Email addresses rendered as blocked link

[tilekus]

Bug Description

All email addresses rendered as blocked link.

Steps to Reproduce

Pass email address to Streamdown.

Expected Behavior

render as email link or even just normal string

Actual Behavior

Blocked link

Code Sample

<Streamdown
   parseIncompleteMarkdown={true}
>
    {'example@gmail.com'}
</Streamdown>

Streamdown Version

1.3.0

React Version

19.1.0

Node.js Version

22.19.0

Browser(s)

Chrome, Firefox, Safari, Other

Operating System

macOS

Additional Context

No response

[sepehr500]

@tilekus I got around this issue by adding the following

         <Streamdown
            defaultOrigin={window.location.origin}
            allowedLinkPrefixes={["mailto:", "*"]}

It is explicitly an issue with this part of rehype-harden. https://github.com/vercel-labs/markdown-sanitizers/blob/7c5af58cf0ad752d60a4a8a905e5d928493e9777/rehype-harden/src/index.ts#L112

honestly...I have been having many issues with the sanitization being too strict. Would love a way to opt out.

[haydenbleasel]

Fixed this in harden-react-markdown and bumped the deps here. Will be fixed in next release 👍

Thanks for reporting!