[pull] main from Milkdown:main

.github/actions/setup/action.yml

@@ -4,12 +4,12 @@ description: Setup the environment
 runs:
   using: composite
   steps:
-    - uses: pnpm/action-setup@739bfe42ca9233c5e6aca07c1a25a9d34aca49b0 # v6.0.7
+    - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
       with:
         run_install: false
 
     - name: Setup node
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version-file: '.nvmrc'
         cache: pnpm

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout code repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
@@ -28,7 +28,7 @@ jobs:
     needs: install-deps
     steps:
       - name: Checkout code repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
@@ -42,7 +42,7 @@ jobs:
     needs: install-deps
     steps:
       - name: Checkout code repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
@@ -56,7 +56,7 @@ jobs:
     needs: install-deps
     steps:
       - name: Checkout code repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
@@ -90,7 +90,7 @@ jobs:
         shard: [1, 2, 3, 4, 5]
     steps:
       - name: Checkout code repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
@@ -109,7 +109,7 @@ jobs:
 
       - name: Upload test results
         if: ${{ failure() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: test-results-e2e-${{ matrix.shard }}
           path: e2e/test-results/

.github/workflows/codeql.yml

@@ -20,14 +20,14 @@ jobs:
         language: ['javascript']
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
+        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
         with:
           languages: ${{ matrix.language }}
       - name: Autobuild
-        uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
+        uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
+        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/fix.yml

@@ -12,7 +12,7 @@ jobs:
   fix:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: ./.github/actions/setup
 

.github/workflows/release.yml

@@ -10,14 +10,14 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - uses: ./.github/actions/setup
 
       - name: Create versions or publish to npm registry
-        uses: changesets/action@v1
+        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0
         with:
           version: pnpm ci:version
           commit: 'chore: version packages'
@@ -32,7 +32,7 @@ jobs:
       contents: write
       id-token: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
@@ -50,7 +50,7 @@ jobs:
           echo "MILKDOWN_RELEASE_TAG=v${MILKDOWN_VERSION}" >> "$GITHUB_ENV"
 
       - name: Create GitHub release
-        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           commit: main
           tag: '${{ env.MILKDOWN_RELEASE_TAG }}'

.lintstagedrc.json

@@ -1,4 +1,4 @@
 {
-  "**/*.{js,ts,tsx,json,yaml,yml,md}": ["oxlint -c .oxlintrc.json --fix"],
+  "**/*.{js,ts,tsx}": ["oxlint -c .oxlintrc.json --fix"],
   "*": "oxfmt --no-error-on-unmatched-pattern"
 }

.oxlintrc.json

@@ -87,9 +87,7 @@
       }
     ],
     "import/named": "error",
-    "import/order": "error",
     "import/no-duplicates": "error",
-    "import/no-import-assign": "error",
     "import/no-self-import": "error",
 
     "typescript/consistent-type-imports": "error",

package.json

@@ -29,8 +29,8 @@
   },
   "devDependencies": {
     "@changesets/cli": "^2.22.0",
-    "@commitlint/cli": "^21.0.0",
-    "@commitlint/config-conventional": "^21.0.0",
+    "@commitlint/cli": "^21.0.1",
+    "@commitlint/config-conventional": "^21.0.1",
     "@milkdown/dev": "workspace:*",
     "@rollup/plugin-commonjs": "^29.0.0",
     "@rollup/plugin-json": "^6.0.0",
@@ -72,7 +72,7 @@
   "engines": {
     "node": ">=22"
   },
-  "packageManager": "pnpm@11.1.0",
+  "packageManager": "pnpm@11.1.1",
   "pnpm": {
     "peerDependencyRules": {
       "ignoreMissing": [

packages/components/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @milkdown/components
 
+## 7.21.1
+
+### Patch Changes
+
+- a612984: Milkdown patch version release.
+
+  ## Fix
+  - fix(crepe): avoid polynomial ReDoS when normalizing provider baseURL (#2366)
+  - fix(components): lazy-init SVG sanitizer to keep preview-panel SSR-safe (#2365)
+
+  ## Chore
+  - chore(deps): bump fast-uri to 3.1.2 to patch GHSA-v39h-62p7-jpjc (#2367)
+  - chore: Pin dependencies (#2364)
+  - chore: config renovate to pin github actions (#2363)
+
+- Updated dependencies [a612984]
+  - @milkdown/core@7.21.1
+  - @milkdown/ctx@7.21.1
+  - @milkdown/exception@7.21.1
+  - @milkdown/plugin-diff@7.21.1
+  - @milkdown/plugin-tooltip@7.21.1
+  - @milkdown/preset-commonmark@7.21.1
+  - @milkdown/preset-gfm@7.21.1
+  - @milkdown/prose@7.21.1
+  - @milkdown/transformer@7.21.1
+  - @milkdown/utils@7.21.1
+
 ## 7.21.0
 
 ### Minor Changes

packages/components/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@milkdown/components",
-  "version": "7.21.0",
+  "version": "7.21.1",
   "keywords": [
     "milkdown",
     "milkdown plugin"

packages/core/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @milkdown/core
 
+## 7.21.1
+
+### Patch Changes
+
+- a612984: Milkdown patch version release.
+
+  ## Fix
+  - fix(crepe): avoid polynomial ReDoS when normalizing provider baseURL (#2366)
+  - fix(components): lazy-init SVG sanitizer to keep preview-panel SSR-safe (#2365)
+
+  ## Chore
+  - chore(deps): bump fast-uri to 3.1.2 to patch GHSA-v39h-62p7-jpjc (#2367)
+  - chore: Pin dependencies (#2364)
+  - chore: config renovate to pin github actions (#2363)
+
+- Updated dependencies [a612984]
+  - @milkdown/ctx@7.21.1
+  - @milkdown/exception@7.21.1
+  - @milkdown/prose@7.21.1
+  - @milkdown/transformer@7.21.1
+
 ## 7.21.0
 
 ### Minor Changes

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@milkdown/core",
-  "version": "7.21.0",
+  "version": "7.21.1",
   "keywords": [
     "markdown",
     "markdown editor",

packages/crepe/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @milkdown/crepe
 
+## 7.21.1
+
+### Patch Changes
+
+- a612984: Milkdown patch version release.
+
+  ## Fix
+  - fix(crepe): avoid polynomial ReDoS when normalizing provider baseURL (#2366)
+  - fix(components): lazy-init SVG sanitizer to keep preview-panel SSR-safe (#2365)
+
+  ## Chore
+  - chore(deps): bump fast-uri to 3.1.2 to patch GHSA-v39h-62p7-jpjc (#2367)
+  - chore: Pin dependencies (#2364)
+  - chore: config renovate to pin github actions (#2363)
+
+- Updated dependencies [a612984]
+  - @milkdown/kit@7.21.1
+
 ## 7.21.0
 
 ### Minor Changes

packages/crepe/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@milkdown/crepe",
-  "version": "7.21.0",
+  "version": "7.21.1",
   "keywords": [
     "crepe",
     "editor",

packages/ctx/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @milkdown/ctx
 
+## 7.21.1
+
+### Patch Changes
+
+- a612984: Milkdown patch version release.
+
+  ## Fix
+  - fix(crepe): avoid polynomial ReDoS when normalizing provider baseURL (#2366)
+  - fix(components): lazy-init SVG sanitizer to keep preview-panel SSR-safe (#2365)
+
+  ## Chore
+  - chore(deps): bump fast-uri to 3.1.2 to patch GHSA-v39h-62p7-jpjc (#2367)
+  - chore: Pin dependencies (#2364)
+  - chore: config renovate to pin github actions (#2363)
+
+- Updated dependencies [a612984]
+  - @milkdown/exception@7.21.1
+
 ## 7.21.0
 
 ### Minor Changes

packages/ctx/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@milkdown/ctx",
-  "version": "7.21.0",
+  "version": "7.21.1",
   "keywords": [
     "markdown",
     "markdown editor",

packages/exception/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @milkdown/exception
 
+## 7.21.1
+
+### Patch Changes
+
+- a612984: Milkdown patch version release.
+
+  ## Fix
+  - fix(crepe): avoid polynomial ReDoS when normalizing provider baseURL (#2366)
+  - fix(components): lazy-init SVG sanitizer to keep preview-panel SSR-safe (#2365)
+
+  ## Chore
+  - chore(deps): bump fast-uri to 3.1.2 to patch GHSA-v39h-62p7-jpjc (#2367)
+  - chore: Pin dependencies (#2364)
+  - chore: config renovate to pin github actions (#2363)
+
 ## 7.21.0
 
 ### Minor Changes

packages/exception/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@milkdown/exception",
-  "version": "7.21.0",
+  "version": "7.21.1",
   "license": "MIT",
   "repository": {
     "type": "git",

packages/integrations/react/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @milkdown/react
 
+## 7.21.1
+
+### Patch Changes
+
+- a612984: Milkdown patch version release.
+
+  ## Fix
+  - fix(crepe): avoid polynomial ReDoS when normalizing provider baseURL (#2366)
+  - fix(components): lazy-init SVG sanitizer to keep preview-panel SSR-safe (#2365)
+
+  ## Chore
+  - chore(deps): bump fast-uri to 3.1.2 to patch GHSA-v39h-62p7-jpjc (#2367)
+  - chore: Pin dependencies (#2364)
+  - chore: config renovate to pin github actions (#2363)
+
+- Updated dependencies [a612984]
+  - @milkdown/crepe@7.21.1
+  - @milkdown/kit@7.21.1
+
 ## 7.21.0
 
 ### Minor Changes

packages/integrations/react/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@milkdown/react",
-  "version": "7.21.0",
+  "version": "7.21.1",
   "keywords": [
     "milkdown",
     "milkdown plugin",

packages/integrations/vue/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @milkdown/vue
 
+## 7.21.1
+
+### Patch Changes
+
+- a612984: Milkdown patch version release.
+
+  ## Fix
+  - fix(crepe): avoid polynomial ReDoS when normalizing provider baseURL (#2366)
+  - fix(components): lazy-init SVG sanitizer to keep preview-panel SSR-safe (#2365)
+
+  ## Chore
+  - chore(deps): bump fast-uri to 3.1.2 to patch GHSA-v39h-62p7-jpjc (#2367)
+  - chore: Pin dependencies (#2364)
+  - chore: config renovate to pin github actions (#2363)
+
+- Updated dependencies [a612984]
+  - @milkdown/crepe@7.21.1
+  - @milkdown/kit@7.21.1
+
 ## 7.21.0
 
 ### Minor Changes