markdown-to-jsx 9.3.5 → 9.4.1

package/dist/html.d.cts

@@ -174,9 +174,12 @@ type RequireAtLeastOne<
 		type: typeof RuleType2.htmlBlock;
 		attrs?: Record<string, any>;
 		children?: ASTNode[] | undefined;
-		noInnerParse?: Boolean;
-		tag: string;
+		verbatim?: boolean;
+		rawAttrs?: string;
+		rawText?: string | undefined;
+		/** @deprecated Use `rawText` instead. This property will be removed in a future major version. */
 		text?: string | undefined;
+		tag: string;
 	}
 	export interface HTMLSelfClosingNode {
 		type: typeof RuleType2.htmlSelfClosing;
@@ -226,6 +229,31 @@ type RequireAtLeastOne<
 		*/
 		enforceAtxHeadings: boolean;
 		/**
+		* **⚠️ SECURITY WARNING: STRONGLY DISCOURAGED FOR USER INPUTS**
+		*
+		* When enabled, attempts to eval expressions in JSX props that cannot be serialized
+		* as JSON (functions, variables, complex expressions). This uses `eval()` which can
+		* execute arbitrary code.
+		*
+		* **ONLY use this option when:**
+		* - The markdown source is completely trusted (e.g., your own documentation)
+		* - You control all JSX components and their props
+		* - The content is NOT user-generated or user-editable
+		*
+		* **DO NOT use this option when:**
+		* - Processing user-submitted markdown
+		* - Rendering untrusted content
+		* - Building public-facing applications with user content
+		*
+		* Example unsafe input: `<Component onClick={() => fetch('/admin/delete-all')} />`
+		*
+		* When disabled (default), unserializable expressions remain as strings that can be
+		* safely inspected or handled on a case-by-case basis via custom renderRule logic.
+		*
+		* @default false
+		*/
+		evalUnserializableExpressions?: boolean;
+		/**
 		* Forces the compiler to always output content with a block-level wrapper
 		* (`<p>` or any block-level syntax your markdown already contains.)
 		*/

package/dist/html.d.ts

@@ -174,9 +174,12 @@ type RequireAtLeastOne<
 		type: typeof RuleType2.htmlBlock;
 		attrs?: Record<string, any>;
 		children?: ASTNode[] | undefined;
-		noInnerParse?: Boolean;
-		tag: string;
+		verbatim?: boolean;
+		rawAttrs?: string;
+		rawText?: string | undefined;
+		/** @deprecated Use `rawText` instead. This property will be removed in a future major version. */
 		text?: string | undefined;
+		tag: string;
 	}
 	export interface HTMLSelfClosingNode {
 		type: typeof RuleType2.htmlSelfClosing;
@@ -226,6 +229,31 @@ type RequireAtLeastOne<
 		*/
 		enforceAtxHeadings: boolean;
 		/**
+		* **⚠️ SECURITY WARNING: STRONGLY DISCOURAGED FOR USER INPUTS**
+		*
+		* When enabled, attempts to eval expressions in JSX props that cannot be serialized
+		* as JSON (functions, variables, complex expressions). This uses `eval()` which can
+		* execute arbitrary code.
+		*
+		* **ONLY use this option when:**
+		* - The markdown source is completely trusted (e.g., your own documentation)
+		* - You control all JSX components and their props
+		* - The content is NOT user-generated or user-editable
+		*
+		* **DO NOT use this option when:**
+		* - Processing user-submitted markdown
+		* - Rendering untrusted content
+		* - Building public-facing applications with user content
+		*
+		* Example unsafe input: `<Component onClick={() => fetch('/admin/delete-all')} />`
+		*
+		* When disabled (default), unserializable expressions remain as strings that can be
+		* safely inspected or handled on a case-by-case basis via custom renderRule logic.
+		*
+		* @default false
+		*/
+		evalUnserializableExpressions?: boolean;
+		/**
 		* Forces the compiler to always output content with a block-level wrapper
 		* (`<p>` or any block-level syntax your markdown already contains.)
 		*/