@haruhimemoe/ui 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.5.1] - 2026-09-28
+
+### Security
+
+- `JsonLd` also escapes `>`, `&`, U+2028 and U+2029 as JSON unicode escapes, not only `<`. The data parses back unchanged.
+
 ## [0.5.0] - 2026-09-28
 
 ### Added
@@ -86,7 +92,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - `className` on every component, and the extras passed to `buttonClasses` and `fieldClasses`, merge with tailwind-merge: a caller's class replaces a built-in one that sets the same property (`fieldClasses("w-auto")` drops `w-full`).
 - Shell: `SiteHeader` (brand slot, nav links as data with `aria-current`, actions slot), `NavLinks`, `SiteFooter` (link columns as data, fine print, the haruhime.moe wordmark and a GitHub link) and `PageShell` (skip link, header, main, footer).
 
-[unreleased]: https://github.com/haruhimemoe/ui/compare/v0.5.0...HEAD
+[unreleased]: https://github.com/haruhimemoe/ui/compare/v0.5.1...HEAD
+[0.5.1]: https://github.com/haruhimemoe/ui/compare/v0.5.0...v0.5.1
 [0.5.0]: https://github.com/haruhimemoe/ui/compare/v0.4.0...v0.5.0
 [0.4.0]: https://github.com/haruhimemoe/ui/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/haruhimemoe/ui/compare/v0.2.0...v0.3.0

package/dist/components/meta/JsonLd.d.ts

@@ -1,7 +1,8 @@
 /**
  * @file src/components/meta/JsonLd.tsx
- * @desc schema.org structured data as a JSON-LD script tag. Every "<" is escaped, so no string
- *       in the data (a user-supplied name, say) can close the tag or open a comment.
+ * @desc schema.org structured data as a JSON-LD script tag. "<", ">", "&" and the line and
+ *       paragraph separators (U+2028, U+2029) are written as JSON escapes, so no string in the
+ *       data (a user-supplied name, say) can close the tag, open a comment or break the script.
  * @author David @dvhsh (https://dvh.sh)
  * @created Wed Sep 23, 2026
  * @modified Mon Sep 28, 2026

package/dist/components/meta/JsonLd.js

@@ -1,10 +1,13 @@
 import { jsx as _jsx } from "react/jsx-runtime";
+/** Characters written as JSON unicode escapes inside the script tag. */
+const UNSAFE = /[<>&\u2028\u2029]/g;
 /**
  * @function jsonLdString
  * @param data {Record<string, unknown>} a schema.org object
- * @returns {string} JSON with `@context` added and every "<" written as the escape `\u003c`
+ * @returns {string} JSON with `@context` added and "<", ">", "&", U+2028 and U+2029 written as
+ *          `\uXXXX` escapes (still the same JSON once parsed)
  */
-const jsonLdString = (data) => JSON.stringify({ "@context": "https://schema.org", ...data }).replace(/</g, "\\u003c");
+const jsonLdString = (data) => JSON.stringify({ "@context": "https://schema.org", ...data }).replace(UNSAFE, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
 /**
  * @function JsonLd
  * @param props {JsonLdProps} the schema.org data, plus native script props
@@ -12,6 +15,6 @@ const jsonLdString = (data) => JSON.stringify({ "@context": "https://schema.org"
  */
 export function JsonLd({ data, ...props }) {
     return (_jsx("script", { ...props, type: "application/ld+json", 
-        // biome-ignore lint/security/noDangerouslySetInnerHtml: JSON-LD must be raw JSON; jsonLdString escapes "<".
+        // biome-ignore lint/security/noDangerouslySetInnerHtml: JSON-LD must be raw JSON; jsonLdString escapes the unsafe characters.
         dangerouslySetInnerHTML: { __html: jsonLdString(data) } }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haruhimemoe/ui",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "React components for the haruhime.moe osu! tools on Next.js: the osu!-web-style palette as a Tailwind theme, buttons, cards, form fields and confirms, filter controls, tables, osu! beatmap display pieces and the site header and footer.",
   "keywords": [
     "osu",