dependabot[bot] opened a new pull request, #42524: URL: https://github.com/apache/superset/pull/42524
Bumps [markdown-to-jsx](https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib) from 9.8.2 to 9.9.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/quantizor/markdown-to-jsx/releases";>markdown-to-jsx's releases</a>.</em></p> <blockquote> <h2>[email protected]</h2> <h3>Minor Changes</h3> <ul> <li>373595c: React Native output now ships with a clean, minimal default look so markdown renders with a readable hierarchy out of the box: a heading size cascade, monospace code, spacing between blocks, a blockquote rule, a proper table with a header row and aligned columns, and GFM task items with a drawn checkbox in place of the bullet. Everything stays fully customizable, each element merges your <code>styles</code> over the defaults per property, <code>styles.text</code> sets a base font and color for all text at once, and any element can be replaced with your own component via <code>overrides</code>.</li> <li>373595c: React Native output now exposes a style key for every element it draws, so nothing is stuck with a built-in look. New <code>styles</code> keys: <code>checkmark</code> and <code>gfmTaskChecked</code> (the checkmark glyph and the checked-box accent of a GFM task item), <code>tableHeaderText</code> (the bold header run), and <code>tableCellDivider</code> and <code>tableRowDivider</code> (the table grid lines). These join the existing bullet, number, and per-element keys, and each merges over the default so you can restyle just what you want. Blockquotes also render tighter: the last paragraph inside no longer leaves extra space below it.</li> <li>373595c: The <code>optimizeForStreaming</code> option now works in the React Native renderer. Previously it was ignored on native, so incomplete markdown flashed raw syntax between tokens; it now suppresses partial structures the same way the web renderers do, which makes streaming LLM responses read smoothly.</li> </ul> <h3>Patch Changes</h3> <ul> <li>8c01560: The Markdown output compiler now produces Markdown that parses back to the same document across many more constructs. Literal special characters in text are escaped so they stay literal, tables emit outer pipes and escape cell pipes, loose lists keep their spacing instead of collapsing to tight, fenced and inline code widen their delimiters past any backticks inside, link and image titles containing quotes are escaped, raw HTML attributes keep their original values instead of being mangled, and an empty inline element like <code><video></video></code> no longer splits the surrounding paragraph.</li> <li>373595c: React Native footnote references now render as a superscript, matching the web renderers, instead of bold. Numeric markers use Unicode superscript characters so they sit raised and scale with the surrounding text, and you can style them with the new <code>styles.footnote</code> option. In the footnotes list, each note now reads on one line next to its number instead of below it.</li> <li>373595c: Fixed React key warnings in React Native when raw HTML mixed with other content, such as a <code><div></code> holding paragraphs with text between them, or a custom component following a heading. These elements now receive unique keys.</li> <li>373595c: React Native no longer crashes when rendering content that mixes text with block elements or images. Previously, text placed next to a block (in a list, table cell, raw HTML block, preformatted block, or footnote) threw "Text strings must be rendered within a <code><Text></code> component", and an image inside a paragraph, heading, link, or emphasis threw "Unexpected view type nested under text node" on Android. Now a container follows its content: it stays a text element when everything inside is inline, and becomes a view (grouping text runs while laying images and blocks out alongside) when it holds a block. Image links remain tappable.</li> <li>373595c: Faster React Native rendering: compiling a large document now runs roughly 5-7% quicker, with the biggest gains on list- and heading-heavy content. Output is unchanged.</li> <li>4008830: Streaming parses of deeply nested content (blockquotes and long lists) are faster. When <code>optimizeForStreaming</code> is on, the incomplete-syntax suppression now runs only on the block that can hold the document's live edge instead of re-scanning every closed block above it, so re-parsing on each streamed token does less work on outline-heavy documents.</li> <li>4008830: While streaming markdown with <code>optimizeForStreaming</code>, a table renders smoothly instead of flashing raw syntax. A partial table (a header row before its divider row, or the opening <code>|</code> of a new table) stays hidden until enough has streamed in to render, and once the table appears it no longer disappears and reappears as each new row arrives. This holds consistently across every renderer.