Writr
← Back to Changelog

v6.1.6

Release
September 17, 2026

[email protected] — 2026-09-17

Supply-chain hardening and unpublished writr-rs fixes; JS engine source is unchanged.

Bug Fixes

  • restore writr-rs goldens on Windows CRLF checkouts — unify CR/CRLF to LF before parse so markdown-rs does not keep CR in mdast text (#516)
  • copy async batch buffer input so callers can reuse the packed buffer after renderBatchBufferAsync (#540)
  • lock down the Node WASI loader: instantiate WASI with preview1 only (no process.env, no filesystem preopens) (#545)
  • bound internal math caches and honor caching: false without clearing other callers' entries (#546)
  • gate Rust/WASM parity and fix MDX rendering compatibility in writr-rs (#547)

Documentation

  • retire obsolete Rust divergence document (#549)

Internal

  • upgrade code quality dependencies (#490)
  • upgrade TypeScript and build tooling (#491)
  • upgrade package manager tooling (#492)
  • upgrade GitHub Actions (#493)
  • upgrade React dependencies (#494)
  • upgrade AI SDK dependencies (#495)
  • upgrade hookified (#496)
  • upgrade js-yaml (#497)
  • upgrade marked (#498)
  • upgrade markdown-it (#499)
  • upgrade tinybench (#500)
  • upgrade workspace code quality dependencies (#501)
  • refresh taiki-e/install-action SHA pin (#502)
  • upgrade napi-rs dependencies (#503)
  • upgrade fancy-regex to 0.19.0 (#504)
  • upgrade rquickjs to 0.12.2 (#505)
  • harden supply chain and CI (#506)
  • stage npm releases via OIDC (#507)
  • record npm stage-only, Drydock, and 2FA (#508)
  • replace dummy secrets in benchmark markdown fixtures (#509)
  • record repository lockdown (#510)
  • upgrade katex to 0.18.2 (AIKIDO-2026-293837) (#511)
  • pin @ungap/structured-clone to 1.3.3 (AIKIDO-2026-11068) (#512)
  • uniquify AI integration check name (#513)
  • replace dummy secrets in harness markdown fixtures (#514)
  • add CODEOWNERS for high-risk paths (#517)
  • bootstrap Aikido Safe Chain (#518)
  • set pnpm trustPolicy to no-downgrade (#519)
  • add Socket Firewall to every job (#520)
  • switch release to pnpm stage (#521)
  • record repository lockdown (#522)
  • pin taiki-e/install-action to an authentic v2.86.5 SHA (#523)
  • disable setup-node cache in deploy-site to prevent cache poisoning (#524)
  • remove property-information override (#525)
  • update katex override to 0.18.7 (#526)
  • remove @ungap/structured-clone override (#527)
  • upgrade code quality dependencies (#528)
  • upgrade TypeScript and build tooling (#529)
  • upgrade package manager and monorepo tooling (#530)
  • upgrade GitHub Actions (#531)
  • pin Dev Container images (#532)
  • upgrade React dependencies (#533)
  • upgrade AI SDK dependencies (#534)
  • upgrade hookified (#535)
  • upgrade js-yaml (#536)
  • upgrade zod (#537)
  • upgrade docula (#538)
  • remove undici override (#539)
  • upgrade markdown-it (#541)
  • upgrade marked (#542)
  • upgrade tinybench (#543)
  • upgrade property-information (#544)
  • compare native Rust and JavaScript rendering (#548)

Notes

  • src/** is unchanged since v6.1.5. The published tarball is still files: ["dist", "README.md", "LICENSE"]; writr-rs/ is not published. Runtime source matches 6.1.5. The tarball-affecting changes are production dependency ranges in package.json (hookified, js-yaml, react, html-react-parser, zod, ai) plus scripts/packageManager. The katex 0.18.7 and property-information 7.2.0 pins live in pnpm-workspace.yaml (this repo’s install), not in the npm tarball.
  • Titles that include (breaking) are upgrades of dev tools or unpublished Rust crates, not writr’s public JS API.

