fix(desktop): keep decoded release notes inert

Entity decoding runs after the tag scan, so `<script>` — how GitHub
renders a tag an author typed literally — became `<script>` once the scan
could no longer see it. The update dialog renders this value with a Markdown
component that does render raw HTML, so escape the angle brackets on the way
out: the text still reads as written and can no longer open an element.

Author: elkaix

apps/desktop/src/updater.ts

@@ -180,6 +180,18 @@ function skipRawTextElement(value: string, name: string, from: number): number {
   return value.length
 }
 
+/**
+ * Decoding runs after the scan, so `<script>` — which is how GitHub
+ * renders a literal tag an author typed — turns back into `<script>` once the
+ * scan can no longer see it. The update dialog renders this value with a
+ * Markdown component that does render raw HTML, so the decoded text has to
+ * leave here inert. Escaping the angle brackets keeps it readable: a Markdown
+ * renderer prints `&lt;` as `<` text rather than opening an element.
+ */
+function escapeMarkupStarts(value: string): string {
+  return value.replaceAll('<', '&lt;').replaceAll('>', '&gt;')
+}
+
 /**
  * The GitHub provider reads the releases Atom feed, whose `<content>` is the
  * body GitHub has already rendered to HTML. The renderer shows these notes as
@@ -214,7 +226,7 @@ function plainReleaseNotes(value: string): string {
     else if (tag.closing && BLOCK_BREAK_TAGS.has(tag.name)) text += '\n'
     index = tag.end + 1
   }
-  return decodeEntities(text)
+  return escapeMarkupStarts(decodeEntities(text))
     .replaceAll(/[^\S\n]+\n/gu, '\n')
     .replaceAll(/\n{3,}/gu, '\n\n')
     .trim()

apps/desktop/tests/updater.spec.ts

@@ -970,6 +970,32 @@ describe('update prompt receipts', () => {
     expect(notes).not.toContain('hidden()')
   })
 
+  it('does not let encoded markup decode back into tags', async () => {
+    vi.resetModules()
+    const directory = temporaryDirectory()
+    writeFileSync(join(directory, 'app-update.yml'), '', 'utf8')
+    const { app: localApp } = await import('electron')
+    const localElectronUpdater = (await import('electron-updater')).default
+    const {
+      getUpdateState: getLocalUpdateState,
+      initUpdater: initLocalUpdater,
+    } = await import('../src/updater')
+    const localAutoUpdater = localElectronUpdater.autoUpdater
+    vi.mocked(localApp.getPath).mockReturnValue(directory)
+    Object.defineProperty(localApp, 'isPackaged', { configurable: true, value: true })
+    Object.defineProperty(process, 'resourcesPath', { configurable: true, value: directory })
+
+    initLocalUpdater(() => undefined)
+    const available = vi.mocked(localAutoUpdater.on).mock.calls
+      .find(([event]) => event === 'update-available')?.[1] as ((info: { version: string, releaseNotes?: string }) => void) | undefined
+    available?.({
+      version: '1.2.3',
+      releaseNotes: '<p>Note</p>&lt;script&gt;payload&lt;/script&gt;',
+    })
+
+    expect(getLocalUpdateState().releaseNotes).toBe('Note\n&lt;script&gt;payload&lt;/script&gt;')
+  })
+
   it('reports a pending install that did not take effect as an error', async () => {
     vi.resetModules()
     const directory = temporaryDirectory()