Tags: sc2in/zigmark
Tags
chore: pin zig-yaml from main (0.3.2) (#85) #84 pinned the fix commit on a feature branch; zig-yaml has since merged the fix to main (sc2in/zig-yaml#3). Point the pin at the canonical main commit (3dc3441). Package content and hash are unchanged (identical tree), so this only updates the URL SHA.
Typst math alt text + typed YAML front-matter scalars (0.10.0) (#80) * feat: Typst math alt text + typed YAML front-matter scalars (0.10.0) Typst renderer now emits `alt:` (the TeX source) on every `#mi(…)` / `#mitex(…)` equation, so documents containing math compile under Typst's PDF/UA-1 tagged-PDF mode without a document-wide `#set math.equation(alt: …)` stopgap. The alt argument is escaped with the same guard as the content. Closes #78. Unquoted YAML front-matter scalars are now typed like TOML: `true`/`false` → `.bool`, `null` → `.null` (in addition to the existing int/float coercion), routed through the same `inferValue` helper the CLI `--set key=value` path uses. `Frontmatter.get` now returns the same `std.json.Value` tag regardless of source format; quoted scalars still stay `.string`. Closes #79. Also surface the zigmark library version in the WASM demo header via a new badge, read from the module's exported `version_ptr`/`version_len`. * fix: update nixpkgs and zig2nix URLs to use tarball sources
fix: trailing YAML comments in front matter (zig-yaml 0.3.1) (#77) * feat: opt-in TeX math ($/$$ via mitex) and image alt to Typst image(alt:) (0.9.0) - Parser{ .math = true } (default off) parses $...$ / $$...$$ into a new AST.Math inline node with Pandoc/KaTeX auto-render delimiter rules; default-off output is byte-identical to 0.8.0 (652/652 + 24/24 spec). - Typst renders math as #mi("...") / #mitex("...") in injection-safe string literals; new docHasMath() lets consumers decide whether to import mitex. - HTML keeps the original delimiters (escaped) for client-side KaTeX; Markdown round-trips verbatim; terminal/AI/AST show the TeX source. - Markdown image alt text now emitted as Typst image(alt: "...") in both figure and bare branches (omitted when empty) for PDF/UA alt text. - inline.parseInlineElements now takes an Options struct { gfm, math }. * fix: bump zig-yaml to 0.3.1 - trailing comments on plain scalars A trailing '# comment' after a plain scalar in a block sequence (e.g. a front-matter revision entry '- date: 2025-01-01 # when') failed the whole document with ParseFailure. Fixed in sc2in/zig-yaml 0.3.1 ('comment terminates a plain scalar', commit 7c60d9c); this bumps the pin and adds front-matter regression tests for the sequence case and the top-level trailing-comment case. 361/361 tests pass (CommonMark 652/652 + GFM 24/24 unchanged). --------- Co-authored-by: TsunamiNoAi <spam@falseblue.com>
Production security & quality hardening (0.8.0) (#74) * chore: update changelog * feat: production security & quality hardening (0.8.0) Prepares zigmark for public release / untrusted input (PolicyPress). HTML XSS: - Filter dangerous URL schemes (javascript:/vbscript:/file:/non-image data:) by default in links, images, and autolinks, with browser-style scheme normalisation; denylist keeps CommonMark/GFM conformance (652/652 + 24/24). - Escape footnote labels (were injected raw into attribute + element text). - Add opt-in safe mode (html.Options.safe / renderHtmlWithOptions / zigmark_render_html_safe / CLI --safe) that escapes raw HTML to visible text. Typst injection (compile-time file read): - Emit code spans/blocks via raw() with string-literal escaping. - Validate frontmatter-derived preamble fields (length/hex/string) with safe fallbacks. DoS / panics: - Parser.max_nesting_depth (128) and max_input_bytes (16 MiB) turn pathological input into NestingTooDeep / InputTooLarge instead of stack overflow / OOM; error paths free the partial tree. - Fix ATX '#' u8 overflow and frontmatter @intcast panics (std.math.cast). Frontmatter (#73): - YAML parse failure no longer leaks the error bundle, asserts, or writes to stderr from library code; CLI degrades gracefully. (Underlying plain-scalar " - " rejection is an upstream zig-yaml limitation.) Tooling: - Fix fuzz harness (was broken on Zig 0.16: old []const u8 signature -> *std.testing.Smith); add safe-HTML/Typst/ZON targets; CI fuzz smoke check. - Add zig fmt --check gate; guard deliberate hand-alignment with // zig fmt: off/on. - New src/markdown/security_test.zig regression suite.
Fix/release bwrap aarch64 (#69) * fix: add apparmor userns sysctl to release build job for aarch64 bwrap fails with 'setting up uid map: Permission denied' on ubuntu-24.04-arm because AppArmor restricts unprivileged user namespaces by default. CI already has this sysctl; release didn't. * fix: add apparmor userns sysctl to wasm and bench-regression CI jobs wasm and bench-regression had sandbox=false but not the sysctl, so bwrap fails when zig2nix must be built from source (e.g. on GHA cache throttle). Matches the fix already in the build job. --------- Co-authored-by: TsunamiNoAi <spam@falseblue.com>
Fix/release bwrap aarch64 (#69) * fix: add apparmor userns sysctl to release build job for aarch64 bwrap fails with 'setting up uid map: Permission denied' on ubuntu-24.04-arm because AppArmor restricts unprivileged user namespaces by default. CI already has this sysctl; release didn't. * fix: add apparmor userns sysctl to wasm and bench-regression CI jobs wasm and bench-regression had sandbox=false but not the sysctl, so bwrap fails when zig2nix must be built from source (e.g. on GHA cache throttle). Matches the fix already in the build job. --------- Co-authored-by: TsunamiNoAi <spam@falseblue.com>
fix: add apparmor userns sysctl to release build job for aarch64 bwrap fails with 'setting up uid map: Permission denied' on ubuntu-24.04-arm because AppArmor restricts unprivileged user namespaces by default. CI already has this sysctl; release didn't.
PreviousNext