chore(deps): bump markdown-to-jsx from 7.7.3 to 9.10.2

[dependabot]

Bumps markdown-to-jsx from 7.7.3 to 9.10.2.

Release notes

Sourced from markdown-to-jsx's releases.

markdown-to-jsx@9.10.2

Patch Changes

• 2401d28, b8ef1d5: Markdown with long runs of brackets or footnote markers now parses in linear time instead of slowing to a crawl. Inputs such as thousands of repeated [ or [^ could previously take seconds to minutes, which mattered most when rendering untrusted input on a server.

  Found by Team Atlanta, collected and verified by OSTIF, reported with a fix by smaury of Shielder.

markdown-to-jsx@9.10.1

Patch Changes

• 74be92f: Stop importing Node's process module in library source so production builds can replace environment checks correctly. Browser bundles no longer crash when reading those checks.

markdown-to-jsx@9.10.0

Minor Changes

• 02bae9f: Heading ids are generated from each heading's plain text content instead of its raw markdown source. Link destinations, formatting markers, and image alt text no longer leak into the id (for example ## [text](https://e.com) becomes id="text" rather than id="texthttpsecom"). Anchors on headings that contained links, images, or autolinks may change; plain-text headings are unaffected. Duplicate-id suffixes (foo, foo-1) still apply.
• 02bae9f: Rejected image destinations now use null on the parsed AST the same way rejected links already do, so TypeScript consumers can treat ImageNode.target and LinkNode.target as string | null. Compilers still omit src for rejected images and the markdown compiler still re-emits them as ![alt]().
• 4d08fd8: Headings that share the same text now get unique HTML ids automatically (introduction, introduction-1, introduction-2), matching the usual Markdown hosting behavior. A custom slugify still controls the base string; uniqueness is applied afterward, so you no longer need a stateful slugify closure that breaks under React Strict Mode.

Patch Changes

• 02bae9f: Link and image destinations that hide a dangerous scheme behind HTML entities (for example [x](&[#106](https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/issues/106);avascript:alert(1))) are now rejected the same way as a literal javascript: URL. Compilers drop the href for rejected links and omit the src for rejected images. The markdown compiler re-emits a rejected image as !https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD[https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADahttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADlhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADthttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD]https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD(https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD)https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADrhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADahttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADthttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADhhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADehttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADrhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADthttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADhhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADahttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADnhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD`https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD!https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD[https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADahttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADlhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADthttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD]https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD(https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADnhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADuhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADlhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADlhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD)https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD`. Direct AST rendering also re-checks link targets before they become hrefs.

• 02bae9f: Single-line <script>, <style>, <pre>, and <textarea> blocks keep their text content when tagfilter is off, including under forceInline. Previously the React output could emit an empty tag and drop the body.

• 4d08fd8: Custom JSX components written in PascalCase, and hyphenated custom elements, keep their markdown children when a blank line appears between the opening and closing tags. Content after the blank no longer leaks out as a sibling of the component.

• e9a253d: Ship an llms.txt cheatsheet with the package and at markdown-to-jsx.quantizor.dev/llms.txt, so coding assistants can pick up the entry points, options, recipes, and AST shapes in a single short read instead of the full README.

  The cheatsheet leads with the questions people actually ask: why a single newline is not a line break, how to wire up a syntax highlighter or KaTeX, opening links in a new tab, restricting which tags render, and the traps around indented template literals and case-sensitive override keys.

  Two documentation corrections come along with it. The HTML entry point example named an export that does not exist; the helper there is astToHTML. And the class added to a fenced code block is language-<lang>, with the older lang-<lang> alongside it on the JSX renderers, rather than lang-<lang> alone as previously written.

• 02bae9f: The markdown compiler now re-emits processing instructions (<?xml ?>), CDATA sections, declarations (<!DOCTYPE html>), and orphan closing tags exactly as written. Previously these were reconstructed as a generic self-closing element, which mangled a processing instruction like <?xml version="1.0"?> down to <? /> and dropped CDATA and declaration content entirely.

• 02bae9f: optimizeForStreaming now defers incomplete HTML the same way in every compiler, including Solid and Vue. Tag-like prefixes that have not finished arriving (Hello <Citation, <!--…) stay hidden until they complete, while ordinary less-than text (5 < 3) keeps rendering.

