vscode-markdown-preview-enhanced

Picked up from crossnote 0.9.41

The extension now pins crossnote 0.9.41.

• WaveDrom diagram labels can no longer inject live SVG event handlers (XSS) — crossnote's earlier fix for WaveDrom code execution (vscode-mpe#2315) made the diagram source inert strict JSON, but valid-but-malicious data passed through: WaveDrom interprets an array-valued signal label as an SVG element description, so name: ["image", {href: "missing.png", onerror: "alert(1)"}] had the client-side renderer build a real <image onerror=…> element — after sanitization had finished. Opening an exported HTML file executed the handler with code chunks disabled, and a hosted export ran the script in the site's origin; the preview was equally reachable. Reportedly a bypass of CVE-2026-11422; reported by @avrlab233 (GHSA-xgfr-fvr6-h5qv, fixed in shd101wyy/crossnote#518). The diagram data is now sanitized before any renderer sees it: event-handler attributes and javascript:/vbscript:/data:text/html URLs are stripped, elements that could execute script, embed an HTML document, or retarget attributes via SMIL animation are dropped, and — because WaveDrom's markup library emits attribute values and label text without XML escaping — quotes and angle brackets in those positions are escaped, closing the attribute-value and text-injection breakouts found while reviewing the fix. Benign label elements (like ["image", {href: "icon.png"}]) render exactly as before, an image-label href containing & now renders instead of failing XML parsing, and every render path (preview, presentation, HTML export) is covered.

Bug fixes

• Opening a second markdown document as the preview custom editor renders into its own tab — with markdown files associated to the preview custom editor (a hand-added "*.md": "markdown-preview-enhanced" entry in workbench.editorAssociations, or any other way of opening two files as custom editors) while previewMode is the default Single Preview, the second document's tab stayed completely blank and the first tab, still open in the background, was re-titled and rendered the second document's content instead of its own. Custom editor panels are created and managed by VS Code, one per document — but the extension registered the first one as the shared "single preview" panel, so every subsequent open reused that panel and the render output for the new document was written into the old tab. Custom editor panels are now tracked as their own class, pinned to the document they were resolved for and never retargeted through the single-preview machinery: each tab renders its own file, live updates and refreshes reach the right panel, closing one tab no longer unregisters the others, and Close All Previews also closes them (#2433 reported by @Andrea79).

Bug fixes

• A hand-added "*.md": "markdown-preview-enhanced" editor association survives restarts — on every activation (and every markdown-preview-enhanced.* setting change) the extension synced workbench.editorAssociations to previewMode, and outside Previews Only that meant deleting every markdown pattern mapped to markdown-preview-enhanced from the user settings — including one the user had added by hand to open markdown files in the preview custom editor while keeping the regular preview mode, so the entry was gone after each VS Code restart (#2429 reported by @Andrea79, fixed in #2431 by @Waynting). The extension now remembers which patterns it wrote itself for Previews Only and only ever removes those; a manually added association is left alone, and one whose value the user has since changed is not touched either. Switching away from Previews Only still removes the associations that mode added. Setups that are in Previews Only when this version first starts are adopted, so switching away later still cleans up after the older version.
• Note indexing refuses the home directory as a notebook root, and says so — the no-workspace fallback of getWorkspaceFolderUri resolves a markdown file that lives outside every workspace folder to its parent directory, so a loose file opened directly from ~ made the note index (backlinks, tags, wikilink completion, the graph view — reachable without any preview open, e.g. by typing [ / #) recursively stat and read everything under the home directory. On macOS that walks ~/Library (Mail, Messages, iCloud data) — the #2376 filesystem scan, again, one directory lower. The home directory is now refused exactly like filesystem-root notebooks: the index build is skipped extension-side (so the refusal holds on the currently pinned crossnote, not only from crossnote 0.9.40 on) and a once-per-root notification explains why notes are not indexed, localized in all ten languages and offering Open Folder…. Unlike drive roots it also warns when no folder is open: a markdown file directly in ~ is rare, and the walk it would trigger is exactly what #2376 reported (reported by @prawnsalad; the runtime refusal and an oversized-walk warning land in crossnote via shd101wyy/crossnote#514).

