chore(deps): bump streamdown to 2.7.1 - #9897

Summary

• Bumps streamdown 2.5.0 → 2.7.1 in apps/sim and the @sim/workflow-renderer devDependency (its >=2.5.0 peer floor is unchanged; nothing here needs 2.7). Lockfile: remend 1.3.0 → 1.4.0, and streamdown no longer pulls mermaid (Sim's own pinned mermaid is unaffected). marked was already forced to 18.0.11 by the root override, which 2.7 now targets officially.
• Streamdown 2.6+ stops stripping its streaming placeholders and hands them to custom components: an image or link whose URL is still arriving now reaches the renderer as src="streamdown:incomplete-image" / href="streamdown:incomplete-link". The mothership chat overrides img and a, so without a change a streaming image showed a broken <img> inside a clickable Lightbox, and a streaming link became a target=_blank anchor to a bogus URL. chat-content.tsx now withholds a pending image (same as 2.5, which dropped it) and renders a pending link as its text until the URL completes (2.5 showed gray "partial link [blocked]" text).
• Reworded the remount comment in chat-content.tsx that cited 2.5's minified memo internals (E/qe), which 2.6 changed. The remount itself is unchanged.
• No removed or renamed props are used (codeDownload was never used). The new codeBlockMaxHeight and tableMaxHeight defaults don't reach Sim, because every surface overrides code/pre and table.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other: dependency upgrade

Testing

I server-rendered (react-dom/server) Sim's real components with the same inputs on 2.5.0 and on 2.7.1: mothership ChatContent (static/reload path, streaming path, and four partial streaming chunks), the deployed-chat MarkdownRenderer, and the workflow note NoteBlockView (plain and with search highlight). The markdown covered headings, inline code, links, an autolink, a reference link, a remote image, an inline file image, a table, a ts fence, a mermaid fence, $…<…$ math, and a loose list. Then I diffed the HTML.

• Byte-identical on both versions: mothership static mode, deployed chat (full and partial), and the note (plain and search).
• Images: the remote image renders the same way on both versions on every surface. Streamdown's default rehype-harden config (allowedImagePrefixes: ["*"]) and the prop-replaces-defaults merge are unchanged. The inline file reference is still rewritten to /api/mothership/chats/<chat>/images/<request>?path=… by privateImageUrls.
• Mothership streaming differences, all expected:
  • Animation markup: trailing spaces now sit inside the word spans, inline code gets per-word fade spans, and blocks carry data-sd-animated (2.6 animate rework).
  • [text][label] with its definition in another block now resolves to a link (2.7.1 fix). On 2.5 it rendered as raw text.
  • $$ \sum_{j<k} $$ no longer truncates the rest of the reply (2.7 fix). On 2.5, every block after the <, including the following paragraph and the list, was silently dropped while streaming.
  • Pending link and image: as described above, after this PR's fix. I confirmed that without the fix, 2.7.1 rendered the sentinel <img> and anchor.
• @sim/workflow-renderer type-check and search-highlight.test.tsx pass. chat-content/external-link.test.tsx passes. bun install --frozen-lockfile is clean.
• Needs a human eye: the stream fade timing. 2.6 moves word stagger onto a shared wall-clock timeline, and Sim uses stagger: 0, duration: 220. SSR can't show timing, so please glance at a live streamed reply.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code