Replace harden-react-markdown with rehype-harden

[haydenbleasel]

This pull request migrates the streamdown package from using harden-react-markdown to the newer and more flexible rehype-harden for markdown security hardening. This includes updating the API to accept a new hardenOptions prop, removing the old security props, and updating dependencies, documentation, and tests accordingly.

Migration to rehype-harden and API changes:

• Replaced the harden-react-markdown dependency with rehype-harden throughout the codebase, and removed all usage and mocking of harden-react-markdown in tests and implementation. (packages/streamdown/index.tsx, packages/streamdown/package.json, pnpm-lock.yaml, packages/streamdown/__tests__/*) [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15]

• Changed the Streamdown component API: replaced the allowedImagePrefixes, allowedLinkPrefixes, and defaultOrigin props with a single hardenOptions prop that is passed directly to rehype-harden. Updated all relevant type definitions and usage. (packages/streamdown/index.tsx, apps/website/app/components/props.tsx, packages/streamdown/README.md) [1] [2] [3] [4] [5] [6] [7]

Documentation updates:

• Updated the documentation to reflect the migration from harden-react-markdown to rehype-harden, including the new hardenOptions API and changes in the default security plugin. (packages/streamdown/README.md) [1] [2]

Testing improvements:

• Added a new comprehensive test suite for the hardenOptions prop, covering various scenarios and option combinations for security hardening. (packages/streamdown/__tests__/harden-options.test.tsx)
• Updated existing tests to use the new hardenOptions prop and removed tests for the old security props. (packages/streamdown/__tests__/streamdown.test.tsx)

Changelog:

• Added a changeset documenting the migration from harden-react-markdown to rehype-harden. (.changeset/cute-deer-cut.md)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
streamdown	Ready	Preview	Comment	Oct 9, 2025 11:59pm