6aeedeb401
Replace marked.js with markdown-it to eliminate ReDoS vulnerability (#36213). Behavior remains consistent with original marked.js except for task lists (- [ ] / - [x]) which now render as checkboxes via markdown-it-task-lists. To preserve marked.js behavior: - Enable GFM strikethrough (~~text~~) - Disable fuzzyLink to avoid auto-linking bare filenames like README.md - Add www. autolink validator per GFM spec (trailing punctuation, balanced parens) - Override html_block/html_inline to escape raw HTML - Override image renderer: alt text for remote URLs, allow base64 data URIs - Override fence/code_block: copy button and JSON collapse - Dangerous schemes (javascript:, vbscript:, file:) sanitized by DOMPurify New: task-list checkbox styling for .chat-text, .sidebar-markdown, .chat-thinking Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
27 lines
600 B
JSON
27 lines
600 B
JSON
{
|
|
"name": "openclaw-control-ui",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"build": "vite build",
|
|
"dev": "vite",
|
|
"preview": "vite preview",
|
|
"test": "vitest run --config vitest.config.ts"
|
|
},
|
|
"dependencies": {
|
|
"@noble/ed25519": "3.0.1",
|
|
"dompurify": "^3.3.3",
|
|
"lit": "^3.3.2",
|
|
"markdown-it": "^14.1.1",
|
|
"markdown-it-task-lists": "^2.1.1"
|
|
},
|
|
"devDependencies": {
|
|
"@types/markdown-it": "^14.1.2",
|
|
"@vitest/browser-playwright": "4.1.0",
|
|
"jsdom": "^29.0.0",
|
|
"playwright": "^1.58.2",
|
|
"vite": "8.0.0",
|
|
"vitest": "4.1.0"
|
|
}
|
|
}
|