0.1.5

Security

• A list-valued URL attribute is probed at every candidate, not at its head. srcset="safe.png 1x, javascript:alert(1) 2x" passed the probe on its second entry, because the value vouched for itself from its leading scheme. Comes from carve-php 0.1.5, now the required floor. Upgrade if you render untrusted Carve or import untrusted HTML.

Breaking

• Rendered output changes with the engine: a list-table header cell carries scope, and the Markdown target escapes < only where it would open markup and leaves a bare ampersand alone.

Fixes

• The render cache no longer serves one converter's HTML to another: the cache key identifies the converter's settings, not just the source.

Improvements

• Per-converter symbol replacements (symbols) and source-line attributes (source_lines).

Full Changelog: 0.1.4...0.1.5

0.1.4

Dependency and maintenance release: require carve-php ^0.1.4, pin php-collective/code-sniffer to the tagged ^0.6.0 series, and update GitHub Actions runtimes.

0.1.3

Improvements

• plantuml extension shorthand on ExtensionFactory.
• TYPE_* constants and a types() method on ExtensionFactory.
• img_fence shorthand for the carve-php sanitized SVG image fence.
• Require carve-php ^0.1.3 (cross-engine convergence: strict column-0, unresolved footnote-ref stays literal, tight-item trailing text, list looseness).

Full Changelog: 0.1.2...0.1.3

0.1.2

Improvements

• toMarkdown() and toAnsi() on the converter, the manager and the Carve facade - render the same source as Markdown or ANSI terminal output alongside HTML and plain text

Full Changelog: 0.1.1...0.1.2

0.1.1

Fixes

• Corrected the code-sniffer dev dependency name left over from the template adaptation
• CI matrix runs on Laravel 12 and 13 (Laravel 11 is EOL and blocked by Composer's security-advisory policy on fresh installs; the package constraint keeps allowing it for existing applications)

Full Changelog: 0.1.0...0.1.1

0.1.0

Initial release of the Carve markup integration for Laravel.

• Blade directives: @carve, @carveRaw, @carveText
• Carve facade and CarveManager with named converter profiles
• Config-driven profiles: safe mode, render mode (interactive/static graceful degradation), soft-break mode, XHTML output, extensions
• Extension factory covering the carve-php extension set
• ValidCarve validation rule
• Content-hash-keyed render caching via any Laravel cache store

Full Changelog: https://github.com/markup-carve/laravel-carve/commits/0.1.0