The FAQ shipped here was a verbatim copy of the one on radicle.dev,
carrying a canonical tag that already pointed search engines at that
original. Drop the duplicate and redirect /faq to radicle.dev/faq so
existing links still reach the content.
The markdown sanitizer's allowlist did not include the <details> and
<summary> tags, so GitHub-style collapsible sections were stripped and
their contents rendered flat. Add both tags to ALLOWED_TAGS and the
"open" attribute to ALLOWED_ATTR, so collapsible sections render and
<details open> starts expanded.
Closes 390f3f2958
Image URLs pointing at a GitHub "blob" page, such as
https://github.com/<owner>/<repo>/blob/<ref>/<path>, serve an HTML
page rather than the raw image bytes, so they render as broken images
in markdown.
Add a canonicalizeGithubImageUrl helper that appends ?raw=true to such
URLs, which makes GitHub redirect to the raw content. URLs already
pointing at the raw content, via ?raw=true or raw.githubusercontent.com,
are left unchanged, as are non-GitHub and non-URL sources.
Wire the helper into the markdown image loop so external image URLs are
canonicalized while relative paths keep resolving against the repo's raw
endpoint.
The cache only stored resolved values, so callers asking for the same
key while a request was still in flight each issued their own. The
peer selector makes this easy to hit: Source and History render their
own Header, so switching tabs while the remote listing loads fires a
second copy of a request that takes seconds.
Cache the promise instead, evicting it on rejection so failures still
retry.
This also upgrades dompurify to the latest version, outside our cooldown
window, for a security fix (verified safe with extra security checks).
Newer dompurify versions expose a bug where happy-dom renders one of our
custom elements incorrectly in tests, unlike real browsers. Switch the unit
test environment from happy-dom to jsdom to fix the failing tests.
The source and commit views hit the /raw archive endpoint with a
HEAD request on every page load to decide whether to show the
download UI. That endpoint runs `git archive` server-side.
Move detection to user interaction: the clone popover probes when
the Download tab is opened, and the commit view checks on click,
navigating on success or showing a message on failure.
Cache only successful results per URL so transient or moving-ref 404s
aren't latched for the session.
Replace global setConfig with an exported sanitizeConfig passed
inline. The global config leaked into mermaid's internal
strict-mode sanitization, stripping valid SVG diagrams.
To allow some very basic hyperlinking in commit descriptions we can
replace fully specified urls with a valid scheme into
`radicle-external-link` components within patches and git history.
- Without strong, **bold** rendered as plain text since marked
emits <strong> and DOMPurify stripped the unknown tag
- Add strong, b, i, del, s to DOMPurify allow-list
- Cover the other inline emphasis tags authors may write as raw
HTML or that GFM strikethrough emits (<del>)
Changes which were needed after the upgrade:
- Replace vite-plugin-virtual (vite 8 incompatible) with vite's
built-in `define` for the buildTimeConfig injection
- tsconfig: drop deprecated `baseUrl` (TS 5+ resolves `paths`
relative to tsconfig)
- Vitest 4: import `defineConfig` from `vitest/config` so `test`
is valid in vite configs
- Zod 4: rename `.errors` to `.issues`, make `ZodSchema` a
type-only import, drop the removed `SafeParseReturnType`
- Tighten/loosen generic casts in localStore to match stricter
zod 4 inference
- ESLint 9 `no-useless-assignment`: remove redundant initializers
and dead reassignments; disable the rule where Svelte's reactive
blocks confuse the analyser
- Svelte/eslint `prefer-svelte-reactivity`: disable for legacy
Svelte usages of URL / Set
- Misc naming-convention and prefer-const fixes
When a saved node (e.g. localhost) is down, the app previously showed a
dead-end "Node not found" page with no way to navigate away.
Now the not-found page displays the seed selector inline with the error
title, showing which node failed and letting users switch to a different
one directly. The same treatment applies when navigating to a repo on an
unreachable node.
Allow radicle-explorer to connect to a locally running radicle-httpd via
https://app.radicle.xyz/nodes/localhost. This was previously disabled to
encourage use of Radicle Desktop, but is now useful for testing the new
always-on node in local development environments.
Remove support for /nodes/radicle.local, an undocumented and unused convention.
Fix remote node loading when Cloudflare URL-encodes port separator (: → %3A).
Based on the work done in commit
`a73c5490b160435a0ef5408b54185c9f698cb73f` there are a few places that
make the app not load in case dom storage aka localStorage is disabled.
To allow some very basic hyperlinking in commit descriptions we can
replace fully specified urls with a valid scheme into
`radicle-external-link` components.
Changes the display of embeds from being markdown images to markdown
links.
Mimics the way embeds work on the desktop app and allows other embeds to
work too like pdfs, videos, etc.
Text in Markdown with emojis has been tried to be fetched from the
/raw route as embeds.
This commit changes the renderer method to compute the hex string for
a unicode emoji to be able to use the /twemoji asset folder.
Instead of failing with a cryptic error in the dev console, this commit
allows the app to keep working and skips the localStorage persistance if
no localStorage is available.
Julien Donck