From 03d94e5cd5e9287c0288c994fbe764edeaec42a4 Mon Sep 17 00:00:00 2001
From: devmaxxx <syn.max.13@gmail.com>
Date: Sat, 17 Oct 2026 00:29:47 +0200
Subject: [PATCH 1/4] docs: add a changelog, an upgrade guide and package
 metadata

Lists the 1.0.0 breaking changes and adds an Upgrading from 0.x section to the README. Names the type file for every export condition, ships CHANGELOG.md, and updates the author and copyright years.
---
 CHANGELOG.md | 45 +++++++++++++++++++++++++++++++++++++++++++++
 LICENSE.md   |  2 +-
 README.md    | 28 ++++++++++++++++++++++++++++
 package.json | 36 +++++++++++++++++++++++++++++-------
 4 files changed, 103 insertions(+), 8 deletions(-)
 create mode 100644 CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..8b3f525
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,45 @@
+# Changelog
+
+## Unreleased
+
+- `exports` names the type file for each entry and module format, so TypeScript picks `.d.ts` for `import` and `.d.cts` for `require` without guessing.
+- The package ships `CHANGELOG.md`, and `author` names the maintainer.
+
+## 1.0.0
+
+The default entry now sanitizes, and React Native gets its own entry.
+
+### Breaking changes
+
+- **React 18 or newer.** The `react` peer range moves from `>=16.8.0` to `>=18.0.0`. The native entry also needs `react-native >=0.71`.
+- **`parse` sanitizes by default.** `parse` from `react-html5-parser` runs DOMPurify over the parsed tree. Output that used to render can now be stripped:
+  - `<script>`, event handlers (`onclick`), `javascript:` URLs, `<iframe>`, `<embed>` and `<object>`;
+  - `<style>` and `<title>`, which act on the whole page;
+  - the `form` and `formaction` attributes;
+  - `style` attributes that set `position: fixed`;
+  - attributes outside DOMPurify's allowlist, such as `contenteditable` and `fetchpriority`;
+  - unknown and custom elements, unless the tag is mapped in `components` (their content is kept).
+- **Bigger default entry.** It grows from about 1.4 kB to about 15 kB min + gzip, because DOMPurify is bundled. Import from `react-html5-parser/core` to keep the old size and behaviour.
+- **`sanitize` no longer replaces the sanitizer on the default entry.** DOMPurify runs after your `sanitize` function. To use only your own sanitizer, import from `/core`.
+- **`components` entries render as React components.** They were called as plain functions before. Hooks inside them now work, but an inline arrow function remounts its subtree on every render, and a component that returns `undefined` throws on React 18. Define components outside render and return `null` for nothing.
+- **`mapElement` receives the component element** for a tag mapped in `components`, not the element the component returned.
+- **`MapComponentFn` props no longer include `key`.** The type is now `ComponentProps` (`PropsWithChildren<Attributes>`).
+
+### Added
+
+- `react-html5-parser/core`: the unsanitized parser, about 3 kB.
+- `react-html5-parser/native`: renders HTML to React Native `View`, `Text` and `Image`, with `components`, `tagStyles`, `textStyle`, `onLinkPress` and `mapElement` options. Links open only for `http`, `https`, `mailto` and `tel`; images load only from `http`, `https` and raster data URIs.
+- `purify` option on the default entry: a DOMPurify config merged over the built-in one.
+- CommonJS builds next to ESM for every entry.
+
+### Fixed
+
+- SVG attributes (`viewBox`, `stroke-width`, `xlink:href` and the rest) map to their React names by default.
+- Form fields render uncontrolled (`defaultValue`, `defaultChecked`), so React no longer warns about a `value` without `onChange`.
+- On React 19, `<script async>` is rendered inert instead of hoisted and run, and `<html>` / `<body>` no longer bind to the page's own.
+- Custom elements keep their attribute names as written.
+- `attrsMap` applies to every element, including mapped components.
+
+### Upgrading
+
+See [Upgrading from 0.x](README.md#upgrading-from-0x).
diff --git a/LICENSE.md b/LICENSE.md
index 2adb94c..5d51025 100644
--- a/LICENSE.md
+++ b/LICENSE.md
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2022 Max Syn
+Copyright (c) 2022-2026 Max Syn
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/README.md b/README.md
index 0358936..91111a5 100644
--- a/README.md
+++ b/README.md
@@ -370,6 +370,34 @@ An error thrown inside `onError` reaches the caller. A component from `component
 - `hidden="until-found"` becomes plain `hidden`: React 19 treats `hidden` as a boolean.
