Markdown PDF Files

2.1.0 (2026/05/24)

Breaking Changes

• Security hardening: Raw HTML in Markdown is now sanitized by default according to the GFM Disallowed Raw HTML extension. The following are removed from Markdown body content:
• Tags: <script>, <iframe>, <style>, <textarea>, <title>, <xmp>, <noembed>, <noframes>, <plaintext> (opening < is escaped to <, content is preserved as visible text)
• on* event handler attributes (onclick, onload, etc.)
• href / src attributes whose value begins with javascript:
• The behavior is controlled by the new markdown-pdf.sanitize setting ("gfm" / "gfm-allow-style" / "none", default "gfm"). See README for details and migration notes.
• To preserve pre-change behavior, set markdown-pdf.sanitize to "none". To keep inline <style> only, use "gfm-allow-style". Existing layout CSS can also be migrated to external files via markdown-pdf.styles.

Changes

• Add markdown-pdf.sanitize setting for raw HTML sanitization (see Breaking Changes above)
• Add support for ```plantuml fenced code blocks as a PlantUML syntax in addition to the existing @startuml / @enduml block markers. Both are supported on equal footing (the fence form is the same one used by VS Code preview, GitHub, and GitLab) #92 #162 #389
• Automatically download the latest Chrome Stable build when Chromium is needed, instead of using only the build id pinned by puppeteer-core. If the Chrome for Testing API is unreachable, the extension falls back to the latest cached build, and finally to the puppeteer-core bundled build id. Add the new markdown-pdf.chromium.autoDownload setting (default true); set it to false to opt out of the automatic download and rely on an installed system browser (Chrome / Chromium / Edge) or markdown-pdf.executablePath.
• Add math rendering support via KaTeX for $...$, $$...$$, \(...\), \[...\], and ```math fenced code blocks (matches VS Code's built-in Markdown preview). Controlled by the new markdown-pdf.math.enabled (default true) and markdown-pdf.math.katex.macros settings.