---
summary: "Upstream text is fenced in content[] so a comment or highlight body can no longer pass for server-authored lines, titles are entity-decoded instead of HTML-stripped, each HN link renders once as its full URL, and typed placeholder text survives stripping."
breaking: false
security: true
---

# 0.5.20 — 2026-09-23

## Changed

- **Links in HN bodies render once, as the full href**, when the link text is the href or a `...`-truncated prefix of it (compared after entity decoding); any other link keeps `text (href)`. In highlight snippets the `<em>` markers stay on the matched characters of the href. ([#25](https://github.com/cyanheads/hn-mcp-server/issues/25))

## Fixed

- **Titles are no longer HTML-stripped**: `title`, `stories[].title`, `submissions[].title`, search `title` / `storyTitle`, and `highlights.title` are entity-decoded once and keep tag-like text such as `The <Dialog> Element`. ([#23](https://github.com/cyanheads/hn-mcp-server/issues/23))
- **Placeholder text is no longer rewritten by `stripHtml`**: typed `@@CODE_0@@` or `@@EM_OPEN@@` passes through unchanged, and a numeric entity past U+10FFFF decodes to U+FFFD instead of throwing. ([#30](https://github.com/cyanheads/hn-mcp-server/issues/30))
- **`decodeHtmlEntities` decodes only its declared named entities**: an inherited name such as `&constructor;` stays as typed instead of rendering `function Object() { [native code] }`, link hrefs included.

## Security

- **Upstream bodies in `content[]` are fenced as `> ` quotes** — item and comment text, `about`, hit text, and the highlight body — so a body line cannot pass for a comment header, heading, or the `> match —` footer, which now lists the body snippet last. ([#23](https://github.com/cyanheads/hn-mcp-server/issues/23))
- **A quoted body line shaped like a link reference definition has its leading `[` escaped** (`> \[1]: url`), since CommonMark applies definitions document-wide and one could turn `[1]` or `[deleted]` in server text into a link. ([#23](https://github.com/cyanheads/hn-mcp-server/issues/23))
- **Single-line fields are escaped at the render boundary**: titles, title highlights, and poll-option text escape only the characters that could break the surrounding Markdown and collapse line breaks to a space; usernames, URLs, and IDs stay verbatim. ([#23](https://github.com/cyanheads/hn-mcp-server/issues/23))