release: v2.10.6 sanitize highlight output and import/heading fixes

- Sec: filter hljs output to span+class before dangerouslySetInnerHTML so
  the syntax-highlight path can't bypass rehype-sanitize.
- Enhance: accept .markdown/.mdown/.mkd on drag-drop and button import.
- Fix: preserve snake_case underscores in the suggested PDF filename.
- Fix: re-clamp editor pane width on window resize.

Bundles the prior bug-hunt fixes (FileReader error handling, DragBar
mouse-grab snap, async rejection handling) into this patch release.

Author: marcop135

CHANGELOG.md

@@ -2,6 +2,16 @@
 
 **Labels:** **Build**, **Chore**, **CI**, **Docs**, **Enhance**, **Feat**, **Fix**, **Perf**, **Revert**, **Sec**, **Style**; add **(WIP)** for incomplete work.
 
+## [2.10.6] - 2026-06-02
+
+- **Enhance:** Accept `.markdown`, `.mdown`, and `.mkd` files on import, not just `.md`.
+- **Fix:** Failed or aborted file reads no longer lock out imports or fail silently.
+- **Fix:** Dragging the divider no longer snaps the editor pane by up to 15px.
+- **Fix:** Re-clamp the editor pane width on window resize so it cannot overflow.
+- **Fix:** Keep `snake_case` underscores in the heading used as the suggested PDF filename.
+- **Fix:** Print proceeds even when Mermaid rendering rejects, and async rejections are handled.
+- **Sec:** Sanitize syntax-highlight output before injection so it cannot bypass the markdown sanitizer.
+
 ## [2.10.5] - 2026-06-02
 
 - **Chore:** Add `dependabot.yml` so npm and github-actions updates arrive as weekly grouped PRs after the npm migration.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "md2pdf",
-  "version": "2.10.5",
+  "version": "2.10.6",
   "packageManager": "npm@10.9.3",
   "description": "Mobile-friendly Markdown to PDF in your browser with GFM, syntax highlighting, and Mermaid. Works offline; nothing is uploaded for conversion. Fork of realdennis/md2pdf (MIT).",
   "keywords": [

src/App/Components/Header/Upload.js

@@ -11,8 +11,8 @@ export default (props) => {
     const files = e.currentTarget.files;
     if (files.length > 0) {
       const file = files[0];
-      if (!/\.(md)$/i.test(file.name)) {
-        alert('Only .md files are allowed.');
+      if (!/\.(md|markdown|mdown|mkd)$/i.test(file.name)) {
+        alert('Only Markdown files are allowed.');
         e.target.value = '';
         return;
       }
@@ -39,7 +39,7 @@ export default (props) => {
         type="file"
         style={{ display: 'none' }}
         onChange={onChange}
-        accept=".md"
+        accept=".md,.markdown,.mdown,.mkd"
       />
       <label
         htmlFor="mdFile"

src/App/Components/Markdown/Previewer/Preview.js

@@ -96,6 +96,31 @@ const highlight = (str, lang) => {
   return '';
 };
 
+// hljs emits only <span class="hljs-*"> wrappers around HTML-escaped text.
+// That output is injected via dangerouslySetInnerHTML, i.e. *after*
+// rehype-sanitize has already run, so re-filter it down to span+class to keep
+// "sanitize is the last line" true for the syntax-highlight path too.
+export const sanitizeHighlightHtml = (html) => {
+  if (typeof document === 'undefined') return '';
+  const template = document.createElement('template');
+  template.innerHTML = html;
+  const walk = (parent) => {
+    Array.from(parent.childNodes).forEach((node) => {
+      if (node.nodeType !== 1) return;
+      if (node.tagName !== 'SPAN') {
+        parent.replaceChild(document.createTextNode(node.textContent), node);
+        return;
+      }
+      Array.from(node.attributes).forEach((attr) => {
+        if (attr.name !== 'class') node.removeAttribute(attr.name);
+      });
+      walk(node);
+    });
+  };
+  walk(template.content);
+  return template.innerHTML;
+};
+
 /** react-markdown's defaultUrlTransform drops `tel:` (CV contact rows); keep it. */
 const urlTransform = (value) => {
   const v = String(value || '').trim();
@@ -139,7 +164,7 @@ export default ({ source, children }) => {
         <code
           className={className}
           dangerouslySetInnerHTML={{
-            __html: highlight(trimmedCode, match[1]),
+            __html: sanitizeHighlightHtml(highlight(trimmedCode, match[1])),
           }}
         />
       );

src/App/Components/Markdown/index.js

@@ -21,6 +21,17 @@ const Markdown = ({ className }) => {
   const [uploading, isOver] = useDrop(markdownRef, setText);
   const isMobile = useIsMobile();
 
+  useEffect(() => {
+    // The editor pane is flex-shrink:0 with a pixel width, so shrinking the
+    // window would otherwise push the divider and preview off-screen. Clamp
+    // the stored width down (never up) to leave room for the preview.
+    const handleResize = () => {
+      setWidth((w) => Math.min(w, Math.max(200, window.innerWidth - 200)));
+    };
+    window.addEventListener('resize', handleResize);
+    return () => window.removeEventListener('resize', handleResize);
+  }, []);
+
   useEffect(() => {
     const handleMouseUp = () => setDrag(false);
     const handleTouchEnd = () => setDrag(false);

src/App/Container/Hooks/useDrop.js

@@ -38,7 +38,7 @@ function useDrop(ref, onLoad = () => {}) {
         files &&
         files[0] &&
         files[0].name &&
-        /\.(md)$/i.test(files[0].name) &&
+        /\.(md|markdown|mdown|mkd)$/i.test(files[0].name) &&
         files[0].size <= MAX_FILE_SIZE &&
         !uploadingRef.current
       ) {

src/App/Lib/printTitle.js

@@ -11,8 +11,10 @@ const stripInlineMarkdown = (text) =>
     .replace(/`([^`]+)`/g, '$1')
     .replace(/\*\*([^*]+)\*\*/g, '$1')
     .replace(/\*([^*]+)\*/g, '$1')
-    .replace(/__([^_]+)__/g, '$1')
-    .replace(/_([^_]+)_/g, '$1')
+    // Underscores only mark emphasis when not intraword (CommonMark), so the
+    // boundary guards keep snake_case identifiers in headings intact.
+    .replace(/(^|[^\w])__([^_]+)__(?!\w)/g, '$1$2')
+    .replace(/(^|[^\w])_([^_]+)_(?!\w)/g, '$1$2')
     .replace(/!\[([^\]]*)\]\([^)]*\)/g, '$1')
     .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
     .replace(/<\/?[^>]+>/g, '');

src/App/Lib/printTitle.test.js

@@ -72,6 +72,14 @@ describe('extractHeading', () => {
     expect(extractHeading('# foo/bar:baz?')).toBe('foo bar baz');
   });
 
+  test('keeps intraword underscores in snake_case headings', () => {
+    expect(extractHeading('# my_snake_case_var')).toBe('my_snake_case_var');
+  });
+
+  test('still strips underscore emphasis at word boundaries', () => {
+    expect(extractHeading('# _italic_ word')).toBe('italic word');
+  });
+
   test('returns empty string when no heading found', () => {
     expect(extractHeading('just prose, nothing else')).toBe('');
   });