From 97a88a6bf9927c71428cd08347c1fd6a3ee8b3f9 Mon Sep 17 00:00:00 2001
From: BlackImpostor <106878493+SkyBuilder1717@users.noreply.github.com>
Date: Sat, 31 May 2025 08:26:49 +0300
Subject: [PATCH] Update dlg_package.lua

---
 builtin/mainmenu/content/dlg_package.lua | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/builtin/mainmenu/content/dlg_package.lua b/builtin/mainmenu/content/dlg_package.lua
index 7c9a5ef45..d197a0143 100644
--- a/builtin/mainmenu/content/dlg_package.lua
+++ b/builtin/mainmenu/content/dlg_package.lua
@@ -253,23 +253,26 @@ local function get_formspec(data)
 			return text
 		end
 
-		local hypertext = ""
+		local hypertext = {}
+		local insert = table.insert
 		if package.releases then
 			for _, def in pairs(package.releases) do
-				hypertext = hypertext..
-					"<b>"..def.title.."</b> ("..def.release_date:gsub("T.*", "")..")\n"..
+				insert(hypertext,
+					"<b>"..core.hypertext_escape(def.title).."</b> ("..def.release_date:gsub("T.*", "")..")\n"..
 					fgettext("$1 downloads",
 						def.downloads)..".\n"
+				)
 
-				if def["release_notes"] then
-					hypertext = hypertext..
-						markup((def["release_notes"]
-							:gsub("<!--.*", ""))
+				if def.release_notes then
+					insert(hypertext, core.hypertext_escape(
+						markup((def.release_notes
+							:gsub("<!--.-%-%->", ""
 							:trim())
 						.."\n"
+					))
 				end
 
-				hypertext = hypertext.."\n"
+				insert(hypertext, "\n")
 			end
 		elseif data.releases_error then
 			table.insert_all(formspec, {"label[2,2;", fgettext("Error loading releases"), "]"} )
@@ -278,7 +281,7 @@ local function get_formspec(data)
 		end
 		table.insert_all(formspec, {
 			"hypertext[0,0;", W, ",", tab_body_height - 0.375,
-			";release;", core.formspec_escape(hypertext), "]",
+			";release;", core.formspec_escape(table.concat(hypertext)), "]",
 		})
 	else
 		error("Unknown tab " .. current_tab)