Writer
ΕΛ Try it

Changelog · v0.2.0

What changed, with receipts.

Every release with what actually ships — and what does not ship yet. No “coming soon” hiding behind a changelog.

v0.2.0 Production & Trust 32 fixtures MIT

v0.2.0 — Production & Trust

24 October 2026

Version 0.2.0 makes Writer safe for untrusted Markdown and adds what production needs: real PDF, framework wrappers, server examples and editor localisation.

In one line. Safe sanitisation in JS, PHP and Python, real PDF, wrappers, server examples, i18n/RTL and 32 fixtures. No DOCX/EPUB or CRDT.

Security

  • Raw HTML is sanitised at the IR boundary by default (html: 'sanitize') in JS, PHP and Python.
  • html: 'allow' is an explicit opt-out; html: 'escape' converts raw HTML into text nodes.
  • URLs pass through one shared allowlist: javascript:, vbscript:, file: and other unsafe schemes are rejected.
  • data: URLs are allowed for raster images only. Control characters and backslash-prefixed URLs cannot hide a scheme.
  • The same sanitised IR feeds HTML and PDF, so no format can bypass the policy.

Added

  • @writer/pdf: a first-party IR → PDF renderer with embedded DejaVu Sans/Mono fonts for Greek and Cyrillic.
  • Wrappers @writer/react, @writer/vue and @writer/svelte around the same Web Component.
  • Server examples for Express, Laravel and Django with validation and a 1 MB limit.
  • Editor chrome localisation and RTL direction. Document content is never translated.
  • A bilingual changelog on writer.gr.

Changed

  • The conformance corpus grew from 22 to 32 fixtures. JS, PHP and Python pass 32/32.
  • README, API reference, architecture notes and the integration guide describe the security model, PDF, wrappers and server examples.
  • Package, SDK, documentation and download versions are unified at 0.2.0.
  • The download bundle is now writer-0.2.0.zip.

Fixed

  • PHP html: 'escape' produces text nodes, matching JS and Python.
  • PHP html: 'allow' is a true no-op and no longer rewrites raw HTML.
  • URL handling no longer accepts backslash-prefixed or control-character-obfuscated schemes.
  • asPDF() returns NO_PDF_ENGINE when no engine exists, instead of HTML with a .pdf extension.
Not included. DOCX/EPUB export and collaborative editing / CRDT do not exist in this release.

v0.1.0 — Initial release

20 October 2026

The first public release set the contract and the three SDKs.

  • @writer/core: Markdown → Writer IR, plugins, renderers, typography, tables, media and commands.
  • @writer/editor: a Web Components editor with WYSIWYG, source, split, preview and readonly modes.
  • PHP and Python SDKs that produce the same canonical IR and the same outputs.
  • A conformance corpus and a bilingual site with offline demos.
Download writer-0.2.0.zip