fix(deps): update dependency safe-mdx to ^1.14.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
safe-mdx	^1.11.0 → ^1.14.0

---

Release Notes

holocron-hq/safe-mdx (safe-mdx)

v1.14.0

Compare Source

1. Opt-in sanitize boolean — strip XSS vectors from native JSX and markdown HTML. It is off by default, so existing render output does not change:

   <SafeMdxRenderer markdown={code} mdast={mdast} sanitize />

   When sanitize is on, createElement drops script, object, embed, applet, portal, frame, frameset, and base. It also removes dangerouslySetInnerHTML, native on* handlers, srcDoc, ping, and URLs that are not http, https, mailto, tel, relative, or data:image/* on img.

   <style>, <meta>, <link>, and http(s) iframes stay allowed. srcDoc, javascript:, and data: iframe or link sources are still stripped.

   There is no allowlist object. The policy is fixed. Function evaluation being off is not enough on its own, because object literals such as dangerouslySetInnerHTML={{__html}} still evaluate.

   Stripped tags and props emit type: 'sanitize' errors.

v1.13.0

Compare Source

1. Page-scope export function and export const — with function evaluation on, named exports in an MDX file can be used on the same page. Exported components work as JSX. Exported helpers and constants work in expressions:

   export function Card({ title, children }) {
     return <div className="rounded-lg p-4">{title}{children}</div>
   }
   
   export function formatTitle(text) {
     return text.toUpperCase()
   }
   
   # {formatTitle("hello")}
   
   <Card title="Welcome">Hello from a page-scope component</Card>

   Turn it on with evaluateOptions: { functions: true }, or by passing a non-empty scope object:

   <SafeMdxRenderer
     markdown={code}
     mdast={mdxParse(code)}
     evaluateOptions={{ functions: true }}
     modules={{ react: React }}
   />

   Functions are hoisted, so a component declared later in the file can be used above its declaration. Const inits run in source order.

   React hooks work when you import them and pass React in modules:

   import { useState, useEffect } from "react"
   
   export function Counter({ initial = 0 }) {
     const [count, setCount] = useState(initial)
     useEffect(() => {
       document.title = String(count)
     }, [count])
     return <button className="px-4 py-2">{count}</button>
   }
   
   <Counter initial={3} />

   These are the real React hooks. useState works for the first server paint. useEffect runs after paint only when this renderer and the interpreted component execute as client React code. Hook components cannot run inside React Server Components.

   Put a blank line after the export block. MDX keeps reading ESM if the next line is attached.

   Still unsupported: export default layouts, export class, re-exports, and declarations without the export keyword. A bare function is invalid MDX. A bare const is parsed as markdown.

   Fixes #​20

v1.12.0

Compare Source

1. Render JSX inside MDX expressions — conditional elements, ternaries, nullish fallbacks, arrays, objects, and callback results now use the same safe component allow-list and prop validation as normal MDX elements:

   {visible && <TextField name="title" />}
   
   {items.map(item => <Card key={item.id}>{item.name}</Card>)}

   Callback-local values work in component props, spread attributes, children, and nested callbacks. Inactive conditional branches remain lazy, so components in branches that are not selected are not resolved.

2. Render JSX fragments in documents and expression props — fragments now preserve all children at the document root, inside components, and inside props:

   <>
     <Heading>First</Heading>
     <Heading>Second</Heading>
   </>

3. Validate nested component props — componentPropsSchema now validates components nested inside expression props and reports their validation errors through the normal error collection path.

4. Resolve react-dom in strict-linking installs — react-dom is now declared as a peer dependency because the main entry imports the client module that uses prefetchDNS and preconnect. pnpm consumers no longer need a packageExtensions workaround and no longer get Cannot find package 'react-dom' at runtime.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	website	2238c70	Commit Preview URL Branch Preview URL	Aug 15 2026, 04:56 PM