fix: add output encoding in releaseNotesTab.component.ts (#11535)

Co-authored-by: Eugene <inbox@null.page>

tabby-settings/src/components/releaseNotesTab.component.ts

@@ -1,7 +1,8 @@
 /* eslint-disable @typescript-eslint/explicit-module-boundary-types */
 import { marker as _ } from '@biesbjerg/ngx-translate-extract-marker'
 import { marked } from '../../node_modules/marked/lib/marked.esm.js'
-import { Component, Injector } from '@angular/core'
+import { Component, Injector, SecurityContext } from '@angular/core'
+import { DomSanitizer } from '@angular/platform-browser'
 import { BaseTabComponent, TranslateService } from 'tabby-core'
 
 export interface Release {
@@ -21,7 +22,7 @@ export class ReleaseNotesComponent extends BaseTabComponent {
     releases: Release[] = []
     lastPage = 1
 
-    constructor (translate: TranslateService, injector: Injector) {
+    constructor (translate: TranslateService, injector: Injector, private domSanitizer: DomSanitizer) {
         super(injector)
         this.setTitle(translate.instant(_('Release notes')))
         this.loadReleases(1)
@@ -36,7 +37,7 @@ export class ReleaseNotesComponent extends BaseTabComponent {
         this.releases = this.releases.concat(releases.map(r => ({
             name: r.name,
             version: r.tag_name,
-            content: marked(r.body),
+            content: this.domSanitizer.sanitize(SecurityContext.HTML, marked(r.body)) ?? '',
             date: new Date(r.created_at),
         })))
         this.lastPage = page