close #71 #62

diff --git a/.forge/issues/382214e0-86e3-4a06-851f-6d00e9d429ca/comments/be1290aa-d8a8-42f5-bc8c-c351db8b28d4.md b/.forge/issues/382214e0-86e3-4a06-851f-6d00e9d429ca/comments/be1290aa-d8a8-42f5-bc8c-c351db8b28d4.mdnew file mode 100644index 0000000..a5ca814--- /dev/null+++ b/.forge/issues/382214e0-86e3-4a06-851f-6d00e9d429ca/comments/be1290aa-d8a8-42f5-bc8c-c351db8b28d4.md@@ -0,0 +1,6 @@1+---2+id: be1290aa-d8a8-42f5-bc8c-c351db8b28d43+author: null4+created: 2026-10-27T16:04:34.645510653Z5+---6+Fixed in 2b56eb82: GFM options + .markdown wrapper (#71); scheme allowlist with entity decoding before the check (#62).

diff --git a/.forge/issues/382214e0-86e3-4a06-851f-6d00e9d429ca/issue.md b/.forge/issues/382214e0-86e3-4a06-851f-6d00e9d429ca/issue.mdindex 5e6715c..2f80e6b 100644--- a/.forge/issues/382214e0-86e3-4a06-851f-6d00e9d429ca/issue.md+++ b/.forge/issues/382214e0-86e3-4a06-851f-6d00e9d429ca/issue.md@@ -1,13 +1,13 @@11 ---22 id: 382214e0-86e3-4a06-851f-6d00e9d429ca33 title: 'Markdown: enable GFM tables + task lists + strikethrough (Options::empty() disables them)'4-state: open4+state: closed55 labels:66 - ui77 assignees: []88 milestone: null99 created: 2026-10-27T15:27:05.553529409Z10-updated: null10+updated: 2026-10-27T16:04:34.629168266Z1111 ---1212 `markdown_to_html` uses `Options::empty()`, so **GFM features are off**. Most visible consequences:1313 

diff --git a/.forge/issues/7b0b0eae-93d2-4cb3-8fa5-e01cbf1447ac/comments/6de0dafc-bc44-487f-ba66-00f4feead39c.md b/.forge/issues/7b0b0eae-93d2-4cb3-8fa5-e01cbf1447ac/comments/6de0dafc-bc44-487f-ba66-00f4feead39c.mdnew file mode 100644index 0000000..6e1d360--- /dev/null+++ b/.forge/issues/7b0b0eae-93d2-4cb3-8fa5-e01cbf1447ac/comments/6de0dafc-bc44-487f-ba66-00f4feead39c.md@@ -0,0 +1,6 @@1+---2+id: 6de0dafc-bc44-487f-ba66-00f4feead39c3+author: null4+created: 2026-10-27T16:04:34.745254702Z5+---6+Fixed in 2b56eb82: GFM options + .markdown wrapper (#71); scheme allowlist with entity decoding before the check (#62).

diff --git a/.forge/issues/7b0b0eae-93d2-4cb3-8fa5-e01cbf1447ac/issue.md b/.forge/issues/7b0b0eae-93d2-4cb3-8fa5-e01cbf1447ac/issue.mdindex 4863cf1..99e0ec1 100644--- a/.forge/issues/7b0b0eae-93d2-4cb3-8fa5-e01cbf1447ac/issue.md+++ b/.forge/issues/7b0b0eae-93d2-4cb3-8fa5-e01cbf1447ac/issue.md@@ -1,13 +1,13 @@11 ---22 id: 7b0b0eae-93d2-4cb3-8fa5-e01cbf1447ac33 title: 'Markdown link/image URLs are not scheme-filtered (javascript: XSS)'4-state: open4+state: closed55 labels:66 - security77 assignees: []88 milestone: null99 created: 2026-10-27T14:53:39.317738326Z10-updated: null10+updated: 2026-10-27T16:04:34.720653453Z1111 ---1212 Markdown link and image destinations are emitted verbatim, so `[click](javascript:...)` renders as a live `javascript:` link on the mirror.1313