chore(deps): Bump markdown-to-jsx from 9.9.0 to 9.10.1

[dependabot]

Bumps markdown-to-jsx from 9.9.0 to 9.10.1.

Release notes

Sourced from markdown-to-jsx's releases.

markdown-to-jsx@9.10.1

Patch Changes

• 74be92f: Stop importing Node's process module in library source so production builds can replace environment checks correctly. Browser bundles no longer crash when reading those checks.

markdown-to-jsx@9.10.0

Minor Changes

• 02bae9f: Heading ids are generated from each heading's plain text content instead of its raw markdown source. Link destinations, formatting markers, and image alt text no longer leak into the id (for example ## [text](https://e.com) becomes id="text" rather than id="texthttpsecom"). Anchors on headings that contained links, images, or autolinks may change; plain-text headings are unaffected. Duplicate-id suffixes (foo, foo-1) still apply.
• 02bae9f: Rejected image destinations now use null on the parsed AST the same way rejected links already do, so TypeScript consumers can treat ImageNode.target and LinkNode.target as string | null. Compilers still omit src for rejected images and the markdown compiler still re-emits them as ![alt]().
• 4d08fd8: Headings that share the same text now get unique HTML ids automatically (introduction, introduction-1, introduction-2), matching the usual Markdown hosting behavior. A custom slugify still controls the base string; uniqueness is applied afterward, so you no longer need a stateful slugify closure that breaks under React Strict Mode.

Patch Changes

• 02bae9f: Link and image destinations that hide a dangerous scheme behind HTML entities (for example [x](&[#106](https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/issues/106);avascript:alert(1))) are now rejected the same way as a literal javascript: URL. Compilers drop the href for rejected links and omit the src for rejected images. The markdown compiler re-emits a rejected image as !https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD[https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADahttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADlhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADthttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD]https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD(https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD)https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADrhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADahttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADthttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADhhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADehttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADrhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADthttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADhhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADahttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADnhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD`https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD!https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD[https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADahttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADlhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADthttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD]https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD(https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADnhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADuhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADlhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEADlhttps://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD)https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/blob/HEAD`. Direct AST rendering also re-checks link targets before they become hrefs.

• 02bae9f: Single-line <script>, <style>, <pre>, and <textarea> blocks keep their text content when tagfilter is off, including under forceInline. Previously the React output could emit an empty tag and drop the body.

• 4d08fd8: Custom JSX components written in PascalCase, and hyphenated custom elements, keep their markdown children when a blank line appears between the opening and closing tags. Content after the blank no longer leaks out as a sibling of the component.

• e9a253d: Ship an llms.txt cheatsheet with the package and at markdown-to-jsx.quantizor.dev/llms.txt, so coding assistants can pick up the entry points, options, recipes, and AST shapes in a single short read instead of the full README.

  The cheatsheet leads with the questions people actually ask: why a single newline is not a line break, how to wire up a syntax highlighter or KaTeX, opening links in a new tab, restricting which tags render, and the traps around indented template literals and case-sensitive override keys.

  Two documentation corrections come along with it. The HTML entry point example named an export that does not exist; the helper there is astToHTML. And the class added to a fenced code block is language-<lang>, with the older lang-<lang> alongside it on the JSX renderers, rather than lang-<lang> alone as previously written.

• 02bae9f: The markdown compiler now re-emits processing instructions (<?xml ?>), CDATA sections, declarations (<!DOCTYPE html>), and orphan closing tags exactly as written. Previously these were reconstructed as a generic self-closing element, which mangled a processing instruction like <?xml version="1.0"?> down to <? /> and dropped CDATA and declaration content entirely.

• 02bae9f: optimizeForStreaming now defers incomplete HTML the same way in every compiler, including Solid and Vue. Tag-like prefixes that have not finished arriving (Hello <Citation, <!--…) stay hidden until they complete, while ordinary less-than text (5 < 3) keeps rendering.

