build(deps): upgrade react-markdown to v9 and remark-gfm to v4

[hainenber]

build(deps): upgrade react-markdown to v9 and remark-gfm to v4

SUMMARY

Previously, these deps were pinned down to rehype-parse due to

• Transitive dep mismatch between react-markdown and remark-gfm (ref PR).

• react-markdown needs React 18+

However, thanks to @msyavuz's tremendous work on migrating the project to React 18, we can now resolve this issue naturally. I've looked at CHANGELOG for both deps and thankfully, only transformLinkUri -> urlTransform migration in SafeMarkdown.tsx is needed. No breaking changes in remark-gfm v4.

Tested manually to ensure no regression.

1. Apostrophes highlighting words are working

Screen.Recording.2026-07-05.at.21.53.15.mov

2. Table is renderable and not err out

Screen.Recording.2026-07-05.at.21.56.00.mov

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A

TESTING INSTRUCTIONS

Green CI for frontier acceptance criterion

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[bito-code-review]

Code Review Agent Run #0156c0

Actionable Suggestions - 0

Review Details

• Files reviewed - 1 · Commit Range: 5a1ad47..55796f6

  • superset-frontend/packages/superset-ui-core/src/components/SafeMarkdown/SafeMarkdown.tsx
• Files skipped - 4

  • .github/dependabot.yml - Reason: Filter setting
  • superset-frontend/package-lock.json - Reason: Filter setting
  • superset-frontend/package.json - Reason: Filter setting
  • superset-frontend/packages/superset-ui-core/package.json - Reason: Filter setting
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.70%. Comparing base (3303d4e) to head (55796f6).

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #41778   +/-   ##
=======================================
  Coverage   64.70%   64.70%           
=======================================
  Files        2686     2686           
  Lines      148626   148626           
  Branches    34298    34298           
=======================================
  Hits        96164    96164           
  Misses      50697    50697           
  Partials     1765     1765           

Flag	Coverage Δ
javascript	69.56% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[rusackas]

Thanks @hainenber, LGTM. Nice to see those dependabot ignores finally come out too.

One thing I dug into before stamping: v9's urlTransform applies to image srcs as well, where the old transformLinkUri only ever saw link hrefs. The blocklist still kills javascript/vbscript/data everywhere and images just get slightly more tolerant of inert custom schemes, so I think that's fine (arguably more consistent with #26211). The function name and docstring still say links-only though... worth a small rename/comment touchup in a follow-up, not blocking.

Approving, and I'll merge soon if there's no objection.