mirror of
https://github.com/bretzel-app/crumbs.git
synced 2026-10-12 12:06:57 +02:00
Frederic Cabassut
27c3e7dccd
The table markdown fallback (previous commit) embeds raw HTML in saved markdown when a cell holds a bullet list, since GFM can't express block content in a table cell. But the read-only renderer (note-card preview, public share page) ran with html:false, so that HTML rendered as escaped literal text instead of a table - moving the bug rather than fixing it. Enable html mode and sanitize the rendered output with sanitize-html. Sanitizing matters beyond this one fallback: note content isn't only ever written through the editor - the MCP server and notes API accept a raw markdown string directly, bypassing the editor's schema, so any HTML this renders has to be treated as untrusted regardless of source. Also make the table's HTML fallback respect the editor's own `html` option (falls back to a `[table]` placeholder when disabled), matching every other node type's markdown storage in tiptap-markdown. Found via a 3-agent adversarial review of the previous fix.
115 lines
3.6 KiB
JSON
115 lines
3.6 KiB
JSON
{
|
|
"name": "crumbs",
|
|
"private": true,
|
|
"version": "0.34.0",
|
|
"type": "module",
|
|
"packageManager": "pnpm@9.15.9",
|
|
"license": "MIT",
|
|
"author": "Bretzel (https://bretzel.app)",
|
|
"homepage": "https://crumbs.bretzel.app",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/bretzel-app/crumbs.git"
|
|
},
|
|
"scripts": {
|
|
"dev": "vite dev",
|
|
"build": "npx tsx scripts/generate-openapi.ts && vite build",
|
|
"openapi": "npx tsx scripts/generate-openapi.ts",
|
|
"preview": "vite preview",
|
|
"prepare": "svelte-kit sync || echo ''",
|
|
"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
|
|
"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
|
|
"test:unit": "vitest run",
|
|
"test:unit:watch": "vitest",
|
|
"test:unit:coverage": "vitest run --coverage",
|
|
"test:e2e": "playwright test",
|
|
"test:e2e:coverage": "VITE_COVERAGE=true pnpm build && pnpm test:e2e && nyc report",
|
|
"coverage:merge-e2e": "nyc merge coverage/e2e/raw coverage/e2e/merged.json && nyc report",
|
|
"test": "pnpm test:unit && pnpm test:e2e",
|
|
"db:push": "drizzle-kit push",
|
|
"db:generate": "drizzle-kit generate",
|
|
"db:migrate": "drizzle-kit migrate",
|
|
"db:studio": "drizzle-kit studio",
|
|
"lint": "eslint .",
|
|
"docs:api": "tsx scripts/generate-api-docs.ts"
|
|
},
|
|
"dependencies": {
|
|
"@modelcontextprotocol/sdk": "^1.30.0",
|
|
"@sveltejs/adapter-node": "^5.5.7",
|
|
"@tiptap/core": "^3.29.2",
|
|
"@tiptap/extension-link": "^3.29.2",
|
|
"@tiptap/extension-placeholder": "^3.29.2",
|
|
"@tiptap/extension-table": "^3.29.2",
|
|
"@tiptap/extension-table-cell": "^3.29.2",
|
|
"@tiptap/extension-table-header": "^3.29.2",
|
|
"@tiptap/extension-table-row": "^3.29.2",
|
|
"@tiptap/extension-task-item": "^3.29.2",
|
|
"@tiptap/extension-task-list": "^3.29.2",
|
|
"@tiptap/extension-text-align": "^3.29.2",
|
|
"@tiptap/extension-underline": "^3.29.2",
|
|
"@tiptap/pm": "^3.29.2",
|
|
"@tiptap/starter-kit": "^3.29.2",
|
|
"arctic": "^3.7.0",
|
|
"argon2": "^0.43.1",
|
|
"better-sqlite3": "^11.10.0",
|
|
"drizzle-orm": "^0.45.2",
|
|
"idb": "^8.0.3",
|
|
"lucide-svelte": "^0.577.0",
|
|
"markdown-it": "^14.3.0",
|
|
"nanoid": "^5.1.16",
|
|
"node-diff3": "^3.2.1",
|
|
"nodemailer": "^9.0.3",
|
|
"sanitize-html": "^2.17.7",
|
|
"svelte-dnd-action": "^0.9.77",
|
|
"tiptap-markdown": "^0.9.0",
|
|
"uuid": "^11.1.1",
|
|
"zod": "^4.4.3",
|
|
"zxcvbn": "^4.4.2"
|
|
},
|
|
"devDependencies": {
|
|
"@playwright/test": "^1.62.1",
|
|
"@sveltejs/kit": "^2.70.2",
|
|
"@sveltejs/vite-plugin-svelte": "^6.2.4",
|
|
"@tailwindcss/typography": "^0.5.20",
|
|
"@tailwindcss/vite": "^4.3.3",
|
|
"@types/better-sqlite3": "^7.6.13",
|
|
"@types/markdown-it": "^14.1.2",
|
|
"@types/nodemailer": "^8.0.1",
|
|
"@types/sanitize-html": "^2.16.1",
|
|
"@types/uuid": "^10.0.0",
|
|
"@types/zxcvbn": "^4.4.5",
|
|
"@vite-pwa/sveltekit": "^1.1.0",
|
|
"@vitest/coverage-v8": "^3.2.7",
|
|
"drizzle-kit": "^0.31.10",
|
|
"jsdom": "^29.1.1",
|
|
"nyc": "^18.0.0",
|
|
"svelte": "^5.56.8",
|
|
"svelte-check": "^4.7.4",
|
|
"tailwindcss": "^4.3.3",
|
|
"tsx": "^4.23.5",
|
|
"typescript": "^5.9.3",
|
|
"vite": "^7.3.6",
|
|
"vite-plugin-istanbul": "^7.2.1",
|
|
"vite-plugin-pwa": "^1.3.0",
|
|
"vitest": "^3.2.7",
|
|
"workbox-window": "^7.4.1",
|
|
"yaml": "^2.9.0"
|
|
},
|
|
"pnpm": {
|
|
"onlyBuiltDependencies": [
|
|
"argon2",
|
|
"better-sqlite3",
|
|
"esbuild"
|
|
],
|
|
"overrides": {
|
|
"serialize-javascript": ">=7.0.3",
|
|
"esbuild@<0.25.0": "0.25.12",
|
|
"cookie": ">=0.7.0 <1",
|
|
"hono": ">=4.12.7",
|
|
"devalue": ">=5.8.1",
|
|
"path-to-regexp@8": ">=8.4.0",
|
|
"fast-uri": ">=3.1.2"
|
|
}
|
|
}
|
|
}
|