Skip to content

[pull] main from Milkdown:main#210

Merged
pull[bot] merged 4 commits into
code:mainfrom
Milkdown:main
May 13, 2026
Merged

[pull] main from Milkdown:main#210
pull[bot] merged 4 commits into
code:mainfrom
Milkdown:main

Conversation

@pull
Copy link
Copy Markdown

@pull pull Bot commented May 13, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

ocavue and others added 4 commits May 13, 2026 01:41
* chore: config renovate to pin github actions

* format code
…fe (#2365)

Calling `createSvgAwareSanitizer()` at module top-level breaks any
server-side import of this module: on Node `DOMPurify()` returns a
stub without `.addHook`, so the registration throws
`TypeError: purify.addHook is not a function` the moment the module
is loaded (e.g. during Next.js page-data collection).

Defer the sanitizer construction to the first sanitize call, which
only happens inside `watchEffect` in the browser.
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…2366)

The OpenAI and Anthropic providers stripped trailing slashes from a
caller-supplied `baseURL` with `replace(/\/+$/, '')`. The `\/+$` pattern
backtracks quadratically on inputs that contain runs of `/` not at the
very end, which CodeQL flagged as js/polynomial-redos (alerts #2, #3).
Replace the regex with a linear `stripTrailingSlashes` helper in the
shared module and use it from both providers.
@pull pull Bot locked and limited conversation to collaborators May 13, 2026
@pull pull Bot added the ⤵️ pull label May 13, 2026
@pull pull Bot merged commit 32c3371 into code:main May 13, 2026
2 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants