Skip to content

[DEV-73] Display update release notes as safe, formatted content - #17

Open
danii1 wants to merge 4 commits into
mainfrom
feature/dev-73
Open

[DEV-73] Display update release notes as safe, formatted content#17
danii1 wants to merge 4 commits into
mainfrom
feature/dev-73

Conversation

@danii1

@danii1 danii1 commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

Task: DEV-73

Summary: Display update release notes as safe, formatted content

Implementation Details

Implemented DEV-73.

  • Added a restrictive release-note HTML renderer in ReleaseNotes.tsx.
  • Supports headings, paragraphs, lists, emphasis, links, code, blockquotes, and tables.
  • Drops scripts, event handlers, styles, forms, media, embedded content, SVG, and other unsafe elements.
  • Restricts links to absolute HTTP(S) URLs and opens them through the existing Electron preload API.
  • Handles malformed, missing, or fully removed content with “Release notes are unavailable.”
  • Added bounded scrolling, wrapping, and flex layout safeguards for long notes.
  • Preserved existing update actions and restart messaging.
  • Added coverage for formatting, malformed HTML, sanitization, unsafe URLs, external links, fallback states, and action accessibility.

Verification passed:

  • 471 desktop tests
  • Typecheck
  • Formatting check
  • Lint (existing warnings only)
  • Production build
  • git diff --check

No documentation update was necessary because no CLI behavior, configuration, or environment variables changed.


This PR was automatically created by @devintern/code

devintern-internal[bot] added 2 commits August 18, 2026 16:23
- Bound release-note HTML length before parsing.\n- Enforce traversal depth and node budgets with safe fallback behavior.\n- Cover oversized, deeply nested, and high-node-count release notes.
@danii1

danii1 commented Aug 18, 2026

Copy link
Copy Markdown
Contributor Author

@devintern-internal awesome, now bump pm-desktop version

devintern-internal[bot] added 2 commits August 18, 2026 16:34
Refresh bun.lock workspace manifest metadata after the pm-desktop version bump.

Consolidate the React import to satisfy import/no-duplicates.

Remove native navigation semantics from release-note links and add regression coverage.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant