Skip to content

[pull] develop from marktext:develop - #121

Merged
pull[bot] merged 4 commits into
code:developfrom
marktext:develop
Sep 2, 2026
Merged

[pull] develop from marktext:develop#121
pull[bot] merged 4 commits into
code:developfrom
marktext:develop

Conversation

@pull

@pull pull Bot commented Sep 2, 2026

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

coolvitto and others added 4 commits September 2, 2026 11:54
Adjusted the wording to align with standard Windows terminology.
* fix: allow copy-paste in same folder with auto-rename (#5138)

When pasting a copied file into the same directory, generate a unique
name (e.g. 'file (copy).md', 'file (copy 2).md') instead of blocking
with 'Source and destination must not be the same.'

Cut-paste in the same folder is still blocked (no-op).

Closes #5138

* feat: easter egg after 9 copies in same folder

* fix: cap same-folder copies at 99 with clear message
…rcement (#4999)

- Add husky for git hook management
- Add lint-staged to run ESLint --fix + Prettier on staged files
- Migrate pnpm.overrides from package.json to pnpm-workspace.yaml
  (fixes 'pnpm field is no longer read' warning in pnpm v10)
- Pre-commit runs: eslint --fix + prettier on src/test .ts/.vue files,
  prettier on .json/.md/.yaml files

Closes #4998
Image attribute values (alt, title, src, etc.) supplied via the
image-edit tool were interpolated into an <img> tag using string
concatenation without escaping. A crafted attribute containing a
double-quote could break out of the attribute and inject arbitrary
HTML into the editor buffer. In the Electron renderer context this
can escalate beyond simple XSS.

Route the value through escapeHTML() before interpolating it into
the tag in both updateImage() and replaceImage() (html_tag branch),
in the current muya engine (packages/muya) and the legacy muyajs
engine (packages/muyajs).

Co-authored-by: Sebastion <sebastion@sebastion.dev>
@pull pull Bot locked and limited conversation to collaborators Sep 2, 2026
@pull pull Bot added the ⤵️ pull label Sep 2, 2026
@pull
pull Bot merged commit 203401e into code:develop Sep 2, 2026
15 of 16 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants