Skip to content

v0.3.0

Choose a tag to compare

View all tags
@chizkidd chizkidd released this 08 Oct 22:47
· 73 commits to main since this release
v0.3.0
33c0dd1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Safer, harder to freeze, and no more third-party scripts.

Security

  • Notebook HTML can no longer contain forms, text boxes, buttons or other form controls, so a notebook can't show a fake sign-in box.
  • Author CSS keeps colors, borders, fonts and layout but loses positioning, z-index and anything that loads a URL. A notebook can't cover the page or restyle the header, and each cell's styles apply to that cell only.
  • Notebooks opened by URL accept only http and https. data:, javascript: and file: links show "Unsupported link".
  • New _headers file: strict Content-Security-Policy (no form submissions, no framing, scripts only from this site and the Cloudflare analytics script), X-Frame-Options, Permissions-Policy, referrer policy.
  • The libraries are served from this site (assets/vendor/), not cdnjs, at current versions with no known advisories: marked 18.0.14, DOMPurify 3.4.16, highlight.js 11.12.0, KaTeX 0.19.0.

Added

  • Output over 1 MB sits behind a "Show output" button.
  • Code cells over 200 KB are shown without syntax colors.
  • An equation over 4,000 characters or nested over 40 levels is shown as plain TeX, as is anything past the first 2,000 equations in a notebook.
  • Local files get the same 10 MB warning as links.
  • A cell that fails to render shows "This cell couldn't be displayed" with its raw source in a collapsible. A broken output shows its own notice and the rest of the cell still renders.
  • New link-preview image, in light and dark versions.

Fixed

  • Output images get their size up front, so the page no longer jumps as images load.
  • Long notebook titles wrap at underscores and dots, in the notebook's own font.
  • pandas Styler tables keep their colors. A leading <style> block used to be dropped.
  • Error and size-warning pages have a proper top-level heading.

Changed

  • Headings no longer get ids from the markdown library. Table-of-contents links still scroll correctly.
Assets 2
Loading