Replace the custom Markdown renderer #269

Merged

erik merged 1 commit from feat/task-9ce89ffa-markdown-renderer into main

2026-07-24 12:01:43 -05:00

erik commented

2026-07-24 10:52:06 -05:00

Owner

Summary

Replace the handwritten public Markdown renderer with markdown-it so imported posts support standard Markdown while raw HTML remains disabled.

Task

Task: #task-9ce89ffa

Changes

Add the latest stable markdown-it runtime and TypeScript declarations to the site template workspace.
Centralize Markdown rendering in a reusable configured parser with raw HTML disabled.
Preserve rel="noopener noreferrer" on external HTTP and email links.
Support semantic headings, emphasis, links, relative images, ordered and unordered lists, blockquotes, inline code, and fenced code blocks with language classes.
Remove the handwritten block and inline parsing functions from the public template.
Add focused parser security/semantics tests and article/link route coverage.

Testing

./scripts/pre-pr.sh
27 visual tests
Manual browser verification of imported daily-process fenced bash blocks

Checklist

Unit tests added/updated
Raw HTML remains non-executable
Tailwind Typography prose styling remains applied
No unrelated changes included

## Summary Replace the handwritten public Markdown renderer with `markdown-it` so imported posts support standard Markdown while raw HTML remains disabled. ## Task Task: #task-9ce89ffa ## Changes - Add the latest stable `markdown-it` runtime and TypeScript declarations to the site template workspace. - Centralize Markdown rendering in a reusable configured parser with raw HTML disabled. - Preserve `rel="noopener noreferrer"` on external HTTP and email links. - Support semantic headings, emphasis, links, relative images, ordered and unordered lists, blockquotes, inline code, and fenced code blocks with language classes. - Remove the handwritten block and inline parsing functions from the public template. - Add focused parser security/semantics tests and article/link route coverage. ## Testing - [x] `./scripts/pre-pr.sh` - [x] 27 visual tests - [x] Manual browser verification of imported `daily-process` fenced `bash` blocks ## Checklist - [x] Unit tests added/updated - [x] Raw HTML remains non-executable - [x] Tailwind Typography `prose` styling remains applied - [x] No unrelated changes included

erik added 1 commit

2026-07-24 10:52:06 -05:00

feat: replace custom Markdown renderer

CI / build-lint-test (pull_request) Successful in 2m8s

Details

fae788318e

Use markdown-it with raw HTML disabled so imported posts support standard Markdown, fenced code blocks, and safe links without maintaining a handwritten parser.\n\nTask: #task-9ce89ffa

erik commented

2026-07-24 10:55:07 -05:00

Author

Owner

Review summary

PR #269 cleanly replaces the handwritten public Markdown parser with the latest stable markdown-it, keeps raw HTML disabled, preserves external-link safety attributes, and retains the existing Tailwind Typography wrappers. Focused parser tests cover standard Markdown and unsafe input, while article and link route tests verify fenced code, blockquotes, images, and escaped scripts in rendered pages.

Acceptance criteria

Met: The handwritten block and inline Markdown functions are removed from public.tsx.
Met: Headings, links, images, emphasis, lists, blockquotes, code spans, and fenced code render as semantic HTML.
Met: Fenced bash content renders through language-bash code blocks with commands preserved.
Met: Raw HTML is disabled and script markup is escaped; unsafe JavaScript links are rejected.
Met: Public post output remains inside the existing Tailwind Typography prose wrappers.
Met: Article, link, parser semantics, and malicious-input tests are included.
Met: Formatting, lint, typecheck, full tests, 27 visual tests, manual browser verification, and Forgejo CI pass.

Blocking issues

None.

Warnings

None.

Verdict

Approved.

### Review summary PR #269 cleanly replaces the handwritten public Markdown parser with the latest stable `markdown-it`, keeps raw HTML disabled, preserves external-link safety attributes, and retains the existing Tailwind Typography wrappers. Focused parser tests cover standard Markdown and unsafe input, while article and link route tests verify fenced code, blockquotes, images, and escaped scripts in rendered pages. ### Acceptance criteria - **Met:** The handwritten block and inline Markdown functions are removed from `public.tsx`. - **Met:** Headings, links, images, emphasis, lists, blockquotes, code spans, and fenced code render as semantic HTML. - **Met:** Fenced `bash` content renders through `language-bash` code blocks with commands preserved. - **Met:** Raw HTML is disabled and script markup is escaped; unsafe JavaScript links are rejected. - **Met:** Public post output remains inside the existing Tailwind Typography `prose` wrappers. - **Met:** Article, link, parser semantics, and malicious-input tests are included. - **Met:** Formatting, lint, typecheck, full tests, 27 visual tests, manual browser verification, and Forgejo CI pass. ### Blocking issues - None. ### Warnings - None. ### Verdict **Approved.**

erik merged commit 9a591a189a into main

2026-07-24 12:01:43 -05:00

erik referenced this pull request from a commit

2026-07-24 12:01:44 -05:00

Merge pull request 'Replace the custom Markdown renderer' (#269) from feat/task-9ce89ffa-markdown-renderer into main