Contributors

  • @jaredwray (62)

Full List of Changes

  • root - chore: upgrade code quality dependencies by @jaredwray in #490
  • root - chore: upgrade TypeScript and build tooling (breaking) by @jaredwray in #491
  • root - chore: upgrade package manager tooling by @jaredwray in #492
  • root - chore: upgrade GitHub Actions (breaking) by @jaredwray in #493
  • root - chore: upgrade React dependencies by @jaredwray in #494
  • root - chore: upgrade AI SDK dependencies by @jaredwray in #495
  • root - chore: upgrade hookified by @jaredwray in #496
  • root - chore: upgrade js-yaml by @jaredwray in #497
  • root - chore: upgrade marked by @jaredwray in #498
  • root - chore: upgrade markdown-it (breaking) by @jaredwray in #499
  • root - chore: upgrade tinybench by @jaredwray in #500
  • workspace - chore: upgrade code quality dependencies (breaking) by @jaredwray in #501
  • workspace - chore: upgrade GitHub Actions by @jaredwray in #502
  • workspace - chore: upgrade napi dependencies by @jaredwray in #503
  • workspace - chore: upgrade fancy-regex to 0.19.0 (breaking) by @jaredwray in #504
  • workspace - chore: upgrade rquickjs to 0.12.2 by @jaredwray in #505
  • writr - chore: defense - harden supply chain and CI by @jaredwray in #506
  • writr - chore: defense - stage npm releases via OIDC by @jaredwray in #507
  • writr - chore: defense - record npm stage-only, Drydock, and 2FA by @jaredwray in #508
  • chore: replace dummy secrets in benchmark markdown fixtures by @jaredwray in #509
  • chore: upgrade katex to 0.18.2 (AIKIDO-2026-293837) by @jaredwray in #511
  • writr - chore: defense - record repository lockdown by @jaredwray in #510
  • chore: pin @ungap/structured-clone to 1.3.3 (AIKIDO-2026-11068) by @jaredwray in #512
  • writr - chore: defense - uniquify AI integration check name by @jaredwray in #513
  • chore: replace dummy secrets in harness markdown fixtures by @jaredwray in #514
  • fix: restore writr-rs goldens on Windows CRLF checkouts by @jaredwray in #516
  • writr - chore: defense - add CODEOWNERS for high-risk paths by @jaredwray in #517
  • writr - chore: defense - bootstrap Aikido Safe Chain by @jaredwray in #518
  • writr - chore: defense - set pnpm trustPolicy no-downgrade by @jaredwray in #519
  • writr - chore: defense - add Socket Firewall to every job by @jaredwray in #520
  • writr - chore: defense - switch release to pnpm stage by @jaredwray in #521
  • writr - chore: defense - record repository lockdown by @jaredwray in #522
  • ci: pin taiki-e/install-action to an authentic v2.86.5 SHA by @jaredwray in #523
  • ci: disable setup-node cache in deploy-site to prevent cache poisoning by @jaredwray in #524
  • mono - chore: remove property-information override by @jaredwray in #525
  • mono - chore: update katex override by @jaredwray in #526
  • mono - chore: remove @ungap/structured-clone override by @jaredwray in #527
  • mono - chore: upgrade code quality dependencies by @jaredwray in #528
  • mono - chore: upgrade TypeScript and build tooling by @jaredwray in #529
  • mono - chore: upgrade package manager and monorepo tooling by @jaredwray in #530
  • mono - chore: upgrade GitHub Actions by @jaredwray in #531
  • mono - chore: pin Dev Container images by @jaredwray in #532
  • mono - chore: upgrade React dependencies by @jaredwray in #533
  • mono - chore: upgrade AI SDK dependencies by @jaredwray in #534
  • mono - chore: upgrade hookified by @jaredwray in #535
  • mono - chore: upgrade js-yaml by @jaredwray in #536
  • mono - chore: upgrade zod by @jaredwray in #537
  • mono - chore: upgrade docula by @jaredwray in #538
  • mono - chore: remove undici override by @jaredwray in #539
  • Fix async batch buffer ownership by @jaredwray in #540
  • mono - chore: upgrade markdown-it by @jaredwray in #541
  • mono - chore: upgrade marked by @jaredwray in #542
  • mono - chore: upgrade tinybench by @jaredwray in #543
  • mono - chore: upgrade property-information by @jaredwray in #544
  • Lock down the Node WASI loader: no host env or filesystem by @jaredwray in #545
  • fix: bound internal math caches and honor caching: false by @jaredwray in #546
  • test: gate Rust/WASM parity and fix MDX rendering compatibility by @jaredwray in #547
  • bench: compare native Rust and JavaScript rendering by @jaredwray in #548
  • docs: retire obsolete Rust divergence document by @jaredwray in #549

Full diff: https://github.com/jaredwray/writr/compare/v6.1.5...v6.1.6