13.1.0 - 2026-11-13

Improvements

• AIChat, Chat and AIPrompt get an AllowHtml parameter (default true). Set it to false to show HTML in messages as literal text when they come from other users or from a model that reads untrusted content.

Fixes

• Markdown sanitizes embedded HTML safely. Event handlers such as <img/src=x onerror=...> could get through before; HTML is now rebuilt from allow-listed tags and attributes with every value re-encoded, and URLs are limited to http, https, mailto, relative URLs and data:image/ for images.
• Markdown no longer crashes or stalls on malformed or hostile input, such as unclosed or deeply nested tags, links like [c](//), unterminated <!--, very long paragraphs or wide tables.
• DropDown, DropDownDataGrid and AutoComplete no longer select an item when they are disabled while the popup is open (#2817, #2818, #2819). Thanks to @Xapollon430!
• DatePicker day selection, time editing and the OK button respect ReadOnly set while the popup is open (#2816). Thanks to @Xapollon430!
• SpreadsheetInsertImage inserts an image at its natural pixel size instead of 2,000,000 by 1,500,000 pixels.

Changes in behavior

• Markdown no longer allows style, id, name, action or contenteditable attributes, form tags, or html, head, body, map and area by default. Add them back through AllowedHtmlTags and AllowedHtmlAttributes.
• Markdown drops URLs with other schemes (for example tel:), renders rejected links as plain text, and closes HTML elements within each HTML block.
• Markdown shows nesting deeper than 100 levels as plain text.