</li> <li>4008830: Raw HTML in your markdown is now stripped of dangerous attributes before it reaches output, closing a cross-site scripting hole that affected every renderer. Inline event handlers (<code>onclick</code>, <code>onerror</code>, <code>onload</code>, and any other <code>on*</code> attribute) and URL attributes carrying a <code>javascript:</code>, <code>vbscript:</code>, or non-image <code>data:</code> scheme (in <code>href</code>, <code>src</code>, <code>action</code>, <code>formaction</code>, <code>poster</code>, <code>cite</code>, and similar) are removed, <code>srcdoc</code> is dropped, and schemes hidden behind HTML entities such as <code>java&[#9](https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/issues/9);script:</code> are caught too. Safe attributes keep their original formatting, <code>data:image</code> URLs still work, and event handlers passed as expressions to your own components (<code><MyButton onClick={fn} /></code>), along with bare boole an props on them (<code><MyButton onClick /></code>), are preserved. Previously the HTML and Markdown string outputs emitted these attributes verbatim, and Solid and Vue injected them without protection.</li> <li>621de7e: URLs containing emoji and other non-BMP Unicode characters now render without crashing.</li> <li>9b3a406: The Vue renderer's <code>renderRule</code> types now reflect that a single rule can render more than one sibling node. The <code>next()</code> callback and a custom <code>renderRule</code> may return an array of nodes, matching what the renderer already produced at runtime, so TypeScript no longer flags valid pass-through overrides.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/quantizor/markdown-to-jsx/blob/main/lib/CHANGELOG.md";>markdown-to-jsx's changelog</a>.</em></p> <blockquote> <h2>9.9.0</h2> <h3>Minor Changes</h3> <ul> <li>373595c: React Native output now ships with a clean, minimal default look so markdown renders with a readable hierarchy out of the box: a heading size cascade, monospace code, spacing between blocks, a blockquote rule, a proper table with a header row and aligned columns, and GFM task items with a drawn checkbox in place of the bullet. Everything stays fully customizable, each element merges your <code>styles</code> over the defaults per property, <code>styles.text</code> sets a base font and color for all text at once, and any element can be replaced with your own component via <code>overrides</code>.</li> <li>373595c: React Native output now exposes a style key for every element it draws, so nothing is stuck with a built-in look. New <code>styles</code> keys: <code>checkmark</code> and <code>gfmTaskChecked</code> (the checkmark glyph and the checked-box accent of a GFM task item), <code>tableHeaderText</code> (the bold header run), and <code>tableCellDivider</code> and <code>tableRowDivider</code> (the table grid lines). These join the existing bullet, number, and per-element keys, and each merges over the default so you can restyle just what you want. Blockquotes also render tighter: the last paragraph inside no longer leaves extra space below it.</li> <li>373595c: The <code>optimizeForStreaming</code> option now works in the React Native renderer. Previously it was ignored on native, so incomplete markdown flashed raw syntax between tokens; it now suppresses partial structures the same way the web renderers do, which makes streaming LLM responses read smoothly.</li> </ul> <h3>Patch Changes</h3> <ul> <li>8c01560: The Markdown output compiler now produces Markdown that parses back to the same document across many more constructs. Literal special characters in text are escaped so they stay literal, tables emit outer pipes and escape cell pipes, loose lists keep their spacing instead of collapsing to tight, fenced and inline code widen their delimiters past any backticks inside, link and image titles containing quotes are escaped, raw HTML attributes keep their original values instead of being mangled, and an empty inline element like <code><video></video></code> no longer splits the surrounding paragraph.</li> <li>373595c: React Native footnote references now render as a superscript, matching the web renderers, instead of bold. Numeric markers use Unicode superscript characters so they sit raised and scale with the surrounding text, and you can style them with the new <code>styles.footnote</code> option. In the footnotes list, each note now reads on one line next to its number instead of below it.</li> <li>373595c: Fixed React key warnings in React Native when raw HTML mixed with other content, such as a <code><div></code> holding paragraphs with text between them, or a custom component following a heading. These elements now receive unique keys.