• 02bae9f: Dangerous url(javascript:…) (and similar) payloads in raw HTML style attributes are now stripped from the HTML and Markdown string outputs, matching the React-family compilers.

• 02bae9f: Table cells that contain a backslash before a pipe are escaped correctly when compiling back to Markdown, so the pipe no longer splits the row on re-parse.

• 02bae9f: Dangerous HTML tags (<script>, <iframe>, <style>, and similar) are escaped by default across the React, HTML, Solid, Vue, and React Native outputs. Matching GFM, only each tag's leading < is neutralized; the body and closing tag stay visible as inert text instead of being dropped. Solid, Vue, and React Native previously rendered these tags live unless tagfilter: true was passed explicitly, and escaped output in every renderer stopped at the opener. Direct calls to astToJSX follow the same default.

markdown-to-jsx@9.9.0

Minor Changes

• 373595c: React Native output now ships with a clean, minimal default look so markdown renders with a readable hierarchy out of the box: a heading size cascade, monospace code, spacing between blocks, a blockquote rule, a proper table with a header row and aligned columns, and GFM task items with a drawn checkbox in place of the bullet. Everything stays fully customizable, each element merges your styles over the defaults per property, styles.text sets a base font and color for all text at once, and any element can be replaced with your own component via overrides.
• 373595c: React Native output now exposes a style key for every element it draws, so nothing is stuck with a built-in look. New styles keys: checkmark and gfmTaskChecked (the checkmark glyph and the checked-box accent of a GFM task item), tableHeaderText (the bold header run), and tableCellDivider and tableRowDivider (the table grid lines). These join the existing bullet, number, and per-element keys, and each merges over the default so you can restyle just what you want. Blockquotes also render tighter: the last paragraph inside no longer leaves extra space below it.
• 373595c: The optimizeForStreaming option now works in the React Native renderer. Previously it was ignored on native, so incomplete markdown flashed raw syntax between tokens; it now suppresses partial structures the same way the web renderers do, which makes streaming LLM responses read smoothly.

Patch Changes

• 8c01560: The Markdown output compiler now produces Markdown that parses back to the same document across many more constructs. Literal special characters in text are escaped so they stay literal, tables emit outer pipes and escape cell pipes, loose lists keep their spacing instead of collapsing to tight, fenced and inline code widen their delimiters past any backticks inside, link and image titles containing quotes are escaped, raw HTML attributes keep their original values instead of being mangled, and an empty inline element like <video></video> no longer splits the surrounding paragraph.
• 373595c: React Native footnote references now render as a superscript, matching the web renderers, instead of bold. Numeric markers use Unicode superscript characters so they sit raised and scale with the surrounding text, and you can style them with the new styles.footnote option. In the footnotes list, each note now reads on one line next to its number instead of below it.
• 373595c: Fixed React key warnings in React Native when raw HTML mixed with other content, such as a <div> holding paragraphs with text between them, or a custom component following a heading. These elements now receive unique keys.
• 373595c: React Native no longer crashes when rendering content that mixes text with block elements or images. Previously, text placed next to a block (in a list, table cell, raw HTML block, preformatted block, or footnote) threw "Text strings must be rendered within a <Text> component", and an image inside a paragraph, heading, link, or emphasis threw "Unexpected view type nested under text node" on Android. Now a container follows its content: it stays a text element when everything inside is inline, and becomes a view (grouping text runs while laying images and blocks out alongside) when it holds a block. Image links remain tappable.
• 373595c: Faster React Native rendering: compiling a large document now runs roughly 5-7% quicker, with the biggest gains on list- and heading-heavy content. Output is unchanged.

... (truncated)

Changelog

Sourced from markdown-to-jsx's changelog.

9.10.2

Patch Changes

• 2401d28, b8ef1d5: Markdown with long runs of brackets or footnote markers now parses in linear time instead of slowing to a crawl. Inputs such as thousands of repeated [ or [^ could previously take seconds to minutes, which mattered most when rendering untrusted input on a server.

  Found by Team Atlanta, collected and verified by OSTIF, reported with a fix by smaury of Shielder.

9.10.1

Patch Changes

• 74be92f: Stop importing Node's process module in library source so production builds can replace environment checks correctly. Browser bundles no longer crash when reading those checks.