 - In the core entry, `async` is dropped from `<script>`, so React 19 renders it inert instead of hoisting and running it, and `<title>`, `<meta>` and `<link>` are hoisted into the document `<head>` by React 19.
 
+## Upgrading from 0.x
+
+1.0 sanitizes by default and needs React 18. Every change is in the [changelog](CHANGELOG.md#100).
+
+**Keep the 0.x output.** Import from the core entry. It is the 0.x parser with the 1.0 fixes, and runs only the `sanitize` you pass:
+
+```diff
+- import { parse } from "react-html5-parser";
++ import { parse } from "react-html5-parser/core";
+```
+
+**Stay on the default entry.** Check what DOMPurify now removes from your content (see [Built-in sanitizer](#built-in-sanitizer)), then:
+
+- Drop your own DOMPurify call from `sanitize`; the built-in one runs anyway. Keep `sanitize` only for rewrites.
+- Allow a tag or attribute you need through `purify`, or map the tag in `components`:
+
+  ```ts
+  parse(html, { purify: { ADD_ATTR: ["contenteditable"] } });
+  ```
+
+**`components`.** Entries are now rendered as React components, not called as functions:
+
+- Define the map at module scope. An inline object or arrow function gives the tag a new component type on every render, and React remounts its subtree.
+- Return `null`, not `undefined`, to render nothing. React 18 throws on `undefined`.
+- `mapElement` now receives the `<YourComponent>` element for a mapped tag, not what your component returned.
+
+**Types.** `MapComponentFn` props are now `ComponentProps` and no longer include `key`.
+
 ## Development
 
 ```sh
diff --git a/package.json b/package.json
index a66afed..89866ea 100644
--- a/package.json
+++ b/package.json
@@ -31,23 +31,41 @@
     "url": "git+https://github.com/devmaxxx/react-html5-parser.git"
   },
   "license": "MIT",
-  "author": "devmaxxx",
+  "author": "Max Syn (https://github.com/devmaxxx)",
   "sideEffects": false,
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "exports": {
     ".": {
-      "import": "./dist/index.js",
-      "require": "./dist/index.cjs"
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
     },
     "./core": {
-      "import": "./dist/core.js",
-      "require": "./dist/core.cjs"
+      "import": {
+        "types": "./dist/core.d.ts",
+        "default": "./dist/core.js"
+      },
+      "require": {
+        "types": "./dist/core.d.cts",
+        "default": "./dist/core.cjs"
+      }
     },
     "./native": {
-      "import": "./dist/native.js",
-      "require": "./dist/native.cjs"
+      "import": {
+        "types": "./dist/native.d.ts",
+        "default": "./dist/native.js"
+      },
+      "require": {
+        "types": "./dist/native.d.cts",
+        "default": "./dist/native.cjs"
+      }
     },
     "./package.json": "./package.json"
   },
@@ -57,6 +75,7 @@
     "dist",
     "native",
     "README.md",
+    "CHANGELOG.md",
     "EXAMPLES.md"
   ],
   "scripts": {
@@ -155,5 +174,8 @@
     "domhandler": "6.0.1",
     "entities": "8.1.0",
     "htmlparser2": "12.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
   }
 }

From 75d5dad023e0d25aa03e426f245bfb4ea3567f21 Mon Sep 17 00:00:00 2001
From: devmaxxx <syn.max.13@gmail.com>
Date: Sat, 17 Oct 2026 00:30:20 +0200
Subject: [PATCH 2/4] chore: name Maksym Synenko as author

---
 LICENSE.md   | 2 +-
 package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/LICENSE.md b/LICENSE.md
index 5d51025..d3d290a 100644
--- a/LICENSE.md
+++ b/LICENSE.md
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2022-2026 Max Syn
+Copyright (c) 2022-2026 Maksym Synenko
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/package.json b/package.json
index 89866ea..b73dcd1 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,7 @@
     "url": "git+https://github.com/devmaxxx/react-html5-parser.git"
   },
   "license": "MIT",
-  "author": "Max Syn (https://github.com/devmaxxx)",
+  "author": "Maksym Synenko (https://github.com/devmaxxx)",
   "sideEffects": false,
   "type": "module",
   "main": "./dist/index.cjs",

From 2948cbbe101fb0fad074119efddd1a05d0324ddc Mon Sep 17 00:00:00 2001
From: devmaxxx <syn.max.13@gmail.com>
Date: Sat, 17 Oct 2026 00:31:40 +0200
Subject: [PATCH 3/4] chore: release 1.0.1

---
 CHANGELOG.md      | 2 +-
 package-lock.json | 4 ++--
 package.json      | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8b3f525..b575c78 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
 # Changelog
 
-## Unreleased
+## 1.0.1
 
 - `exports` names the type file for each entry and module format, so TypeScript picks `.d.ts` for `import` and `.d.cts` for `require` without guessing.
