Status and Compatibility
Version status
Installation is covered in Quick start.
Runtime compatibility
The npm package only contains dist/, NOTICE, and THIRD_PARTY_LICENSES; see the contributing guide for building from source.
Pinned upstream
Upgrading the parser changes AST shape, source ranges, and the rendering baseline. Re-run rendering and security review.
Snapshot versions
A version change is a structural break. Include versions in cache keys; restore rejects mismatched data.
Styling and security baseline
- Styles live in
react-wikitext/styles.cssand must be imported explicitly; there are no global element styles. - Inline styles keep only whitelisted layout and appearance declarations; values using
url(),expression(), or!importantare dropped whole and reported as diagnostics. There is noevaldependency; under strict CSP, allowstyle-srcas needed for them to apply. - No
dangerouslySetInnerHTML; the final HAST comes from the sanitizer and wiki policy. - Images are not loaded by default; only authorized URLs (from a resolver, or an explicitly enabled plugin-image policy) become
<img>. - React entries depend on Context and only run in Client Components; the root entry and
/viewship a"use client"directive, so the host does not need to repeat it.
See Security model and Rendering behavior for the full boundaries.
Verifying compatibility
After upgrading React, the parser, or bundler config, at least run test:consumer and test.
License
- The library is released under GPL-3.0-or-later.
wikiparser-node@1.48.1uses the same license.- Third-party notices are in
NOTICEandTHIRD_PARTY_LICENSESat the repository root.
Check GPL-3.0-or-later compatibility before distributing builds that include this library.