@iyulab/chat-components 0.18.0 → 0.18.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [0.18.1] - 2026-10-07
|
|
4
|
+
|
|
5
|
+
### Documentation
|
|
6
|
+
|
|
7
|
+
- The security guide still listed `u-table-block` cell `text` as trusted HTML. It now lists `text` as untrusted
|
|
8
|
+
(rendered as text) and the new `html` field as the trusted-markup input, as 0.18.0 changed — in `docs/security.md`
|
|
9
|
+
and the skill security reference.
|
|
10
|
+
|
|
3
11
|
## [0.18.0] - 2026-10-07
|
|
4
12
|
|
|
5
13
|
### Changed (breaking)
|
package/package.json
CHANGED
|
@@ -8,7 +8,8 @@ is trusted to contain:
|
|
|
8
8
|
| `u-marked-block` `value` | untrusted | Raw HTML shown as text · link/image URLs protocol-checked (`javascript:`/`data:`/`vbscript:`/`//host` → `#`) · code fences escaped · table cells same rules |
|
|
9
9
|
| `block-json` fences | untrusted | Only registered blocks; only the schema's property names are assigned |
|
|
10
10
|
| `refs` | untrusted | Text rendered as text · URLs protocol-checked in `u-ref-tag` and `u-ref-card` |
|
|
11
|
-
| `u-table-block` cell `text` bound directly |
|
|
11
|
+
| `u-table-block` cell `text` bound directly | untrusted | Rendered as text; search, sort and downloads use it |
|
|
12
|
+
| `u-table-block` cell `html` bound directly | **trusted HTML** | Display only. Sanitize before binding. `block-json` cannot reach it |
|
|
12
13
|
| Your custom block | your element's contract | The schema allows names, not content — sanitize HTML-rendered properties inside the element |
|
|
13
14
|
|
|
14
15
|
Requests: markdown images and `u-images-block` load the `http:`/`https:` URL the model writes as soon as they
|