — 2026-08-08
|
|
11
|
+
|
|
12
|
+
### Changed
|
|
13
|
+
|
|
14
|
+
- **Sanitisation is now tested in a real browser.** `vitest.config.ts` defines
|
|
15
|
+
two projects: **happy-dom** for the bulk of the suite, and **Chromium**
|
|
16
|
+
(Playwright) for the tests whose subject is sanitisation. Coverage stays
|
|
17
|
+
unified at 100% across both.
|
|
18
|
+
|
|
19
|
+
⚠ **A correctness requirement, not an optimisation.** DOMPurify 3.4.8+
|
|
20
|
+
silently stops sanitising under happy-dom — `<script>` and `<img>` pass
|
|
21
|
+
straight through, and ordinary markdown loses its `<p>` wrapper. A
|
|
22
|
+
happy-dom-only suite can therefore go green while this component ships no
|
|
23
|
+
sanitisation at all, which is the one failure it must never ship.
|
|
24
|
+
|
|
25
|
+
⭐ **The experiment settles what the pin never could**: dompurify 3.4.13
|
|
26
|
+
sanitises correctly in Chromium. The defect is happy-dom's DOM emulation, not
|
|
27
|
+
a DOMPurify regression — so **consumers were never exposed**, and the risk was
|
|
28
|
+
confined to the test environment the whole time.
|
|
29
|
+
|
|
30
|
+
The browser run also *removes* a workaround instead of carrying it: happy-dom
|
|
31
|
+
eagerly **executed** inline `<script>` while DOMPurify parsed into its scratch
|
|
32
|
+
document, so the suite had to stub `alert`. A real browser parses into an
|
|
33
|
+
inert context.
|
|
34
|
+
|
|
35
|
+
### Security
|
|
36
|
+
|
|
37
|
+
- **`dompurify` is a normal caret range again** (`^3.4.13`), lifting the
|
|
38
|
+
exact-version pin — and with it the **five advisories** that pin was holding
|
|
39
|
+
open (three LOW, two MEDIUM). The browser project is what made that safe, and
|
|
40
|
+
is the standing acceptance check.
|
|
41
|
+
|
|
10
42
|
## [0.14.1] — 2026-08-07
|
|
11
43
|
|
|
12
44
|
### Security
|
|
@@ -646,7 +678,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
646
678
|
### Notes
|
|
647
679
|
- First release — exercising the automated npm OIDC publish pipeline end-to-end.
|
|
648
680
|
|
|
649
|
-
[Unreleased]: https://github.com/Artui/ag-ui-web-component/compare/v0.
|
|
681
|
+
[Unreleased]: https://github.com/Artui/ag-ui-web-component/compare/v0.15.0...HEAD
|
|
682
|
+
[0.15.0]: https://github.com/Artui/ag-ui-web-component/compare/v0.14.1...v0.15.0
|
|
650
683
|
[0.14.1]: https://github.com/Artui/ag-ui-web-component/compare/v0.14.0...v0.14.1
|
|
651
684
|
[0.14.0]: https://github.com/Artui/ag-ui-web-component/compare/v0.13.0...v0.14.0
|
|
652
685
|
[0.13.0]: https://github.com/Artui/ag-ui-web-component/compare/v0.12.0...v0.13.0
|