@cloro-dev/response-parser 0.5.1 → 0.5.3

package/README.md

@@ -10,7 +10,7 @@ A powerful TypeScript library for parsing AI model responses from ChatGPT, Gemin
 - 🔍 **Auto-Detection**: Automatically detects the AI provider from response structure
 - 🎨 **Built-in Styling**: Provider-specific styling
 - 🔧 **Framework-Agnostic**: Pure HTML output for any framework
-- 🔒 **Secure**: Automatic script sanitization
+- 🧹 **Script removal**: Removes `<script>` and `<noscript>` elements. This is not a full HTML sanitizer.
 - 📦 **TypeScript**: Full TypeScript support with comprehensive types
 - 🎯 **Lightweight**: No runtime dependencies for core parsing
 
@@ -26,7 +26,9 @@ pnpm add @cloro-dev/response-parser
 
 ## Quick Start
 
-This library parses AI responses and returns sanitized HTML strings. You can render the HTML in any framework:
+This library parses AI responses and returns HTML strings. You can render the HTML in any framework.
+
+> **Security**: The parser removes only `<script>` and `<noscript>` elements. It does not remove event handler attributes (for example `onerror=`) or `javascript:` URLs. If the HTML comes from a source that you do not trust, sanitize `parsed.html` with a full HTML sanitizer (for example [DOMPurify](https://github.com/cure53/DOMPurify)) before you render it.
 
 ```typescript
 import { parseAiResponse, detectProvider } from "@cloro-dev/response-parser";
@@ -36,7 +38,7 @@ const response = await fetchAIResponse();
 const parsed = parseAiResponse(response);
 
 console.log(parsed.provider); // 'CHATGPT' | 'GEMINI' | etc.
-console.log(parsed.html); // Sanitized HTML ready for rendering
+console.log(parsed.html); // HTML with <script> and <noscript> elements removed
 console.log(parsed.text); // Plain text version
 ```
 
@@ -236,6 +238,15 @@ The core parsing logic is identical - you just need to handle the HTML rendering
 
 ## What's Changed
 
+### v0.5.3
+
+- First release from the Publish workflow, with npm Trusted Publishing and provenance. No library changes
+
+### v0.5.2
+
+- ✅ **Fixed** The README said that the parser sanitizes HTML. It removes only `<script>` and `<noscript>` elements. A new Security note tells you to sanitize untrusted HTML before you render it
+- ✅ **Fixed** The `package.json` repository URL now points to `cloro-dev/response-parser`
+
 ### v0.5.1
 
 - ✅ **Fixed** ChatGPT `removeSources` now hides the open sources dialog of the mobile page
@@ -306,7 +317,7 @@ The core parsing logic is identical - you just need to handle the HTML rendering
 
 ### v0.1.3
 
-- ✅ **Always sanitizes** HTML by default (removes scripts for security)
+- ✅ **Always removes** `<script>` and `<noscript>` elements from the HTML
 - ✅ **Always includes** provider-specific styles
 - ✅ **Always uses** provider's base URL for relative links
 - ❌ **Removed** `theme` option (styles are provider-specific)
@@ -335,33 +346,19 @@ pnpm lint
 
 ## Release
 
-1. Log in to npm with an account that can publish to `@cloro-dev`:
-
-   ```bash
-   npm login
-   ```
+The [Publish workflow](.github/workflows/publish.yml) publishes the package to npm when a version tag is pushed. It uses npm Trusted Publishing, so you do not need to log in to npm.
 
-2. Run the checks and the build:
-
-   ```bash
-   pnpm type-check && pnpm lint && pnpm build
-   ```
-
-3. Increase the version. This changes `package.json` and creates a git commit and tag:
-
-   ```bash
-   npm version patch   # 0.4.5 → 0.4.6
-   npm version minor   # 0.4.5 → 0.5.0
-   npm version major   # 0.4.5 → 1.0.0
-   ```
+1. Add an entry under "What's Changed".
 
-4. Publish. `prepublishOnly` builds the package again before the upload:
+2. Increase the version. This changes `package.json` and creates a git commit and a `v` tag:
 
    ```bash
-   npm publish
+   npm version patch   # 0.5.2 → 0.5.3
+   npm version minor   # 0.5.2 → 0.6.0
+   npm version major   # 0.5.2 → 1.0.0
    ```
 
-5. Push the commit and the tag, and add an entry under "What's Changed":
+3. Push the commit and the tag. The workflow type-checks, lints, builds and publishes:
 
    ```bash
    git push --follow-tags

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloro-dev/response-parser",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "type": "module",
   "description": "Parse and render AI model responses from ChatGPT, Gemini, Perplexity, and more",
   "main": "dist/index.cjs",
@@ -40,7 +40,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/cloro/response-parser.git"
+    "url": "https://github.com/cloro-dev/response-parser.git"
   },
   "devDependencies": {
     "@rollup/plugin-commonjs": "^25.0.7",