Release v1.9.0

Security

• Fixed a stored cross-site scripting vulnerability in Markdown rendering.
• Breaking change: User-authored inline HTML, CSS, and JavaScript no longer render in Markdown documents. Wiki-Go Markdown extensions remain supported.
• Affected versions: v1.2.0 through v1.8.13.
• Upgrade to v1.9.0 or later.
• Reported by @0xbassiouny1337.
• See GHSA-fwwj-gjg9-65gr for details.

New feature

• Chapter links sidebar by @cmatsuoka

Commits

• Merge pull request #187 from leomoon-studios/dev (4fd20d9 by Amin Persia)
• Adds close chapter-links on mobile on outside tap (d41e277 by Amin Persia)
• Merge secure chapter links integration into dev (ef2d3e5 by Amin Persia)
• Add permanent security and regression coverage (f6c574e by Amin Persia)
• Localizes and hardens the panel controls (80aaf9c by Amin Persia)
• Preserve inline TOC behavior with chapter links and refine styling (4d317a5 by Amin Persia)
• Makes chapter links state CSP compatible (19c2872 by Amin Persia)
• Safely render chapter links from typed headings (e458284 by Amin Persia)
• Exposes trusted chapter heading metadata (42d5033 by Amin Persia)
• Merge PR #186 chapter links into dev (bd0b128 by Amin Persia)
• Make the side panel tab movable on mobile (02c856d by Claudio Matsuoka)
• Fix side panel on mobile (def3ed7 by Claudio Matsuoka)
• Use retracted instead of collapsed for chapter links panel (915aca9 by Claudio Matsuoka)
• Refactor code block mark detection (ec3445d by Claudio Matsuoka)
• Make page title bold in the side panel (919bd33 by Claudio Matsuoka)
• Fix rearrangement of side panel contents (7e8054c by Claudio Matsuoka)
• Add show/retract button to chapter links side panel (55b7e6d by Claudio Matsuoka)
• Implement chapter links (55d38d2 by Claudio Matsuoka)
• Prepare for the chapter links feature (5c5e605 by Claudio Matsuoka)
• Updates SECURITY.md (6cb2ee5 by Amin Persia)
• Fixes bad links indicator regression (e1f1228 by Amin Persia)
• Security: harden sessions and trusted proxy handling (2449c3b by Amin Persia)
• Fixes regression on favicons not loading in link pages (f698857 by Amin Persia)
• Security (csp): enforce a restrictive page security policy (c8db525 by Amin Persia)
• Security (svg): replace regex sanitization with an XML allowlist (f16f2ab by Amin Persia)
• Security (html): restrict trusted HTML conversion points (b7a790a by Amin Persia)
• Fixes shortcode regression (713edfa by Amin Persia)
• Security (markdown): disable raw HTML in document renderers (f893388 by Amin Persia)
• Fixes github style admonition regression (a9b71d5 by Amin Persia)
• Security (markdown): harden kanban and links rendering (e707a62 by Amin Persia)
• Security (markdown): safely render formatting and navigation extensions (1a5faaf by Amin Persia)
• Security (markdown): validate and safely render media extensions (73d415a by Amin Persia)
• Security (markdown): safely render direction and Mermaid blocks (71ac014 by Amin Persia)
• Security (markdown): add trusted nodes for Wiki-Go extensions (8eb0961 by Amin Persia)
• Security (markdown): render comments without unsafe HTML (d3b0132 by Amin Persia)
• Updates rest-api-examples.http file (6e57ef2 by Amin Persia)
• PR 181 follow up (c8d7538 by Amin Persia)
• Improve side panel expand/collapse behavior (#181) (2677ab6 by Claudio Matsuoka)