9.10.0

Minor Changes

• 02bae9f: Heading ids are generated from each heading's plain text content instead of its raw markdown source. Link destinations, formatting markers, and image alt text no longer leak into the id (for example ## [text](https://e.com) becomes id="text" rather than id="texthttpsecom"). Anchors on headings that contained links, images, or autolinks may change; plain-text headings are unaffected. Duplicate-id suffixes (foo, foo-1) still apply.
• 02bae9f: Rejected image destinations now use null on the parsed AST the same way rejected links already do, so TypeScript consumers can treat ImageNode.target and LinkNode.target as string | null. Compilers still omit src for rejected images and the markdown compiler still re-emits them as ![alt]().
• 4d08fd8: Headings that share the same text now get unique HTML ids automatically (introduction, introduction-1, introduction-2), matching the usual Markdown hosting behavior. A custom slugify still controls the base string; uniqueness is applied afterward, so you no longer need a stateful slugify closure that breaks under React Strict Mode.

Patch Changes

• 02bae9f: Link and image destinations that hide a dangerous scheme behind HTML entities (for example [x](&[#106](https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/issues/106);avascript:alert(1))) are now rejected the same way as a literal javascript: URL. Compilers drop the href for rejected links and omit the src for rejected images. The markdown compiler re-emits a rejected image as !https://github.com/quantizor/markdown-to-jsx/blob/main/lib[https://github.com/quantizor/markdown-to-jsx/blob/main/libahttps://github.com/quantizor/markdown-to-jsx/blob/main/liblhttps://github.com/quantizor/markdown-to-jsx/blob/main/libthttps://github.com/quantizor/markdown-to-jsx/blob/main/lib]https://github.com/quantizor/markdown-to-jsx/blob/main/lib(https://github.com/quantizor/markdown-to-jsx/blob/main/lib)https://github.com/quantizor/markdown-to-jsx/blob/main/libhttps://github.com/quantizor/markdown-to-jsx/blob/main/lib https://github.com/quantizor/markdown-to-jsx/blob/main/librhttps://github.com/quantizor/markdown-to-jsx/blob/main/libahttps://github.com/quantizor/markdown-to-jsx/blob/main/libthttps://github.com/quantizor/markdown-to-jsx/blob/main/libhhttps://github.com/quantizor/markdown-to-jsx/blob/main/libehttps://github.com/quantizor/markdown-to-jsx/blob/main/librhttps://github.com/quantizor/markdown-to-jsx/blob/main/lib https://github.com/quantizor/markdown-to-jsx/blob/main/libthttps://github.com/quantizor/markdown-to-jsx/blob/main/libhhttps://github.com/quantizor/markdown-to-jsx/blob/main/libahttps://github.com/quantizor/markdown-to-jsx/blob/main/libnhttps://github.com/quantizor/markdown-to-jsx/blob/main/lib https://github.com/quantizor/markdown-to-jsx/blob/main/lib`https://github.com/quantizor/markdown-to-jsx/blob/main/lib!https://github.com/quantizor/markdown-to-jsx/blob/main/lib[https://github.com/quantizor/markdown-to-jsx/blob/main/libahttps://github.com/quantizor/markdown-to-jsx/blob/main/liblhttps://github.com/quantizor/markdown-to-jsx/blob/main/libthttps://github.com/quantizor/markdown-to-jsx/blob/main/lib]https://github.com/quantizor/markdown-to-jsx/blob/main/lib(https://github.com/quantizor/markdown-to-jsx/blob/main/libnhttps://github.com/quantizor/markdown-to-jsx/blob/main/libuhttps://github.com/quantizor/markdown-to-jsx/blob/main/liblhttps://github.com/quantizor/markdown-to-jsx/blob/main/liblhttps://github.com/quantizor/markdown-to-jsx/blob/main/lib)https://github.com/quantizor/markdown-to-jsx/blob/main/lib`. Direct AST rendering also re-checks link targets before they become hrefs.

• 02bae9f: Single-line <script>, <style>, <pre>, and <textarea> blocks keep their text content when tagfilter is off, including under forceInline. Previously the React output could emit an empty tag and drop the body.

• 4d08fd8: Custom JSX components written in PascalCase, and hyphenated custom elements, keep their markdown children when a blank line appears between the opening and closing tags. Content after the blank no longer leaks out as a sibling of the component.

• e9a253d: Ship an llms.txt cheatsheet with the package and at markdown-to-jsx.quantizor.dev/llms.txt, so coding assistants can pick up the entry points, options, recipes, and AST shapes in a single short read instead of the full README.

