v1.1.7

Security

• Markdown→HTML XSS hardening: the /changelog/ page reads vendor/lumasync/CHANGELOG.md from the pinned submodule, parses it with marked, and injects the result via Astro's set:html. Because marked preserves inline raw HTML, an upstream payload (<script> / onclick= etc.) would have rendered verbatim into the deployed page. The parsed HTML now passes through DOMPurify.sanitize() (via isomorphic-dompurify for SSR) before being assigned, so unsafe tags and attributes are stripped at build time. Defends against a supply-chain compromise of the vendor changelog content path.