@particle-academy/fancy-code 0.9.1 → 0.9.3

package/CHANGELOG.md

@@ -0,0 +1,68 @@
+# Changelog
+
+All notable changes to `@particle-academy/fancy-code` are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+> **Pre-1.0:** breaking changes land in MINOR releases. Until 1.0 the minor
+> number is not a compatibility promise — read the entry, not the version.
+
+> This file starts here. Earlier releases predate it and were never written up;
+> `git log` is the record for those. It is not backfilled rather than
+> guessed-at, because a changelog that invents its own history is worse than one
+> that admits where it begins.
+
+## [Unreleased]
+
+## [0.9.3] — 2026-10-18
+
+The 0.9.2 fix below, actually published. **0.9.2 was tagged but never reached
+npm**: the publish workflow's install step crashed on the runner's npm 10 (an
+arborist peer-set bug). It now installs with npm 11, the version it already
+published with. This line also publishes under the `maint-0.4` dist-tag, so
+`latest` stays on the current line.
+
+## [0.9.2] — 2026-10-18 (tagged, never published)
+
+### Security
+
+- **`<MarkdownEditor>`'s preview no longer renders a link or image whose URL
+  can run script.** Backported from 0.12.1. The preview is inserted with
+  `innerHTML`, where React's `javascript:` guard does not apply, and URL schemes
+  were never checked, so `[x](javascript:...)` was a live script link. A link
+  now needs a relative URL or `http`, `https`, `mailto` or `tel`; an image a
+  relative URL, `http(s)` or a raster `data:image/...`. Anything else renders as
+  its text or alt text. **Upgrade if any markdown you preview was written by
+  someone else.** Nothing else changes.
+
+## [0.9.1] — 2026-07-28
+
+### Fixed
+
+- **`CodeEditorPanel` crashed when the editor engine arrived after first
+  render.** `if (!engine) return null` sat above the `useMemo` that builds the
+  gutter, so a render without an engine ran zero hooks and the next ran one —
+  React desyncs on the changed count and throws from inside itself.
+  `_engineReturn` is typed `| null` and starts null, so any host rendering the
+  panel before the engine settles hit this.
+
+  **No action needed** — the fix is internal and the API is unchanged.
+
+### Added
+
+- `jsdom` as a devDependency, and the first component test in this package.
+  There was previously no way to render a component in a test here at all, which
+  is precisely how the bug above shipped.
+
+### Changed
+
+- Widened the `@particle-academy/fancy-file-commons` requirement from `^0.2.0` to
+  `>=0.2 <2.0`, so a sibling minor release is an upgrade and not a resolver
+  conflict. **No action needed** — widening a range only adds candidates; the
+  version you have today still resolves.
+
+  A caret on a `0.x` range locks the MINOR, so this pinned a sibling at
+  whatever it happened to be on the day it was written, and each sibling
+  release then read as a conflict to the resolver rather than an upgrade.
+  Nothing here was using an API the newer minors removed — the range was the
+  whole problem.

package/dist/index.cjs

@@ -1643,8 +1643,27 @@ function escapeHtml(s) {
 function escapeAttr(s) {
   return s.replace(/"/g, """).replace(/'/g, "'");
 }
+var LINK_SCHEMES = /* @__PURE__ */ new Set(["http", "https", "mailto", "tel"]);
+function schemeOf(url) {
+  let s = "";
+  for (const ch of url) {
+    const code = ch.codePointAt(0) ?? 0;
+    if (code === 9 || code === 10 || code === 13) continue;
+    if (s === "" && code <= 32) continue;
+    s += ch;
+  }
+  const m = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(s);
+  return m ? m[1].toLowerCase() : null;
+}
+function safeUrl(url, kind) {
+  const scheme = schemeOf(url);
+  if (scheme === null) return true;
+  if (scheme === "http" || scheme === "https") return true;
+  if (kind === "link") return LINK_SCHEMES.has(scheme);
+  return scheme === "data" && /^data:image\/(png|jpe?g|gif|webp|avif|bmp);/i.test(url.trim());
+}
 function inline(text) {
-  return text.replace(/!\[([^\]]*)\]\(([^)\s]+)(?:\s+"([^"]*)")?\)/g, (_m, alt, src, title) => `<img src="${escapeAttr(src)}" alt="${escapeAttr(alt)}"${title ? ` title="${escapeAttr(title)}"` : ""}>`).replace(/\[([^\]]+)\]\(([^)\s]+)(?:\s+"([^"]*)")?\)/g, (_m, t, href, title) => `<a href="${escapeAttr(href)}"${title ? ` title="${escapeAttr(title)}"` : ""} rel="noopener">${t}</a>`).replace(/`([^`]+)`/g, (_m, c) => `<code>${c}</code>`).replace(/(\*\*|__)(?=\S)([\s\S]*?\S)\1/g, "<strong>$2</strong>").replace(/(\*|_)(?=\S)([\s\S]*?\S)\1/g, "<em>$2</em>");
+  return text.replace(/!\[([^\]]*)\]\(([^)\s]+)(?:\s+"([^"]*)")?\)/g, (_m, alt, src, title) => safeUrl(src, "image") ? `<img src="${escapeAttr(src)}" alt="${escapeAttr(alt)}"${title ? ` title="${escapeAttr(title)}"` : ""}>` : alt).replace(/\[([^\]]+)\]\(([^)\s]+)(?:\s+"([^"]*)")?\)/g, (_m, t, href, title) => safeUrl(href, "link") ? `<a href="${escapeAttr(href)}"${title ? ` title="${escapeAttr(title)}"` : ""} rel="noopener">${t}</a>` : t).replace(/`([^`]+)`/g, (_m, c) => `<code>${c}</code>`).replace(/(\*\*|__)(?=\S)([\s\S]*?\S)\1/g, "<strong>$2</strong>").replace(/(\*|_)(?=\S)([\s\S]*?\S)\1/g, "<em>$2</em>");
 }
 function renderMarkdown(markdown) {
   const lines = markdown.replace(/\r\n?/g, "\n").split("\n");