@marimo-team/islands 0.23.10-dev43 → 0.23.10-dev44

package/dist/main.js

@@ -22,17 +22,17 @@ import { _ as Logger, c as Objects, g as cn, h as Events, i as NOT_SET, l as use
 import { t as require_react } from "./react-DA-nE2FX.js";
 import { t as require_compiler_runtime } from "./compiler-runtime-CEbnTgxf.js";
 import { n as Copy, r as toast, t as copyToClipboard } from "./copy-UqRYxiOg.js";
-import { $ as reducer, B as safeExtractSetUIElementMessageBuffers, Bn as CircleAlert, Bt as DATA_TYPE_ICON, C as AccordionContent, Cn as Root2$1, Ct as Checkbox, Dn as Table2, Dt as PathBuilder, E as BorderAllIcon, En as Trash2, F as base64ToDataView, Fn as Eye, H as getMarimoExportContext, Ht as require_client, It as jotaiJsonStorage, J as getCellNames, Jt as requestClientAtom, K as createActions, Kt as convertStatsName, L as dataViewToBase64, Ln as Database, Mn as Layers, Mt as generateUUID, Nn as Info, On as PaintRoller, Ot as Paths, Pn as FileText, Pt as repl, Q as numColumnsAtom, Rn as Columns2, S as Accordion, Sn as Item$1, St as normalizeName, T as AccordionTrigger, Tt as MarkdownLanguageAdapter, U as hasTrustedExportContext, V as renderHTML, Vn as Braces, W as hasRunAnyCellAtom, X as notebookAtom, Xt as isUninstantiated, Y as hasOnlyOneCellAtom, Yt as useRequestClient, Z as notebookOutline, _n as atomWithStorage, a as useCellFocusActions, an as parseDataset, bt as getValidName, cn as HTMLCellId, ct as initialModeAtom, dn as findCellId, et as useCellActions, f as isOutputEmpty, fn as OBJECT_ID_ATTR, ft as outputIsLoading, gn as atomWithReducer, ht as headingToIdentifier, i as LazyAnyLanguageCodeMirror, in as parseAttrValue, jn as LoaderCircle, jt as DeferredRequestRegistry, k as ChevronDownIcon, lt as kioskModeAtom, mn as jsonParseWithSpecialChar, mt as isErrorMime, n as Spinner, o as useLastFocusedCellId, on as parseInitialValue, p as useExpandedConsoleOutput, pn as RANDOM_ID_ATTR, pt as outputIsStale, qt as getRequestClient, rt as createCell, s as maybeAddAltairImport, st as getInitialAppMode, tn as NotebookScopedLocalStorage, tt as useCellIds, un as UIElementId, vn as selectAtom, w as AccordionItem, wn as Trigger2, wt as customPythonLanguageSupport, xn as Content2, xt as isInternalCellName, zt as PluralWords, __tla as __tla_0 } from "./html-to-image-BviMxrkm.js";
-import { __tla as __tla_1 } from "./chunk-5FQGJX7Z-BNjes6Yx.js";
+import { $ as reducer, B as safeExtractSetUIElementMessageBuffers, Bn as CircleAlert, Bt as DATA_TYPE_ICON, C as AccordionContent, Cn as Root2$1, Ct as Checkbox, Dn as Table2, Dt as PathBuilder, E as BorderAllIcon, En as Trash2, F as base64ToDataView, Fn as Eye, H as getMarimoExportContext, Ht as require_client, It as jotaiJsonStorage, J as getCellNames, Jt as requestClientAtom, K as createActions, Kt as convertStatsName, L as dataViewToBase64, Ln as Database, Mn as Layers, Mt as generateUUID, Nn as Info, On as PaintRoller, Ot as Paths, Pn as FileText, Pt as repl, Q as numColumnsAtom, Rn as Columns2, S as Accordion, Sn as Item$1, St as normalizeName, T as AccordionTrigger, Tt as MarkdownLanguageAdapter, U as hasTrustedExportContext, V as renderHTML, Vn as Braces, W as hasRunAnyCellAtom, X as notebookAtom, Xt as isUninstantiated, Y as hasOnlyOneCellAtom, Yt as useRequestClient, Z as notebookOutline, _n as atomWithStorage, a as useCellFocusActions, an as parseDataset, bt as getValidName, cn as HTMLCellId, ct as initialModeAtom, dn as findCellId, et as useCellActions, f as isOutputEmpty, fn as OBJECT_ID_ATTR, ft as outputIsLoading, gn as atomWithReducer, ht as