chore: bump version to 0.17.30

Author: Evaggelos Balaskas

CHANGELOG.md

@@ -4,31 +4,22 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Common Changelog](https://common-changelog.org) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.17.29] - 2026-05-26
+## [0.17.30] - 2026-05-26
 
-### Fixed
+### Added
 
-- Pin `flowchart.js` to exact 1.12.0 (regression from bulk bump) ([`b7f31b52`](../../commit/b7f31b52)).
-- Pin `codemirror-mode-elixir` to exact 1.1.1 (regression from bulk bump) ([`660fc675`](../../commit/660fc675)).
+- Render ` ```plantuml` fence blocks as PlantUML SVG via server ([`672a85f6`](../../commit/672a85f6)).
+- Accept ` ```flow` as alias for ` ```flowchart` fence tag ([`6c4addaf`](../../commit/6c4addaf)).
 
-### Changed
+### Fixed
+
+- Decode HTML entities in plantuml fence content before encoding ([`87a8773e`](../../commit/87a8773e)).
+- Guard against Infinity/NaN in mermaid + svg-resize math ([`af9dab77`](../../commit/af9dab77)).
+- Pin `raphael` to exact 2.2.7 (regression from bulk bump) ([`acf9a224`](../../commit/acf9a224)).
+- Drop `mousewheel`/`DOMMouseScroll` from CodeMirror passive patch in Dockerfile ([`e18708dc`](../../commit/e18708dc)).
+- Fix `sanitizeInline` closing-tag handler reading wrong capture group ([`1476af95`](../../commit/1476af95)).
 
-- Bulk in-range upgrade of 14 routine dependencies (no CVEs) ([`9ba65a67`](../../commit/9ba65a67)).
-- Bump `katex` direct dep to ^0.16.47 (fixes CVE-2024-28398, CVE-2025-23205) ([`ef6ddb86`](../../commit/ef6ddb86)).
-- Force `dompurify` to ^2.5.4 via yarn resolutions (GHSA-mmhx-hmjr-r674) ([`5197f50e`](../../commit/5197f50e)).
-- Force `handlebars` to ^4.7.7 via yarn resolutions (GHSA-q2c6-c6pm-g3gh) ([`9bf71155`](../../commit/9bf71155)).
-- Force `follow-redirects` to ^1.14.7 via yarn resolutions (GHSA-74fj-2j2h-c42q) ([`aaf0c76e`](../../commit/aaf0c76e)).
-- Force `lodash.merge` to ^4.6.2 via yarn resolutions (CVE-2018-16469) ([`96ec15f3`](../../commit/96ec15f3)).
-- Force `codemirror` to ^5.58.2 via yarn resolutions (GHSA-3p3p-7p4f-r28x) ([`23dbc469`](../../commit/23dbc469)).
-- Force `kind-of` to ^6.0.3 via yarn resolutions (CVE-2019-20149) ([`f6d7eef7`](../../commit/f6d7eef7)).
-- Force `form-data` to ^2.5.4 via yarn resolutions (GHSA-fjxv-7rqg-78g4) ([`9cdbbf4e`](../../commit/9cdbbf4e)).
-- Force `eventsource` to ^1.1.1 via yarn resolutions (GHSA-6h5x-7c5m-7cr5) ([`a8bd178b`](../../commit/a8bd178b)).
-- Force `decompress-zip` to ^0.3.2 via yarn resolutions (GHSA-3wq5-r5w8-5xhf) ([`94f2a991`](../../commit/94f2a991)).
-- Force `acorn` to ^5.7.4 via yarn resolutions (GHSA-6chw-6frg-f759) ([`8bfc0f76`](../../commit/8bfc0f76)).
-- Force `ajv` to ^6.12.3 via yarn resolutions (CVE-2020-15366 + $data ReDoS) ([`ad3c2be3`](../../commit/ad3c2be3)).
-- Force `remarkable` to ^1.7.2 via yarn resolutions (ReDoS + XSS) ([`d886d5f0`](../../commit/d886d5f0)).
-
-## [0.17.28] - 2026-05-26
+## [0.17.29] - 2026-05-26
 
 ### Fixed
 
@@ -397,6 +388,7 @@ The format is based on [Common Changelog](https://common-changelog.org) and this
 [0.17.13]: ../../compare/v0.17.12...v0.17.13
 [0.17.12]: ../../compare/v0.17.10...v0.17.12
 [0.17.10]: ../../compare/v0.17.9...v0.17.10
+[0.17.30]: ../../compare/v0.17.29...v0.17.30
 [0.17.29]: ../../compare/v0.17.28...v0.17.29
 [0.17.28]: ../../compare/v0.17.27...v0.17.28
 [0.17.27]: ../../compare/v0.17.26...v0.17.27

README.md

@@ -38,6 +38,7 @@ This is the **legacy** branch of Boostnote — a markdown-first, open-source not
 
 | Version | What changed |
 |---------|-------------|
+| 0.17.30 | Add PlantUML SVG render, ```flow alias; fix plantuml HTML entities, mermaid NaN guard, sanitizeInline regex, raphael pin, Dockerfile patch |
 | 0.17.29 | Bump katex to ^0.16.47; bulk upgrade 14 deps; force deps (dompurify, handlebars, follow-redirects, codemirror, kind-of, form-data, eventsource, decompress-zip, ajv, remarkable, lodash.merge, acorn); fix regressions |
 | 0.17.28 | Add dep-resolve skill; force deps (decode-uri-component, ws, got, glob-parent, js-yaml, set-value, ansi-regex) |
 | 0.17.27 | Bump sanitize-html to ^2.7.1; force dep versions (url-parse, dot-prop, async, ua-parser-js, sha.js, underscore, express, on-headers, min-document); drop unused immutable |

package.json

@@ -1,7 +1,7 @@
 {
   "name": "boost",
   "productName": "Boostnote",
-  "version": "0.17.29",
+  "version": "0.17.30",
   "main": "index.js",
   "description": "Boostnote",
   "license": "GPL-3.0",