  The cheatsheet leads with the questions people actually ask: why a single newline is not a line break, how to wire up a syntax highlighter or KaTeX, opening links in a new tab, restricting which tags render, and the traps around indented template literals and case-sensitive override keys.

  Two documentation corrections come along with it. The HTML entry point example named an export that does not exist; the helper there is astToHTML. And the class added to a fenced code block is language-<lang>, with the older lang-<lang> alongside it on the JSX renderers, rather than lang-<lang> alone as previously written.

• 02bae9f: The markdown compiler now re-emits processing instructions (<?xml ?>), CDATA sections, declarations (<!DOCTYPE html>), and orphan closing tags exactly as written. Previously these were reconstructed as a generic self-closing element, which mangled a processing instruction like <?xml version="1.0"?> down to <? /> and dropped CDATA and declaration content entirely.

• 02bae9f: optimizeForStreaming now defers incomplete HTML the same way in every compiler, including Solid and Vue. Tag-like prefixes that have not finished arriving (Hello <Citation, <!--…) stay hidden until they complete, while ordinary less-than text (5 < 3) keeps rendering.

• 02bae9f: Dangerous url(javascript:…) (and similar) payloads in raw HTML style attributes are now stripped from the HTML and Markdown string outputs, matching the React-family compilers.

• 02bae9f: Table cells that contain a backslash before a pipe are escaped correctly when compiling back to Markdown, so the pipe no longer splits the row on re-parse.

• 02bae9f: Dangerous HTML tags (<script>, <iframe>, <style>, and similar) are escaped by default across the React, HTML, Solid, Vue, and React Native outputs. Matching GFM, only each tag's leading < is neutralized; the body and closing tag stay visible as inert text instead of being dropped. Solid, Vue, and React Native previously rendered these tags live unless tagfilter: true was passed explicitly, and escaped output in every renderer stopped at the opener. Direct calls to astToJSX follow the same default.

9.9.0

Minor Changes

• 373595c: React Native output now ships with a clean, minimal default look so markdown renders with a readable hierarchy out of the box: a heading size cascade, monospace code, spacing between blocks, a blockquote rule, a proper table with a header row and aligned columns, and GFM task items with a drawn checkbox in place of the bullet. Everything stays fully customizable, each element merges your styles over the defaults per property, styles.text sets a base font and color for all text at once, and any element can be replaced with your own component via overrides.
• 373595c: React Native output now exposes a style key for every element it draws, so nothing is stuck with a built-in look. New styles keys: checkmark and gfmTaskChecked (the checkmark glyph and the checked-box accent of a GFM task item), tableHeaderText (the bold header run), and tableCellDivider and tableRowDivider (the table grid lines). These join the existing bullet, number, and per-element keys, and each merges over the default so you can restyle just what you want. Blockquotes also render tighter: the last paragraph inside no longer leaves extra space below it.
• 373595c: The optimizeForStreaming option now works in the React Native renderer. Previously it was ignored on native, so incomplete markdown flashed raw syntax between tokens; it now suppresses partial structures the same way the web renderers do, which makes streaming LLM responses read smoothly.

Patch Changes

• 8c01560: The Markdown output compiler now produces Markdown that parses back to the same document across many more constructs. Literal special characters in text are escaped so they stay literal, tables emit outer pipes and escape cell pipes, loose lists keep their spacing instead of collapsing to tight, fenced and inline code widen their delimiters past any backticks inside, link and image titles containing quotes are escaped, raw HTML attributes keep their original values instead of being mangled, and an empty inline element like <video></video> no longer splits the surrounding paragraph.

... (truncated)

Commits

• 6b6141d Version Packages (#895)
• 2401d28 fix(parser): parse bracket and footnote runs in linear time
• 36c7e2b Version Packages (#892)
• 74be92f fix: keep process.env.NODE_ENV definable in browser bundles
• 8f1435d Version Packages (#889)
• 02bae9f feat: harden defaults, harnesses, and per-entry builds (#891)
• 4d08fd8 feat(parser): dedupe heading ids and preserve component blocks (#890)
• e9a253d docs: ship a machine-oriented llms.txt cheatsheet
• ab4affb Version Packages
• ab45557 docs: raw-HTML sanitization guide, translations, and rebuilt site
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for markdown-to-jsx since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependabot. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.