---
summary: "crossref_get_references markup strip rewritten (tag shape, MathML/JATS citation regions), full HTML5 named entity set"
breaking: false
security: false
---

# 0.3.6 — 2026-08-09

## Changed

- **`crossref_get_references` markup strip** rewritten in `crossref-service.ts`. A bracket is now stripped only when it is a well-formed tag — the attribute tail must be `name="value"` pairs rather than arbitrary prose (`TAG_ATTRIBUTES`), so a bracketed phrase that merely opens with an element name (`<Stack Overflow, https://…>`, `<Available from: http://…>`) is no longer read as a tag. A MathML formula or a JATS structured citation (`mixed-citation`, `element-citation`, `nlm-citation`, `citation`) deposited whole into a free-text field is matched end to end as a region and emptied of tags, rather than requiring every element inside it to be individually allow-listed. The element lists widened: link elements (never stripped, since their address lives in an attribute) now include `uri` alongside `a` and `ext-link`; inline elements add `span`, `etal`, `fname`, `article-title`, `given-names`, `person-group`, `string-name`, `surname`, `collab`; tight (no-separator) elements add `inf`, `tex`, `tex-math`, `formula`, `ref_formula`, `inline-formula`; block elements add `disp-formula`. [#50](https://github.com/cyanheads/crossref-mcp-server/issues/50)
- **Character reference decoding** (`decodeHtmlEntities`) moved from `crossref-service.ts` to a new `src/services/crossref/html-entities.ts` module and now resolves the full HTML5 named character reference set (2,125 semicolon-terminated names) plus decimal and hex numeric references, replacing the previous five-name table (`amp`, `lt`, `gt`, `quot`, `apos`). Decoding is now a single regex pass instead of chained `.replace()` calls, which closes a double-decoding defect where `&amp;lt;` incorrectly decoded to `<` instead of the literal `&lt;`. Numeric references resolve via `String.fromCodePoint` instead of `String.fromCharCode`, so astral code points no longer truncate to 16 bits; a numeric reference naming no scalar value (zero, past the last code point, half of a surrogate pair) is left as deposited. Every surface that runs through `normalizeText` picks this up: reference free text, work titles and subtitles, container titles, abstracts, journal and funder names, member and prefix names. [#51](https://github.com/cyanheads/crossref-mcp-server/issues/51)

328 tests pass; `bun run devcheck` and `bun run rebuild` clean.