 - The package ships `CHANGELOG.md`, and `author` names the maintainer.
diff --git a/package-lock.json b/package-lock.json
index 20a4ccc..fbd192c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "react-html5-parser",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "react-html5-parser",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "license": "MIT",
       "dependencies": {
         "dompurify": "^3.4.17"
diff --git a/package.json b/package.json
index b73dcd1..c902d2c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "react-html5-parser",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Turn HTML strings into React and React Native elements, sanitized by default. No dangerouslySetInnerHTML.",
   "keywords": [
     "react",

From 7b7e841f9b509b0ac43ca86f57dd42f5a826bd90 Mon Sep 17 00:00:00 2001
From: devmaxxx <syn.max.13@gmail.com>
Date: Sat, 17 Oct 2026 00:32:10 +0200
Subject: [PATCH 4/4] ci: publish to npm and create the GitHub release on a
 version tag

npm run release now only tags and pushes. The Release workflow checks the tag
against package.json, runs the tests and size limits, publishes with npm
trusted publishing and creates the release from the CHANGELOG.md section.
---
 .github/workflows/release.yml | 46 +++++++++++++++++++++++++++++++++++
 README.md                     |  2 ++
 package.json                  |  2 +-
 3 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..d1c1eef
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,46 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "[0-9]+.[0-9]+.[0-9]+"
+
+permissions:
+  contents: write
+  # npm trusted publishing: the package is published with an OIDC token and
+  # gets provenance, so no NPM_TOKEN secret is stored.
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+          cache: npm
+          registry-url: https://registry.npmjs.org
+
+      # Trusted publishing needs npm 11.5.1 or newer.
+      - run: npm install -g npm@latest
+
+      - name: Check the tag matches package.json
+        run: |
+          version=$(node -p "require('./package.json').version")
+          if [ "$version" != "$GITHUB_REF_NAME" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match package.json version $version"
+            exit 1
+          fi
+
+      - run: npm ci
+      - run: npm test
+      - run: npm run build:size
+      - run: npm publish
+
+      - name: Create the GitHub release from CHANGELOG.md
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          awk -v v="$GITHUB_REF_NAME" '/^## /{ if (f) exit; f = ($2 == v); next } f' CHANGELOG.md > notes.md
+          gh release create "$GITHUB_REF_NAME" --verify-tag --title "$GITHUB_REF_NAME" --notes-file notes.md
diff --git a/README.md b/README.md
index 91111a5..cadba78 100644
--- a/README.md
+++ b/README.md
@@ -409,6 +409,8 @@ npm run build        # tsdown to dist/ (ESM + CJS + types), then publint
 npm run build:size   # build, then check the size limits above
 ```
 
+To release, bump `version` in `package.json`, add its section to `CHANGELOG.md`, merge, then run `npm run release` on `main`. It tags the version and pushes the tag; the Release workflow publishes to npm with provenance and creates the GitHub release from the changelog section.
+
 ## Contributing
 
 Issues and pull requests are welcome at [github.com/devmaxxx/react-html5-parser](https://github.com/devmaxxx/react-html5-parser). For a bug, include the HTML string and the options you passed to `parse`. A pull request should come with a test in `__tests__/` and keep `npm test` and `npm run build:size` green.
diff --git a/package.json b/package.json
index c902d2c..9d79921 100644
--- a/package.json
+++ b/package.json
@@ -85,7 +85,7 @@
     "build:size": "npm run build && npm run sizecheck",
     "test": "npm run typecheck && jest",
     "test:watch": "jest --watchAll",
-    "release": "npm run test && npm run build:size && git tag $npm_package_version && git push && git push --tags && npm publish",
+    "release": "npm run test && npm run build:size && git tag $npm_package_version && git push && git push origin $npm_package_version",
     "typecheck": "tsc --noEmit -p .",
     "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\""
   },