• 02bae9f: Dangerous url(javascript:…) (and similar) payloads in raw HTML style attributes are now stripped from the HTML and Markdown string outputs, matching the React-family compilers.

• 02bae9f: Table cells that contain a backslash before a pipe are escaped correctly when compiling back to Markdown, so the pipe no longer splits the row on re-parse.

• 02bae9f: Dangerous HTML tags (<script>, <iframe>, <style>, and similar) are escaped by default across the React, HTML, Solid, Vue, and React Native outputs. Matching GFM, only each tag's leading < is neutralized; the body and closing tag stay visible as inert text instead of being dropped. Solid, Vue, and React Native previously rendered these tags live unless tagfilter: true was passed explicitly, and escaped output in every renderer stopped at the opener. Direct calls to astToJSX follow the same default.

Changelog

Sourced from markdown-to-jsx's changelog.

9.10.1

Patch Changes

• 74be92f: Stop importing Node's process module in library source so production builds can replace environment checks correctly. Browser bundles no longer crash when reading those checks.

9.10.0

Minor Changes

• 02bae9f: Heading ids are generated from each heading's plain text content instead of its raw markdown source. Link destinations, formatting markers, and image alt text no longer leak into the id (for example ## [text](https://e.com) becomes id="text" rather than id="texthttpsecom"). Anchors on headings that contained links, images, or autolinks may change; plain-text headings are unaffected. Duplicate-id suffixes (foo, foo-1) still apply.
• 02bae9f: Rejected image destinations now use null on the parsed AST the same way rejected links already do, so TypeScript consumers can treat ImageNode.target and LinkNode.target as string | null. Compilers still omit src for rejected images and the markdown compiler still re-emits them as ![alt]().
• 4d08fd8: Headings that share the same text now get unique HTML ids automatically (introduction, introduction-1, introduction-2), matching the usual Markdown hosting behavior. A custom slugify still controls the base string; uniqueness is applied afterward, so you no longer need a stateful slugify closure that breaks under React Strict Mode.

Patch Changes

• 02bae9f: Link and image destinations that hide a dangerous scheme behind HTML entities (for example [x](&[#106](https://github.com/quantizor/markdown-to-jsx/tree/HEAD/lib/issues/106);avascript:alert(1))) are now rejected the same way as a literal javascript: URL. Compilers drop the href for rejected links and omit the src for rejected images. The markdown compiler re-emits a rejected image as !https://github.com/quantizor/markdown-to-jsx/blob/main/lib[https://github.com/quantizor/markdown-to-jsx/blob/main/libahttps://github.com/quantizor/markdown-to-jsx/blob/main/liblhttps://github.com/quantizor/markdown-to-jsx/blob/main/libthttps://github.com/quantizor/markdown-to-jsx/blob/main/lib]https://github.com/quantizor/markdown-to-jsx/blob/main/lib(https://github.com/quantizor/markdown-to-jsx/blob/main/lib)https://github.com/quantizor/markdown-to-jsx/blob/main/libhttps://github.com/quantizor/markdown-to-jsx/blob/main/lib https://github.com/quantizor/markdown-to-jsx/blob/main/librhttps://github.com/quantizor/markdown-to-jsx/blob/main/libahttps://github.com/quantizor/markdown-to-jsx/blob/main/libthttps://github.com/quantizor/markdown-to-jsx/blob/main/libhhttps://github.com/quantizor/markdown-to-jsx/blob/main/libehttps://github.com/quantizor/markdown-to-jsx/blob/main/librhttps://github.com/quantizor/markdown-to-jsx/blob/main/lib https://github.com/quantizor/markdown-to-jsx/blob/main/libthttps://github.com/quantizor/markdown-to-jsx/blob/main/libhhttps://github.com/quantizor/markdown-to-jsx/blob/main/libahttps://github.com/quantizor/markdown-to-jsx/blob/main/libnhttps://github.com/quantizor/markdown-to-jsx/blob/main/lib https://github.com/quantizor/markdown-to-jsx/blob/main/lib`https://github.com/quantizor/markdown-to-jsx/blob/main/lib!https://github.com/quantizor/markdown-to-jsx/blob/main/lib[https://github.com/quantizor/markdown-to-jsx/blob/main/libahttps://github.com/quantizor/markdown-to-jsx/blob/main/liblhttps://github.com/quantizor/markdown-to-jsx/blob/main/libthttps://github.com/quantizor/markdown-to-jsx/blob/main/lib]https://github.com/quantizor/markdown-to-jsx/blob/main/lib(https://github.com/quantizor/markdown-to-jsx/blob/main/libnhttps://github.com/quantizor/markdown-to-jsx/blob/main/libuhttps://github.com/quantizor/markdown-to-jsx/blob/main/liblhttps://github.com/quantizor/markdown-to-jsx/blob/main/liblhttps://github.com/quantizor/markdown-to-jsx/blob/main/lib)https://github.com/quantizor/markdown-to-jsx/blob/main/lib`. Direct AST rendering also re-checks link targets before they become hrefs.

