Release v0.24.0
Literal braces reach your messages, and pre-rendered pages get the runtime's full protection. Rich text now decodes numeric HTML entities ({ and { style), so a message can finally show a literal { or } without confusing the placeholder syntax. In the same pass, verbaly render closes a gap with the runtime: translated attributes in static HTML now go through the exact same security guards as the browser interpreter. No breaking changes.
Highlights
- Messages can now show literal curly braces. Write
{and}in a rich message and they render as{and}. Before, a raw brace broke the placeholder syntax and the entity came out as literal text, so there was no way to display one. Hex forms like{work too, in the browser, in every<Trans>and in pre-rendered pages. - Pre-rendered pages are now as safe as the browser.
verbaly rendertranslates attributes with the same rules the runtime always used: unsafe links (javascript:and friends) never land in the HTML, and dangerous attributes likestyleandsrcdocare never written from translations.
For the full details of this release, see the repository changelog.