headingToIdentifier, i as LazyAnyLanguageCodeMirror, in as parseAttrValue, jn as LoaderCircle, jt as DeferredRequestRegistry, k as ChevronDownIcon, lt as kioskModeAtom, mn as jsonParseWithSpecialChar, mt as isErrorMime, n as Spinner, o as useLastFocusedCellId, on as parseInitialValue, p as useExpandedConsoleOutput, pn as RANDOM_ID_ATTR, pt as outputIsStale, qt as getRequestClient, rt as createCell, s as maybeAddAltairImport, st as getInitialAppMode, tn as NotebookScopedLocalStorage, tt as useCellIds, un as UIElementId, vn as selectAtom, w as AccordionItem, wn as Trigger2, wt as customPythonLanguageSupport, xn as Content2, xt as isInternalCellName, zt as PluralWords, __tla as __tla_0 } from "./html-to-image-DXSdAI_Y.js";
+import { __tla as __tla_1 } from "./chunk-5FQGJX7Z-BbqSm5gU.js";
 import { o as useSize, s as Root$1, u as createLucideIcon } from "./dist-Dk6PV_d3.js";
 import { A as SquareFunction, C as DEFAULT_COLOR_SCHEME, D as SCALE_TYPE_DESCRIPTIONS, E as EMPTY_VALUE$1, O as TIME_UNIT_DESCRIPTIONS, S as DEFAULT_AGGREGATION, T as DEFAULT_TIME_UNIT, _ as AGGREGATION_TYPE_DESCRIPTIONS, a as AGGREGATION_FNS$1, b as COLOR_SCHEMES, c as COLOR_BY_FIELDS, d as NONE_VALUE, f as SELECTABLE_DATA_TYPES, g as TIME_UNITS, h as STRING_AGGREGATION_FNS, i as convertDataTypeToSelectable, j as ChartColumn, k as escapeFieldName, l as COMBINED_TIME_UNITS, m as SORT_TYPES, n as createSpecWithoutData, o as BIN_AGGREGATION, p as SINGLE_TIME_UNITS, r as isFieldSet, s as CHART_TYPES, t as augmentSpecWithData, u as ChartType, v as AGGREGATION_TYPE_ICON, w as DEFAULT_MAX_BINS_FACET, x as COUNT_FIELD, y as CHART_TYPE_ICON } from "./spec-X7FwLJni.js";
-import { $ as contextAwarePanelOpen, $t as $fae977aafc393c5c$export$6b862160d295c8e, A as prettifyRowCount, At as SELECT_COLUMN_ID, B as DatePicker, Bt as TabsContent, C as downloadSizeLimitAtom, Ct as DelayMount, D as ErrorState, Dt as loadTableAndRawData, E as EmptyState, Et as getPageIndexForRow, F as ContextMenuSeparator, Ft as Maps, G as CommandEmpty, Gt as ChartLoadingState, H as Combobox, Ht as TabsTrigger, I as ContextMenuTrigger, It as dateToLocalISODate, J as CommandList, Jt as RenderTextWithLinks, K as CommandInput, Kt as LazyVegaEmbed, L as useInternalStateWithSync, Lt as dateToLocalISODateTime, M as ContextMenu, Mt as toFieldTypes, N as ContextMenuContent, Nt as getMimeValues, O as LoadingState, Ot as loadTableData, P as ContextMenuItem, Pt as isNullishFilter, Q as PANEL_TYPES, Qt as $fae977aafc393c5c$export$588937bcd60ade55, R as useSelectList, Rt as dateToLocalISOTime, S as Filenames, St as ColumnChartSpecModel, T as ColumnPreviewContainer, Tt as usePrevious$1, U as ComboboxItem, Ut as ChartErrorState, V as DateRangePicker, Vt as TabsList, W as Command, Wt as ChartInfoState, X as smartMatch, Xt as HtmlOutput, Y as CommandSeparator, Yt as Kbd, Z as ContextAwarePanelItem, Zt as EmotionCacheProvider, _ as ADD_PRINTING_CLASS, _t as NAMELESS_COLUMN_PREFIX, an as Ellipsis, at as Toggle, b as downloadHTMLAsImage, bt as renderCellValue, c as Slide, cn as ChevronsUpDown, d as RadioGroupItem, dn as ChevronsDownUp, dt as Table, en as TextWrap, et as contextAwarePanelOwner, f as JsonOutput, fn as ChevronLeft, ft as TableBody, g as InstallPackageButton, gt as TableRow, h as DataTable, ht as TableHeader, it as slotsController, j as getColumnCountForDisplay, jt as TOO_MANY_ROWS, k as prettifyRowColumnCount, kt as INDEX_COLUMN_NAME, l as Switch, ln as ChevronsRight, lt as Fill, m as OutputRenderer, mt as TableHead, n as marimoVersionAtom, nn as Funnel, nt as isCellAwareAtom, o