• 02bae9f: Single-line <script>, <style>, <pre>, and <textarea> blocks keep their text content when tagfilter is off, including under forceInline. Previously the React output could emit an empty tag and drop the body.

• 4d08fd8: Custom JSX components written in PascalCase, and hyphenated custom elements, keep their markdown children when a blank line appears between the opening and closing tags. Content after the blank no longer leaks out as a sibling of the component.

• e9a253d: Ship an llms.txt cheatsheet with the package and at markdown-to-jsx.quantizor.dev/llms.txt, so coding assistants can pick up the entry points, options, recipes, and AST shapes in a single short read instead of the full README.

  The cheatsheet leads with the questions people actually ask: why a single newline is not a line break, how to wire up a syntax highlighter or KaTeX, opening links in a new tab, restricting which tags render, and the traps around indented template literals and case-sensitive override keys.

  Two documentation corrections come along with it. The HTML entry point example named an export that does not exist; the helper there is astToHTML. And the class added to a fenced code block is language-<lang>, with the older lang-<lang> alongside it on the JSX renderers, rather than lang-<lang> alone as previously written.

• 02bae9f: The markdown compiler now re-emits processing instructions (<?xml ?>), CDATA sections, declarations (<!DOCTYPE html>), and orphan closing tags exactly as written. Previously these were reconstructed as a generic self-closing element, which mangled a processing instruction like <?xml version="1.0"?> down to <? /> and dropped CDATA and declaration content entirely.

• 02bae9f: optimizeForStreaming now defers incomplete HTML the same way in every compiler, including Solid and Vue. Tag-like prefixes that have not finished arriving (Hello <Citation, <!--…) stay hidden until they complete, while ordinary less-than text (5 < 3) keeps rendering.

• 02bae9f: Dangerous url(javascript:…) (and similar) payloads in raw HTML style attributes are now stripped from the HTML and Markdown string outputs, matching the React-family compilers.

• 02bae9f: Table cells that contain a backslash before a pipe are escaped correctly when compiling back to Markdown, so the pipe no longer splits the row on re-parse.

• 02bae9f: Dangerous HTML tags (<script>, <iframe>, <style>, and similar) are escaped by default across the React, HTML, Solid, Vue, and React Native outputs. Matching GFM, only each tag's leading < is neutralized; the body and closing tag stay visible as inert text instead of being dropped. Solid, Vue, and React Native previously rendered these tags live unless tagfilter: true was passed explicitly, and escaped output in every renderer stopped at the opener. Direct calls to astToJSX follow the same default.

Commits

• 36c7e2b Version Packages (#892)
• 74be92f fix: keep process.env.NODE_ENV definable in browser bundles
• 8f1435d Version Packages (#889)
• 02bae9f feat: harden defaults, harnesses, and per-entry builds (#891)
• 4d08fd8 feat(parser): dedupe heading ids and preserve component blocks (#890)
• e9a253d docs: ship a machine-oriented llms.txt cheatsheet
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Auto-approved: version-update:semver-minor