</li> <li>373595c: React Native no longer crashes when rendering content that mixes text with block elements or images. Previously, text placed next to a block (in a list, table cell, raw HTML block, preformatted block, or footnote) threw "Text strings must be rendered within a <code><Text></code> component", and an image inside a paragraph, heading, link, or emphasis threw "Unexpected view type nested under text node" on Android. Now a container follows its content: it stays a text element when everything inside is inline, and becomes a view (grouping text runs while laying images and blocks out alongside) when it holds a block. Image links remain tappable.</li> <li>373595c: Faster React Native rendering: compiling a large document now runs roughly 5-7% quicker, with the biggest gains on list- and heading-heavy content. Output is unchanged.</li> <li>4008830: Streaming parses of deeply nested content (blockquotes and long lists) are faster. When <code>optimizeForStreaming</code> is on, the incomplete-syntax suppression now runs only on the block that can hold the document's live edge instead of re-scanning every closed block above it, so re-parsing on each streamed token does less work on outline-heavy documents.</li> <li>4008830: While streaming markdown with <code>optimizeForStreaming</code>, a table renders smoothly instead of flashing raw syntax. A partial table (a header row before its divider row, or the opening <code>|</code> of a new table) stays hidden until enough has streamed in to render, and once the table appears it no longer disappears and reappears as each new row arrives. This holds consistently across every renderer.</li> <li>4008830: Raw HTML in your markdown is now stripped of dangerous attributes before it reaches output, closing a cross-site scripting hole that affected every renderer. Inline event handlers (<code>onclick</code>, <code>onerror</code>, <code>onload</code>, and any other <code>on*</code> attribute) and URL attributes carrying a <code>javascript:</code>, <code>vbscript:</code>, or non-image <code>data:</code> scheme (in <code>href</code>, <code>src</code>, <code>action</code>, <code>formaction</code>, <code>poster</code>, <code>cite</code>, and similar) are removed, <code>srcdoc</code> is dropped, and schemes hidden behind HTML entities such as <code>java&[#9](https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/issues/9);script:</code> are caught too. Safe attributes keep their original formatting, <code>data:image</code> URLs still work, and event handlers passed as expressions to your own components (<code><MyButton onClick={fn} /></code>), along with bare boole an props on them (<code><MyButton onClick /></code>), are preserved. Previously the HTML and Markdown string outputs emitted these attributes verbatim, and Solid and Vue injected them without protection.</li> <li>621de7e: URLs containing emoji and other non-BMP Unicode characters now render without crashing.</li> <li>9b3a406: The Vue renderer's <code>renderRule</code> types now reflect that a single rule can render more than one sibling node. The <code>next()</code> callback and a custom <code>renderRule</code> may return an array of nodes, matching what the renderer already produced at runtime, so TypeScript no longer flags valid pass-through overrides.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/quantizor/markdown-to-jsx/commit/ab4affb5a488c34f2c8a37fbc0a187579286ac42";><code>ab4affb</code></a> Version Packages</li> <li><a href="https://github.com/quantizor/markdown-to-jsx/commit/ab455572f701eab7d961ad0ceac42c08d4a58422";><code>ab45557</code></a> docs: raw-HTML sanitization guide, translations, and rebuilt site</li> <li><a href="https://github.com/quantizor/markdown-to-jsx/commit/ffb0fbb401ecaf16219444e8cbbce34e7be2feb6";><code>ffb0fbb</code></a> chore: type-check all published entry points in CI</li> <li><a href="https://github.com/quantizor/markdown-to-jsx/commit/373595c03bb0c659a54e8d76f5a9396c72e21dad";><code>373595c</code></a> feat(native): renderer defaults, streaming, and styling escape hatches</li> <li><a href="https://github.com/quantizor/markdown-to-jsx/commit/8c01560cfcd00690113fbde5ecaf4a4cedc8f79e";><code>8c01560</code></a> fix(markdown): astToMarkdown round-trip fidelity</li> <li><a href="https://github.com/quantizor/markdown-to-jsx/commit/9b3a406c15521a860ce23391be184b7d7235aa71";><code>9b3a406</code></a> fix(renderers): cross-renderer HTML handling and Vue renderRule types</li> <li><a href="https://github.com/quantizor/markdown-to-jsx/commit/4008830fd7f16d77fb2d9f6cc75367d154269120";><code>4008830</code></a> fix(parser): sanitize dangerous raw HTML and refine streaming</li> <li><a href="https://github.com/quantizor/markdown-to-jsx/commit/621de7eb388cccbea7a796f48425123027fc5a42";><code>621de7e</code></a> fix: render URLs containing non-BMP characters (<a href="https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/issues/886";>#886</a>)</li> <li>See full diff in <a href="https://github.com/quantizor/markdown-to-jsx/commits/[email protected]/lib";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