as SLIDE_TYPE_OPTIONS_BY_VALUE, on as Download, p as OutputArea, pn as ArrowDownWideNarrow, pt as TableCell, q as CommandItem, qt as useOverflowDetection, r as showCodeInRunModeAtom, rn as EyeOff, rt as SlotNames, sn as Code, t as useNotebookCodeAvailable, tn as GripHorizontal, tt as contextAwarePanelType, u as RadioGroup, un as ChevronsLeft, ut as Provider$1, v as downloadBlob, vt as generateColumns, w as ColumnName, wt as useIntersectionObserver, x as Progress, xt as ColumnChartContext, y as downloadByURL, yt as inferFieldTypes, z as CompactChipRow, zt as Tabs, __tla as __tla_2 } from "./code-visibility-BpCUlq4u.js";
+import { $ as contextAwarePanelOpen, $t as $fae977aafc393c5c$export$6b862160d295c8e, A as prettifyRowCount, At as SELECT_COLUMN_ID, B as DatePicker, Bt as TabsContent, C as downloadSizeLimitAtom, Ct as DelayMount, D as ErrorState, Dt as loadTableAndRawData, E as EmptyState, Et as getPageIndexForRow, F as ContextMenuSeparator, Ft as Maps, G as CommandEmpty, Gt as ChartLoadingState, H as Combobox, Ht as TabsTrigger, I as ContextMenuTrigger, It as dateToLocalISODate, J as CommandList, Jt as RenderTextWithLinks, K as CommandInput, Kt as LazyVegaEmbed, L as useInternalStateWithSync, Lt as dateToLocalISODateTime, M as ContextMenu, Mt as toFieldTypes, N as ContextMenuContent, Nt as getMimeValues, O as LoadingState, Ot as loadTableData, P as ContextMenuItem, Pt as isNullishFilter, Q as PANEL_TYPES, Qt as $fae977aafc393c5c$export$588937bcd60ade55, R as useSelectList, Rt as dateToLocalISOTime, S as Filenames, St as ColumnChartSpecModel, T as ColumnPreviewContainer, Tt as usePrevious$1, U as ComboboxItem, Ut as ChartErrorState, V as DateRangePicker, Vt as TabsList, W as Command, Wt as ChartInfoState, X as smartMatch, Xt as HtmlOutput, Y as CommandSeparator, Yt as Kbd, Z as ContextAwarePanelItem, Zt as EmotionCacheProvider, _ as ADD_PRINTING_CLASS, _t as NAMELESS_COLUMN_PREFIX, an as Ellipsis, at as Toggle, b as downloadHTMLAsImage, bt as renderCellValue, c as Slide, cn as ChevronsUpDown, d as RadioGroupItem, dn as ChevronsDownUp, dt as Table, en as TextWrap, et as contextAwarePanelOwner, f as JsonOutput, fn as ChevronLeft, ft as TableBody, g as InstallPackageButton, gt as TableRow, h as DataTable, ht as TableHeader, it as slotsController, j as getColumnCountForDisplay, jt as TOO_MANY_ROWS, k as prettifyRowColumnCount, kt as INDEX_COLUMN_NAME, l as Switch, ln as ChevronsRight, lt as Fill, m as OutputRenderer, mt as TableHead, n as marimoVersionAtom, nn as Funnel, nt as isCellAwareAtom, o as SLIDE_TYPE_OPTIONS_BY_VALUE, on as Download, p as OutputArea, pn as ArrowDownWideNarrow, pt as TableCell, q as CommandItem, qt as useOverflowDetection, r as showCodeInRunModeAtom, rn as EyeOff, rt as SlotNames, sn as Code, t as useNotebookCodeAvailable, tn as GripHorizontal, tt as contextAwarePanelType, u as RadioGroup, un as ChevronsLeft, ut as Provider$1, v as downloadBlob, vt as generateColumns, w as ColumnName, wt as useIntersectionObserver, x as Progress, xt as ColumnChartContext, y as downloadByURL, yt as inferFieldTypes, z as CompactChipRow, zt as Tabs, __tla as __tla_2 } from "./code-visibility-CzYIDGEy.js";
 import { c as Calendar, i as createReducerAndAtoms, n as useOnUnmount, o as ToggleLeft, t as useOnMount } from "./useLifecycle-00mO3OSS.js";
 import { t as Check } from "./check-BCaJeT-J.js";
