markdown-to-jsx 9.3.4 → 9.4.0

package/dist/index.d.cts

@@ -176,6 +176,7 @@ type RequireAtLeastOne<
 		attrs?: Record<string, any>;
 		children?: ASTNode[] | undefined;
 		noInnerParse?: Boolean;
+		rawAttrs?: string;
 		tag: string;
 		text?: string | undefined;
 	}
@@ -227,6 +228,31 @@ type RequireAtLeastOne<
 		*/
 		enforceAtxHeadings: boolean;
 		/**
+		* **⚠️ SECURITY WARNING: STRONGLY DISCOURAGED FOR USER INPUTS**
+		*
+		* When enabled, attempts to eval expressions in JSX props that cannot be serialized
+		* as JSON (functions, variables, complex expressions). This uses `eval()` which can
+		* execute arbitrary code.
+		*
+		* **ONLY use this option when:**
+		* - The markdown source is completely trusted (e.g., your own documentation)
+		* - You control all JSX components and their props
+		* - The content is NOT user-generated or user-editable
+		*
+		* **DO NOT use this option when:**
+		* - Processing user-submitted markdown
+		* - Rendering untrusted content
+		* - Building public-facing applications with user content
+		*
+		* Example unsafe input: `<Component onClick={() => fetch('/admin/delete-all')} />`
+		*
+		* When disabled (default), unserializable expressions remain as strings that can be
+		* safely inspected or handled on a case-by-case basis via custom renderRule logic.
+		*
+		* @default false
+		*/
+		evalUnserializableExpressions?: boolean;
+		/**
 		* Forces the compiler to always output content with a block-level wrapper
 		* (`<p>` or any block-level syntax your markdown already contains.)
 		*/
@@ -337,8 +363,8 @@ declare function sanitizer(input: string): string | null;
 declare function slugify(str: string): string;
 declare function compiler(markdown?: string, options?: MarkdownToJSX.Options): React2.ReactNode;
 /**
-* A simple HOC for easy React use. Feed the markdown content as a direct child
-* and the rest is taken care of automatically.
+* A React component for easy markdown rendering. Feed the markdown content as a direct child
+* and the rest is taken care of automatically. Supports memoization for optimal performance.
 */
 declare const Markdown: React2.FC<Omit<React2.HTMLAttributes<Element>, "children"> & {
 	children?: string | null;

package/dist/index.d.ts

@@ -176,6 +176,7 @@ type RequireAtLeastOne<
 		attrs?: Record<string, any>;
 		children?: ASTNode[] | undefined;
 		noInnerParse?: Boolean;
+		rawAttrs?: string;
 		tag: string;
 		text?: string | undefined;
 	}
@@ -227,6 +228,31 @@ type RequireAtLeastOne<
 		*/
 		enforceAtxHeadings: boolean;
 		/**
+		* **⚠️ SECURITY WARNING: STRONGLY DISCOURAGED FOR USER INPUTS**
+		*
+		* When enabled, attempts to eval expressions in JSX props that cannot be serialized
+		* as JSON (functions, variables, complex expressions). This uses `eval()` which can
+		* execute arbitrary code.
+		*
+		* **ONLY use this option when:**
+		* - The markdown source is completely trusted (e.g., your own documentation)
+		* - You control all JSX components and their props
+		* - The content is NOT user-generated or user-editable
+		*
+		* **DO NOT use this option when:**
+		* - Processing user-submitted markdown
+		* - Rendering untrusted content
+		* - Building public-facing applications with user content
+		*
+		* Example unsafe input: `<Component onClick={() => fetch('/admin/delete-all')} />`
+		*
+		* When disabled (default), unserializable expressions remain as strings that can be
+		* safely inspected or handled on a case-by-case basis via custom renderRule logic.
+		*
+		* @default false
+		*/
+		evalUnserializableExpressions?: boolean;
+		/**
 		* Forces the compiler to always output content with a block-level wrapper
 		* (`<p>` or any block-level syntax your markdown already contains.)
 		*/
@@ -337,8 +363,8 @@ declare function sanitizer(input: string): string | null;
 declare function slugify(str: string): string;
 declare function compiler(markdown?: string, options?: MarkdownToJSX.Options): React2.ReactNode;
 /**
-* A simple HOC for easy React use. Feed the markdown content as a direct child
-* and the rest is taken care of automatically.
+* A React component for easy markdown rendering. Feed the markdown content as a direct child
+* and the rest is taken care of automatically. Supports memoization for optimal performance.
 */
 declare const Markdown: React2.FC<Omit<React2.HTMLAttributes<Element>, "children"> & {
 	children?: string | null;