Picked up from crossnote 0.9.40

The extension now pins crossnote 0.9.40.

• Local fonts and images in .crossnote/style.less load in the preview — a relative url(...) in the user stylesheet (@font-face { src: url('fonts/MyFont.woff2') }, background-image: url(./bg.png)) never resolved: crossnote compiles style.less and inlines it into a <style> tag, so the browser resolved those references against the preview document instead of the stylesheet — inside a VS Code webview nothing exists there. Local fonts silently fell back to the default while remote ones (Google Fonts, any https:// URL) kept working, which made the failure look arbitrary (#2424 reported by @patriknusszer; fixed in shd101wyy/crossnote#513 by @Waynting). References are now resolved against style.less's own directory when it is loaded and rewritten into webview-loadable URLs for the preview (file://… in every export format). Absolute URLs, url(#fragment) paint servers, paths escaping the stylesheet's directory, and missing files are left untouched, and _Start Crossnote Server_ keeps its own root-relative url(/files/…) references working (shd101wyy/crossnote#516).
• **Mermaid and wavedrom CLI exports no longer run through a shell ([CVE-20

Features

• Start/Stop crossnote Server in the context menus — right-clicking inside a markdown editor now offers Markdown Preview Enhanced: Start Crossnote Server next to the existing Open Preview to the Side and Open Graph View entries, and both context menus (editor and Explorer right-click on a .md/.qmd/… file) also offer Markdown Preview Enhanced: Stop Crossnote Server while a server is actually running, so the wiki server is startable and stoppable in one click without the command palette. Both entries are hidden in the web extension (the server needs to spawn a process); Stop only appears while the crossnoteServerRunning context key is set, so it adds no clutter when nothing runs. The product name is capitalized as Crossnote in the titles, consistent with the project branding, and the titles are localized in all ten supported languages.

• New commands "Open Current Source in Editor" and "Open Current Source in Editor and Close Preview" (#2420 by @HappyOnigiri) — Open the Markdown file the focused preview is rendering in a text editor, either alongside the preview or replacing it. This is the way back to the source after following links inside the preview, where the preview shows subdir/c.md but the tab it was opened from still refers to a.md; it also gives "previewMode": "Previews Only" an exit into the editor, since the preview occupies the tab there. The editor opens in the preview's own editor group, and the preview tab is only closed once the editor has opened, so a failure to open leaves the preview in place.

• Build standalone Wiki command — Markdown Preview Enhanced: Build standalone Wiki (HTML) packs the folders of the current workspace (or the folder of the loose file, when no workspace is open) into one standalone, read-only HTML file, with the same config resolution as the extension. A save dialog asks where to store the file (default index.html) and the result can be opened right away; the preview context menu's Export ▸ Wiki item builds the same file for the whole workspace and shares the dialog. What the exported file actually is — since crossnote 0.9.37 a frozen, read-only copy of the whole serve app — is described in the crossnote section below. Desktop only.

• Start/Stop crossnote Server commands — Markdown Preview Enhanced: Start Crossnote Server runs the crossnote serve CLI as a child process for the folders of the current workspace (multi-root workspaces serve every folder, exactly like the CLI), loading config the same way the extension does, and offers the server URL in an "Open in browser" notification. Markdown Preview Enhanced: Stop Crossnote Server stops it. The port defaults to 3000 (auto-increments when busy) and is configurable via markdown-preview-enhanced.crossnoteServePort. The server runs in its own process because crossnote's serve server mutates process-global state (build directory, the file-URL mapper) that the extension host's own previews rely on. The CLI is bundled at build time from the crossnote/cli export; a build against a crossnote without it skips the bundle and the commands explain at runtime. Desktop only — the web extension cannot spawn processes.

Bug fixes

• The wiki export progress notification closes when the file is saved — Build standalone Wiki showed "Building the standalone wiki…" with a progress notification that stayed open after the "Standalone wiki saved (N notes)" message appeared, until the user dismissed that message: the progress task was awaiting the saved notification's promise, so the progress legitimately considered itself still running until then. The task now ends when the file is written, and the saved message (with its localized Open button) is shown after it.

• Start Crossnote Server no longer opens a blank page — the command's build directory (the crossnote/ folder populated by `gulp cop