 import { A as Icon, C as logNever, D as $18f2051aff69b9bf$export$a54013f0d02a8f82, E as $18f2051aff69b9bf$export$43bb16f9c6d9e3f7, F as createCollection, I as X, M as clamp$2, N as usePrevious$2, P as useDirection, R as ChevronDown, S as assertNever, a as SelectGroup, c as SelectSeparator, d as NativeSelect, i as SelectContent, j as Trigger$1, l as SelectTrigger, n as capitalize, o as SelectItem, r as Select, s as SelectLabel, t as Strings, u as SelectValue, w as $a916eb452884faea$export$b7a616150fdb9f44 } from "./strings-J57tzLr3.js";
 import { B as $64fa3d84918910a7$export$4d86445c2cf5e3, C as DropdownMenuTrigger, Ft as $65484d02dcb7eb3e$export$457c3d6518dd4c6f, It as $3ef42575df84b30b$export$9d1611c77c2fe928, W as $64fa3d84918910a7$export$df3a06d6289f983e, Wt as $ff5963eb1fccf552$export$e08e3b67e392101e, X as useDebouncedCallback, Y as useDebounceControlledState, a as NumberField, d as roundToFractionDigits, f as DropdownMenu, g as DropdownMenuLabel, gn as ChevronRight, h as DropdownMenuItem, hn as Circle, i as OnBlurredInput, l as prettyNumber, m as DropdownMenuGroup, n as DebouncedNumberInput, o as maxFractionDigitsForSteps, ot as $f7dceffc5ad7768b$export$4e328f61c538687f, p as DropdownMenuContent, pt as $6179b936705e76d3$export$ae780daf29e6d456, r as Input, st as $701a24aa0da5b062$export$ea18c227d4417cc3, t as DebouncedInput, u as prettyScientificNumber, v as DropdownMenuSeparator, xt as $458b0a5536c1a7cf$export$40bfa8c7b0832715, y as DropdownMenuShortcut, z as $64fa3d84918910a7$export$29f1550f4b0d4415 } from "./input-OdWHkobi.js";
 import { _ as isWasm, c as asRemoteURL, d as isStaticNotebook, f as appendQueryParams, g as Deferred, m as require_cuid2, u as getStaticVirtualFiles, v as CircleQuestionMark } from "./toDate-d8RCRrRd.js";
-import { a as MarimoIncomingMessageEvent, c as MarimoValueUpdateEvent, d as Square, f as File, i as PythonIcon, l as createInputEvent, n as blobToString, o as MarimoValueInputEvent, r as filesToBase64, s as MarimoValueReadyEvent, t as processOutput, u as deserializeBlob } from "./process-output-Bq3VMBsg.js";
+import { a as MarimoIncomingMessageEvent, c as MarimoValueUpdateEvent, d as Square, f as File, i as PythonIcon, l as createInputEvent, n as blobToString, o as MarimoValueInputEvent, r as filesToBase64, s as MarimoValueReadyEvent, t as processOutput, u as deserializeBlob } from "./process-output-uozPQhBl.js";
 import { n as Trash, r as Pencil, t as BulkEdit } from "./types-ChtMFmZ2.js";
 import { n as require_prop_types, r as Plus, t as ErrorBoundary } from "./ErrorBoundary-DpbaKVv7.js";
 import { t as require_react_dom } from "./react-dom-BTJzcVJ9.js";
@@ -8558,7 +8558,7 @@ let __tla = Promise.all([
       };
     }
   };
-  var LazyChatbot = import_react.lazy(() => import("./chat-ui-CqtCMdc-.js").then((e) => ({
+  var LazyChatbot = import_react.lazy(() => import("./chat-ui-BxwraqS-.js").then((e) => ({
     default: e.Chatbot
   }))), messageSchema = array(object({
     id: string(),
@@ -36187,7 +36187,7 @@ ${c}
   function _temp2$2(e) {
     e.target === e.currentTarget && e.key === "Enter" && (e.preventDefault(), e.stopPropagation(), e.currentTarget.click());
   }
-  var LazySlidesComponent = import_react.lazy(() => import("./reveal-component-x3disQC3.js"));
+  var LazySlidesComponent = import_react.lazy(() => import("./reveal-component-DERGOPiW.js"));
   const SlidesLayoutRenderer = ({ layout: e, setLayout: r, cells: c, mode: l }) => {
     var _a3;
     let u = useAtomValue(kioskModeAtom), d = l === "read" || u, f = useAtomValue(numColumnsAtom) > 1, [p, m] = (0, import_react.useState)(null), { slideCells: h, skippedIds: g, noOutputIds: _, slideTypes: v, startCellIndex: y } = (0, import_react.useMemo)(() => computeSlideCellsInfo(c, e), [

