diff --git a/lib/pages/chat/events/html_message.dart b/lib/pages/chat/events/html_message.dart
index 3f82806b5..51defb5f5 100644
--- a/lib/pages/chat/events/html_message.dart
+++ b/lib/pages/chat/events/html_message.dart
@@ -86,10 +86,10 @@ class HtmlMessage extends StatelessWidget {
     'rt',
     'html',
     'body',
-    // Workaround for https://github.com/krille-chan/fluffychat/issues/507
-    'tg-forward',
   };
 
+  static const Set<String> ignoredHtmlTags = {'mx-reply'};
+
   /// We add line breaks before these tags:
   static const Set<String> blockHtmlTags = {
     'p',
@@ -156,8 +156,13 @@ class HtmlMessage extends StatelessWidget {
     // We must not render elements nested more than 100 elements deep:
     if (depth >= 100) return const TextSpan();
 
-    // This is a text node, so we render it as text:
-    if (node is! dom.Element) {
+    if (node is dom.Element &&
+        ignoredHtmlTags.contains(node.localName?.toLowerCase())) {
+      return const TextSpan();
+    }
+
+    // This is a text node or not permitted node, so we render it as text:
+    if (node is! dom.Element || !allowedHtmlTags.contains(node.localName)) {
       var text = node.text ?? '';
       // Single linebreak nodes between Elements are ignored:
       if (text == '\n') text = '';
@@ -170,9 +175,6 @@ class HtmlMessage extends StatelessWidget {
       );
     }
 
-    // We must not render tags which are not in the allow list:
-    if (!allowedHtmlTags.contains(node.localName)) return const TextSpan();
-
     switch (node.localName) {
       case 'br':
         return const TextSpan(text: '\n');
@@ -261,13 +263,15 @@ class HtmlMessage extends StatelessWidget {
             child: Text.rich(
               TextSpan(
                 children: [
-                  if (node.parent?.localName == 'ul')
-                    const TextSpan(text: '• '),
-                  if (node.parent?.localName == 'ol')
-                    TextSpan(
-                      text:
-                          '${(node.parent?.nodes.whereType<dom.Element>().toList().indexOf(node) ?? 0) + (int.tryParse(node.parent?.attributes['start'] ?? '1') ?? 1)}. ',
-                    ),
+                  if (!isCheckbox) ...[
+                    if (node.parent?.localName == 'ul')
+                      const TextSpan(text: '• '),
+                    if (node.parent?.localName == 'ol')
+                      TextSpan(
+                        text:
+                            '${(node.parent?.nodes.whereType<dom.Element>().toList().indexOf(node) ?? 0) + (int.tryParse(node.parent?.attributes['start'] ?? '1') ?? 1)}. ',
+                      ),
+                  ],
                   if (node.className == 'task-list-item')
                     WidgetSpan(
                       child: Padding(
diff --git a/lib/pages/chat/events/message_content.dart b/lib/pages/chat/events/message_content.dart
index 792c63814..5cfd55c28 100644
--- a/lib/pages/chat/events/message_content.dart
+++ b/lib/pages/chat/events/message_content.dart
@@ -241,7 +241,7 @@ class MessageContent extends StatelessWidget {
             }
             var html = AppSettings.renderHtml.value && event.isRichMessage
                 ? event.formattedText
-                : event.body;
+                : event.body.replaceAll('<', '&lt;').replaceAll('>', '&gt;');
             if (event.messageType == MessageTypes.Emote) {
               html = '* $html';
             }
diff --git a/licenses.yaml b/licenses.yaml
index c10273e32..fe53d876b 100644
--- a/licenses.yaml
+++ b/licenses.yaml
@@ -27,6 +27,7 @@ packageLicenseOverride:
   platform_detect: Apache-2.0
   rxdart: Apache-2.0
   flutter_new_badger: MIT
+  sqlcipher_flutter_libs: MIT
 
   # flutter's internal packages
   flutter_driver: BSD-3-Clause
diff --git a/pubspec.lock b/pubspec.lock
index 00e5f83d2..a5a5b4931 100644
--- a/pubspec.lock
+++ b/pubspec.lock
@@ -1015,12 +1015,11 @@ packages:
   license_checker:
     dependency: "direct dev"
     description:
-      path: "."
-      ref: HEAD
-      resolved-ref: "38a65ff5b4b65db092b11dad999081388f75ece8"
-      url: "https://github.com/krille-chan/license_checker.git"
-    source: git
-    version: "1.6.0"
+      name: license_checker
+      sha256: "8a35b6946e50811e070ac6fe4717ee431cd1a334e080df2116956b54b0bb0d0f"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.6.2"
   linkify:
     dependency: "direct main"
     description:
diff --git a/pubspec.yaml b/pubspec.yaml
index 202ca1edb..6a4bcc44a 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -92,9 +92,7 @@ dev_dependencies:
   import_sorter: ^4.6.0
   integration_test:
     sdk: flutter
-  # Waiting for https://github.com/rufman/license_checker/pull/47
-  license_checker:
-    git: https://github.com/krille-chan/license_checker.git
+  license_checker: ^1.6.2
   translations_cleaner: ^0.0.5
 
 import_sorter:
diff --git a/test/command_hint_test.dart b/test/command_hint_test.dart
index 68812be5f..84f558635 100644
--- a/test/command_hint_test.dart
+++ b/test/command_hint_test.dart
@@ -8,8 +8,7 @@ import 'utils/test_client.dart';
 void main() async {
   test('Check for missing /command hints', () async {
     final translated =
-        jsonDecode(File('lib/l10n/intl_en.arb').readAsStringSync())
-            .keys
+        jsonDecode(File('lib/l10n/intl_en.arb').readAsStringSync()).keys
             .where((String k) => k.startsWith('commandHint_'))
             .map((k) => k.replaceFirst('commandHint_', ''));
     final commands = (await prepareTestClient()).commands.keys;