@particle-academy/react-fancy 5.71.3 → 5.72.0

package/CHANGELOG.md

@@ -11,6 +11,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.72.0] - 2026-11-01
+
+### Added
+
+- **`blob:` hrefs are accepted** (reported by Genie). A `URL.createObjectURL`
+  URL for an in-memory file was refused by `sanitizeHref` without a word, so
+  `<Button href="blob:...">` rendered a plain `<button>` and the link was
+  dead. `blob:` is accepted in the form a browser mints it,
+  `blob:<origin>/<id>` with an `http(s)://`, `null` or `file://` origin;
+  `blob:javascript:...`, `blob:data:...` and other wrappers stay refused. The
+  allow-list is shared, so this reaches every caller of it:
+  - `Button` (`href`, anchor mode)
+  - `ChatThread` / `ChatMessage` attachment links (`attachment.url`)
+  - `ContentRenderer` extension-tag attributes (`href`, `src`, `action`,
+    `formaction`, `xlink:href`)
+  - `sanitizeHtml` in its default (blocklist) mode, and so `ContentRenderer`,
+    `Editor` and `renderMarkdown` without `sanitize` options. Allowlist mode
+    (`sanitizeHtml(html, options)`) is unchanged: it keeps only the schemes
+    you list.
+  - the exported `sanitizeHref` itself
+- **A development warning when a component drops an href.** `Button` and
+  `ChatMessage` now `console.warn` once per distinct href when a non-empty
+  href is refused, naming the component and the scheme and showing only a
+  short prefix of the URL. Nothing is logged in production
+  (`NODE_ENV === "production"`), for an empty or missing href, or when
+  sanitising content (markdown, HTML, extension tags), where refusing hostile
+  markup is the job rather than a mistake.
+
+### Security
+
+- **`data:` remains refused, by decision**, for every media type and with or
+  without `download`: a navigable `data:text/html` is the risky case. Now
+  pinned by tests, together with `javascript:`, `vbscript:`, `file:` and the
+  obfuscated spellings (leading control characters, mixed case, whitespace
+  inside the scheme, entity and percent-encoded colons).
+
+**Consumer action: none.** An href that was silently dropped now works if it
+is `blob:`, and otherwise warns in development.
+
 ## [5.71.3] - 2026-11-01
 
 ### Fixed

package/dist/button.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
 require('./chunk-M5MUGSON.cjs');
-var chunk2KQVBD7K_cjs = require('./chunk-2KQVBD7K.cjs');
+var chunkFBGCSGCE_cjs = require('./chunk-FBGCSGCE.cjs');
 require('./chunk-XCZZVRBY.cjs');
 require('./chunk-MXWR3T3N.cjs');
 require('./chunk-ZU5Q77OT.cjs');
@@ -10,11 +10,11 @@ require('./chunk-ZU5Q77OT.cjs');
 
 Object.defineProperty(exports, "Action", {
   enumerable: true,
-  get: function () { return chunk2KQVBD7K_cjs.Action; }
+  get: function () { return chunkFBGCSGCE_cjs.Action; }
 });
 Object.defineProperty(exports, "Button", {
   enumerable: true,
-  get: function () { return chunk2KQVBD7K_cjs.Button; }
+  get: function () { return chunkFBGCSGCE_cjs.Button; }
 });
 //# sourceMappingURL=button.cjs.map
 //# sourceMappingURL=button.cjs.map

package/dist/button.js

@@ -1,5 +1,5 @@
 import './chunk-LQ4ICCN2.js';
-export { Action, Button } from './chunk-VV5435PS.js';
+export { Action, Button } from './chunk-3KF3OYWS.js';
 import './chunk-45BBNJQD.js';
 import './chunk-J3A4Z2P7.js';
 import './chunk-MMW2JGKZ.js';

package/dist/chat-thread.cjs

@@ -1,14 +1,14 @@
 'use strict';
 
-var chunk7PUTP2N7_cjs = require('./chunk-7PUTP2N7.cjs');
+var chunk5WVEW3Q5_cjs = require('./chunk-5WVEW3Q5.cjs');
 require('./chunk-S3TRSECD.cjs');
-require('./chunk-JGEFIWDA.cjs');
+require('./chunk-A5CACIHR.cjs');
 require('./chunk-2C64OVOZ.cjs');
 require('./chunk-BJL3VDRK.cjs');
 require('./chunk-VBWRH4UW.cjs');
 require('./chunk-MOU6O324.cjs');
 require('./chunk-M5MUGSON.cjs');
-require('./chunk-2KQVBD7K.cjs');
+require('./chunk-FBGCSGCE.cjs');
 require('./chunk-XCZZVRBY.cjs');
 require('./chunk-MXWR3T3N.cjs');
 require('./chunk-ZU5Q77OT.cjs');
@@ -17,11 +17,11 @@ require('./chunk-ZU5Q77OT.cjs');
 
 Object.defineProperty(exports, "ChatMessage", {
   enumerable: true,
-  get: function () { return chunk7PUTP2N7_cjs.ChatMessage; }
+  get: function () { return chunk5WVEW3Q5_cjs.ChatMessage; }
 });
 Object.defineProperty(exports, "ChatThread", {
   enumerable: true,
-  get: function () { return chunk7PUTP2N7_cjs.ChatThread; }
+  get: function () { return chunk5WVEW3Q5_cjs.ChatThread; }
 });
 //# sourceMappingURL=chat-thread.cjs.map
 //# sourceMappingURL=chat-thread.cjs.map

package/dist/chat-thread.js

@@ -1,12 +1,12 @@
-export { ChatMessage, ChatThread } from './chunk-WFEX7DAR.js';
+export { ChatMessage, ChatThread } from './chunk-GUCUYDFB.js';
 import './chunk-AUTW5O4W.js';
-import './chunk-FJJ3GMXI.js';
+import './chunk-2MDU3W7E.js';
 import './chunk-I3LAFKJU.js';
 import './chunk-UZCR7DK5.js';
 import './chunk-IQ4KQJAO.js';
 import './chunk-6FCQD2KQ.js';
 import './chunk-LQ4ICCN2.js';
-import './chunk-VV5435PS.js';
+import './chunk-3KF3OYWS.js';
 import './chunk-45BBNJQD.js';
 import './chunk-J3A4Z2P7.js';
 import './chunk-MMW2JGKZ.js';

package/dist/{chunk-FJJ3GMXI.js → chunk-2MDU3W7E.js}

@@ -1,5 +1,5 @@
 import { visuallyHidden } from './chunk-I3LAFKJU.js';
-import { sanitizeHtml, sanitizeHref, Button } from './chunk-VV5435PS.js';
+import { sanitizeHtml, sanitizeHref, Button } from './chunk-3KF3OYWS.js';
 import { cn } from './chunk-MMW2JGKZ.js';
 import { marked } from 'marked';
 import { createContext, useMemo, useRef, useState, useCallback, useContext, useLayoutEffect, useEffect } from 'react';
@@ -1400,5 +1400,5 @@ function ContentRenderer({
 ContentRenderer.displayName = "ContentRenderer";
 
 export { ContentRenderer, detectFormat, extensionEditorClasses, htmlToMarkdown, markdownToEditorHtml, mergeExtensions, proseClasses, registerExtension, registerExtensions, renderMarkdown };
-//# sourceMappingURL=chunk-FJJ3GMXI.js.map
-//# sourceMappingURL=chunk-FJJ3GMXI.js.map
+//# sourceMappingURL=chunk-2MDU3W7E.js.map
+//# sourceMappingURL=chunk-2MDU3W7E.js.map