Val Alexander 9315302516 fix(ui): replace marked.js with markdown-it to fix ReDoS UI freeze (#46707) thanks @zhangfnf ...

Replace marked.js with markdown-it for the control UI chat markdown renderer
to eliminate a ReDoS vulnerability that could freeze the browser tab.

- Configure markdown-it with custom renderers matching marked.js output
- Add GFM www-autolink with trailing punctuation stripping per spec
- Escape raw HTML via html_block/html_inline overrides
- Flatten remote images to alt text, preserve base64 data URI images
- Add task list support via markdown-it-task-lists plugin
- Trim trailing CJK characters from auto-linked URLs (RFC 3986)
- Keep marked dependency for agents-panels-status-files.ts usage

Co-authored-by: zhangfan49 <zhangfan49@baidu.com>
Co-authored-by: Nova <nova@openknot.ai>

2026-04-13 16:08:35 -05:00

..

public

…

src

fix(ui): replace marked.js with markdown-it to fix ReDoS UI freeze (#46707) thanks @zhangfnf

2026-04-13 16:08:35 -05:00

AGENTS.md

docs(agents): split scoped workflow guidance (#65241)

2026-04-12 09:09:50 +01:00

CLAUDE.md

docs(agents): split scoped workflow guidance (#65241)

2026-04-12 09:09:50 +01:00

index.html

…

package.json

fix(ui): replace marked.js with markdown-it to fix ReDoS UI freeze (#46707) thanks @zhangfnf

2026-04-13 16:08:35 -05:00

vite.config.ts

…

vitest.config.ts

test: move Vitest configs under test

2026-04-10 13:44:51 +01:00

vitest.node.config.ts

test: move Vitest configs under test

2026-04-10 13:44:51 +01:00