package/dist/{mermaid-4DMBBIKO-DIdL224_.js → mermaid-4DMBBIKO-Eg3D4FVz.js}

@@ -1,5 +1,5 @@
 import "./react-DA-nE2FX.js";
-import { a as tt } from "./chunk-5FQGJX7Z-BNjes6Yx.js";
+import { o as tt } from "./chunk-5FQGJX7Z-BbqSm5gU.js";
 import "./jsx-runtime-DebpN0FN.js";
 export {
   tt as Mermaid

package/dist/{process-output-Bq3VMBsg.js → process-output-uozPQhBl.js}

@@ -1,6 +1,6 @@
 import { s as __toESM } from "./chunk-BNovOVIE.js";
 import { t as require_compiler_runtime } from "./compiler-runtime-CEbnTgxf.js";
-import { at as parseHtmlContent, it as ansiToPlainText } from "./html-to-image-BviMxrkm.js";
+import { at as parseHtmlContent, it as ansiToPlainText } from "./html-to-image-DXSdAI_Y.js";
 import { u as createLucideIcon } from "./dist-Dk6PV_d3.js";
 import { t as Strings } from "./strings-J57tzLr3.js";
 import { t as require_jsx_runtime } from "./jsx-runtime-DebpN0FN.js";

package/dist/{reveal-component-x3disQC3.js → reveal-component-DERGOPiW.js}

@@ -6,10 +6,10 @@ import { s as __toESM } from "./chunk-BNovOVIE.js";
 import { _ as Logger, g as cn, h as Events, l as useEventListener, t as Button } from "./button-C5K9fIPF.js";
 import { t as require_react } from "./react-DA-nE2FX.js";
 import { t as require_compiler_runtime } from "./compiler-runtime-CEbnTgxf.js";
-import { lt as kioskModeAtom } from "./html-to-image-BviMxrkm.js";
-import "./chunk-5FQGJX7Z-BNjes6Yx.js";
+import { lt as kioskModeAtom } from "./html-to-image-DXSdAI_Y.js";
+import "./chunk-5FQGJX7Z-BbqSm5gU.js";
 import { u as createLucideIcon } from "./dist-Dk6PV_d3.js";
-import { a as DEFAULT_SLIDE_TYPE, c as Slide, ct as PanelResizeHandle, i as DEFAULT_DECK_TRANSITION, in as Expand, ot as Panel, rn as EyeOff, s as SlideSidebar, sn as Code, st as PanelGroup, t as useNotebookCodeAvailable } from "./code-visibility-BpCUlq4u.js";
+import { a as DEFAULT_SLIDE_TYPE, c as Slide, ct as PanelResizeHandle, i as DEFAULT_DECK_TRANSITION, in as Expand, ot as Panel, rn as EyeOff, s as SlideSidebar, sn as Code, st as PanelGroup, t as useNotebookCodeAvailable } from "./code-visibility-CzYIDGEy.js";
 import { X as useDebouncedCallback } from "./input-OdWHkobi.js";
 import "./toDate-d8RCRrRd.js";
 import "./react-dom-BTJzcVJ9.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marimo-team/islands",
-  "version": "0.23.10-dev43",
+  "version": "0.23.10-dev44",
   "main": "dist/main.js",
   "types": "dist/index.d.ts",
   "type": "module",
@@ -141,6 +141,7 @@
     "react-vega": "^8.0.0",
     "react-virtuoso": "^4.18.1",
     "reactflow": "^11.11.4",
+    "rehype-sanitize": "^6.0.0",
     "remark-gfm": "^4.0.1",
     "reveal.js": "^6.0.0",
     "rpc-anywhere": "^1.7.0",

