MDViewer 1.2.1

MDViewer 1.2.1

Maintenance release.

• Third-party license notices in the app — the open-source license and copyright notices (marked, Shiki, KaTeX, Mermaid, DOMPurify) are now shown in the About panel's Credits area (App menu → About MDViewer), so they ship inside the app as the MIT / Apache-2.0 / MPL-2.0 licenses expect — not only in the repository.
• Added a copyright line to the About panel.

No changes to rendering, the remote-content policy, or the App Sandbox. Notarized & stapled. Requires macOS 14 or later.

MDViewer 1.2.0

MDViewer 1.2.0

A security-hardening release. MDViewer now runs inside the macOS App Sandbox and gives you explicit control over remote content, alongside output sanitization, a strict Content-Security-Policy, and refreshed rendering libraries.

App Sandbox

• Runs sandboxed (com.apple.security.app-sandbox), limiting filesystem/network reach.
• File access via security-scoped bookmarks; the last-opened document reliably reopens across launches.
• On-demand folder access: documents referencing local images prompt to grant access to their folder (remembered per folder) — relative images render without exposing your whole disk.
• Remote images load only when allowed (network-client entitlement).

Remote-content controls (Privacy)

• New Privacy preference: remote http/https images gated by policy — Ask (per document), Always, or Never.
• Quick Look always blocks remote content.

Content-injection hardening

• Rendered Markdown sanitized with DOMPurify before insertion.
• Strict CSP enforced via response header; renderer served through a custom local scheme (no file:// origin).
• Clicked links restricted to http/https/mailto and local Markdown.

Dependency updates (provenance recorded)

• marked 12 → 18.0.6, KaTeX 0.16.11 → 0.17.0, Mermaid 10.9.5 → 11.16.0; syntax highlighting rebuilt from official Shiki 4.3.1 (40 languages).

Fixes

• Fixed a rendering regression that blanked documents containing headings.
• Quick Look previews render reliably (deterministic snapshot) and block remote content.

Notarized & stapled. Requires macOS 14 or later.

MDViewer 1.1.3

MDViewer 1.1.3

Added

• Quick Look preview — press Space on a .md file in Finder to see it fully rendered (syntax highlighting, KaTeX math, Mermaid diagrams) without opening the app.

Changed

• Added the MIT LICENSE and credited original author Masanori Sakai (@Masakai).
• Internal documentation and code comments translated to English.

---

Signed with Developer ID and notarized by Apple — opens cleanly through Gatekeeper.
Requires macOS 14 (Sonoma) or later. Universal (Apple Silicon + Intel).