Bump to v0.12.16 — security hardening: http(s) scheme guard on link sinks, loop-stable HTML tag strip

src/components/feed/FountainCard.tsx

@@ -3,6 +3,7 @@ import type { ContentSegment } from "../../lib/parsing";
 import type { PodcastEpisode } from "../../types/podcast";
 import { resolveFountainEpisode } from "../../lib/podcast";
 import { usePodcastStore } from "../../stores/podcast";
+import { safeHttpUrl } from "../../lib/utils";
 
 export function FountainCard({ seg }: { seg: ContentSegment }) {
   const [episode, setEpisode] = useState<PodcastEpisode | null>(null);
@@ -22,7 +23,7 @@ export function FountainCard({ seg }: { seg: ContentSegment }) {
     // Fallback: render as a regular link
     return (
       <a
-        href={seg.value}
+        href={safeHttpUrl(seg.value)}
         target="_blank"
         rel="noopener noreferrer"
         className="mt-2 flex items-center gap-3 rounded-sm bg-bg-raised border border-border p-3 hover:bg-bg-hover transition-colors cursor-pointer"

src/components/feed/MediaCards.tsx

@@ -1,5 +1,6 @@
 import { ContentSegment } from "../../lib/parsing";
 import { usePodcastStore } from "../../stores/podcast";
+import { safeHttpUrl } from "../../lib/utils";
 
 export function VideoBlock({ sources }: { sources: string[] }) {
   if (sources.length === 0) return null;
@@ -76,7 +77,7 @@ export function AudioBlock({ sources }: { sources: string[] }) {
 export function YouTubeCard({ seg }: { seg: ContentSegment }) {
   return (
     <a
-      href={seg.value}
+      href={safeHttpUrl(seg.value)}
       target="_blank"
       rel="noopener noreferrer"
       className="mt-2 flex items-center gap-3 rounded-sm bg-bg-raised border border-border p-3 hover:bg-bg-hover transition-colors cursor-pointer"
@@ -98,7 +99,7 @@ export function YouTubeCard({ seg }: { seg: ContentSegment }) {
 export function VimeoCard({ seg }: { seg: ContentSegment }) {
   return (
     <a
-      href={seg.value}
+      href={safeHttpUrl(seg.value)}
       target="_blank"
       rel="noopener noreferrer"
       className="mt-2 flex items-center gap-3 rounded-sm bg-bg-raised border border-border p-3 hover:bg-bg-hover transition-colors cursor-pointer"
@@ -117,7 +118,7 @@ export function VimeoCard({ seg }: { seg: ContentSegment }) {
 export function SpotifyCard({ seg }: { seg: ContentSegment }) {
   return (
     <a
-      href={seg.value}
+      href={safeHttpUrl(seg.value)}
       target="_blank"
       rel="noopener noreferrer"
       className="mt-2 flex items-center gap-3 rounded-sm bg-bg-raised border border-border p-3 hover:bg-bg-hover transition-colors cursor-pointer"
@@ -136,7 +137,7 @@ export function SpotifyCard({ seg }: { seg: ContentSegment }) {
 export function TidalCard({ seg }: { seg: ContentSegment }) {
   return (
     <a
-      href={seg.value}
+      href={safeHttpUrl(seg.value)}
       target="_blank"
       rel="noopener noreferrer"
       className="mt-2 flex items-center gap-3 rounded-sm bg-bg-raised border border-border p-3 hover:bg-bg-hover transition-colors cursor-pointer"

src/components/feed/TextSegments.tsx

@@ -4,6 +4,7 @@ import { useUIStore } from "../../stores/ui";
 import { useProfile } from "../../hooks/useProfile";
 import { ContentSegment } from "../../lib/parsing";
 import { getNDK, fetchWithTimeout } from "../../lib/nostr";
+import { safeHttpUrl } from "../../lib/utils";
 
 // Returns true if we handled the URL internally (njump.me interception).
 export function tryHandleUrlInternally(url: string): boolean {
@@ -122,7 +123,7 @@ export function renderTextSegments(
         elements.push(
           <a
             key={i}
-            href={seg.value}
+            href={safeHttpUrl(seg.value)}
             target="_blank"
             rel="noopener noreferrer"
             className="text-accent hover:text-accent-hover underline underline-offset-2 decoration-accent/40"

src/components/podcast/EpisodeList.tsx

@@ -2,6 +2,7 @@ import { useState, useEffect } from "react";
 import type { PodcastShow, PodcastEpisode } from "../../types/podcast";
 import { getEpisodes } from "../../lib/podcast";
 import { usePodcastStore } from "../../stores/podcast";
+import { stripHtmlTags } from "../../lib/utils";
 
 function SubscribeButton({ show }: { show: PodcastShow }) {
   const subscribed = usePodcastStore((s) => s.isSubscribed(show.feedUrl));
@@ -87,7 +88,7 @@ export function EpisodeList({ show, onBack }: EpisodeListProps) {
           </div>
           {show.description && (
             <div className="text-[11px] text-text-dim mt-1 line-clamp-3">
-              {show.description.replace(/<[^>]+>/g, "").slice(0, 200)}
+              {stripHtmlTags(show.description).slice(0, 200)}
             </div>
           )}
         </div>

src/components/podcast/PodcastCard.tsx

@@ -1,5 +1,6 @@
 import type { PodcastShow } from "../../types/podcast";
 import { usePodcastStore } from "../../stores/podcast";
+import { stripHtmlTags } from "../../lib/utils";
 
 interface PodcastCardProps {
   show: PodcastShow;
@@ -32,7 +33,7 @@ export function PodcastCard({ show, onClick }: PodcastCardProps) {
         <div className="text-[11px] text-text-muted truncate">{show.author}</div>
         {show.description && (
           <div className="text-[11px] text-text-dim mt-1 line-clamp-2">
-            {show.description.replace(/<[^>]+>/g, "").slice(0, 120)}
+            {stripHtmlTags(show.description).slice(0, 120)}
           </div>
         )}
       </button>