diff --git a/worker/bun.lock b/worker/bun.lock index 322c737..3e60311 100644 --- a/worker/bun.lock +++ b/worker/bun.lock @@ -6,7 +6,7 @@ "name": "agentdraft-api", "dependencies": { "hono": "4.13.14", - "marked": "14.1.3", + "marked": "18.1.2", "nanoid": "5.0.9", "parse5": "8.0.1", }, @@ -316,7 +316,7 @@ "magic-string": ["magic-string@0.30.21", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="], - "marked": ["marked@14.1.3", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-ZibJqTULGlt9g5k4VMARAktMAjXoVnnr+Y3aCqW1oDftcV4BA3UmrBifzXoZyenHRk75csiPu9iwsTj4VNBT0g=="], + "marked": ["marked@18.1.2", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-DfOnvLAQ6WYeWxWO1u4RyFOeqyHup6dks5PPqnoFiooU7ipRvidO/2j8plhAHIiZg574E9ZlzSjUiPMLAzFkgg=="], "miniflare": ["miniflare@5.20261023.1-beta", "", { "dependencies": { "@cspotcode/source-map-support": "0.8.1", "sharp": "0.35.5", "undici": "7.30.1", "workerd": "1.20261023.1", "ws": "8.21.0", "youch": "4.1.0-beta.10" } }, "sha512-hgm1AJhwC6W+iaRhvMnfs7bPOsxjKa8LXTFR2WVPA5qA9KhpyBd2LddmT+9M9tm65VZ8YWkwQGvB+cKbqJoKeA=="], diff --git a/worker/package.json b/worker/package.json index e8820d2..6175a60 100644 --- a/worker/package.json +++ b/worker/package.json @@ -12,7 +12,7 @@ }, "dependencies": { "hono": "4.13.14", - "marked": "14.1.3", + "marked": "18.1.2", "nanoid": "5.0.9", "parse5": "8.0.1" }, diff --git a/worker/src/services/markdown.ts b/worker/src/services/markdown.ts index f09968f..b75417d 100644 --- a/worker/src/services/markdown.ts +++ b/worker/src/services/markdown.ts @@ -22,12 +22,16 @@ export const MAX_MD_BYTES = 1024 * 1024; // 1 MiB of source Markdown // own validator. That rejection is correct: the policy must not special-case an // element just because we happened to emit it. The fix belongs in the renderer, which // substitutes inert Unicode ballot glyphs carrying no interactive semantics. +// +// The trailing space is ours to emit: since marked 17 the default checkbox renderer +// supplies the gap before the item text, so an override that omits it glues the glyph +// to the label ("☐API worker"). marked.use({ renderer: { checkbox({ checked }: { checked: boolean }): string { return checked - ? '' - : ''; + ? ' ' + : ' '; }, }, });