package/src/components/chat/chat-display.tsx

@@ -60,8 +60,8 @@ export const renderUIMessage = ({
 
     switch (part.type) {
       case "text":
-        // Streamdown sanitizes the HTML which strips out marimo elements
-        // So instead, we render the HTML with our custom renderer.
+        // Streamdown strips marimo elements, so render them with our own HTML
+        // renderer. Other markdown (incl. mo.md HTML) goes through Streamdown.
         if (part.text.includes("<marimo-")) {
           return (
             <React.Fragment key={index}>

package/src/components/markdown/__tests__/markdown-renderer.test.tsx

@@ -0,0 +1,43 @@
+/* Copyright 2026 Marimo. All rights reserved. */
+import { render, screen, waitFor } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+import { MarkdownRenderer } from "../markdown-renderer";
+
+describe("MarkdownRenderer", () => {
+  // Regression test for https://github.com/marimo-team/marimo/issues/9847
+  it("preserves class names on raw HTML (e.g. marimo admonitions)", async () => {
+    const { container } = render(
+      <MarkdownRenderer
+        content={
+          '<div class="admonition error">' +
+          '<p class="admonition-title">Error</p>' +
+          "<p>Nope!</p>" +
+          "</div>"
+        }
+      />,
+    );
+
+    await waitFor(() => {
+      expect(screen.getByText("Nope!")).toBeInTheDocument();
+    });
+
+    const admonition = container.querySelector(".admonition.error");
+    expect(admonition).toBeInTheDocument();
+    expect(container.querySelector(".admonition-title")).toBeInTheDocument();
+  });
+
+  it("strips unsafe tags while keeping class names", async () => {
+    const { container } = render(
+      <MarkdownRenderer
+        content={'<div class="safe"><script>alert(1)</script>hello</div>'}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(screen.getByText("hello")).toBeInTheDocument();
+    });
+
+    expect(container.querySelector(".safe")).toBeInTheDocument();
+    expect(container.querySelector("script")).not.toBeInTheDocument();
+  });
+});

package/src/components/markdown/markdown-renderer.tsx

@@ -4,7 +4,12 @@ import { EditorView } from "@codemirror/view";
 import { useAtomValue } from "jotai";
 import { BetweenHorizontalStartIcon } from "lucide-react";
 import { memo, Suspense, useState } from "react";
-import { Streamdown, type StreamdownProps } from "streamdown";
+import rehypeSanitize, { defaultSchema } from "rehype-sanitize";
+import {
+  defaultRehypePlugins,
+  Streamdown,
+  type StreamdownProps,
+} from "streamdown";
 import { Button, type ButtonProps } from "@/components/ui/button";
 import { maybeAddMarimoImport } from "@/core/cells/add-missing-import";
 import { useCellActions } from "@/core/cells/cells";
@@ -148,6 +153,23 @@ const CopyButton: React.FC<ButtonProps> = ({ onClick, ...props }) => {
   );
 };
 
+// Allow `className` on every element; the default GitHub schema strips it,
+// which drops the styling on marimo HTML like `mo.md(...)` admonitions.
+const sanitizeSchema = {
+  ...defaultSchema,
+  attributes: {
+    ...defaultSchema.attributes,
+    "*": [...(defaultSchema.attributes?.["*"] ?? []), "className"],
+  },
+};
+
+// Keep Streamdown's other rehype plugins (raw, harden) so scripts and unsafe
+// URLs are still sanitized.
+const REHYPE_PLUGINS: StreamdownProps["rehypePlugins"] = Object.values({
+  ...defaultRehypePlugins,
+  sanitize: [rehypeSanitize, sanitizeSchema],
+});
+
 type Components = StreamdownProps["components"];
 
 const COMPONENTS: Components = {
@@ -187,6 +209,7 @@ export const MarkdownRenderer = memo(({ content }: { content: string }) => {
     <Streamdown
       components={COMPONENTS}
       plugins={plugins}
+      rehypePlugins={REHYPE_PLUGINS}
       className="mo-markdown-renderer"
     >
       {content}