chore(deps): update dependency marked to v18 by renovate[bot] · Pull Request #1171 · Doist/reactist

renovate · 2026-08-18T02:05:55Z

This PR contains the following updates:

Package	Change	Age	Confidence
marked (source)	`4.3.0` → `18.0.10`

Release Notes

markedjs/marked (marked)

`v18.0.10`

Compare Source

Bug Fixes

keep the em/strong mask the same length as the source (#4044) (681373c)
parse EOF backtick fences after paragraphs (#4039) (81bd750)
place task checkboxes after list loose is finalized (#4046) (b8cf7dc), closes #4045

`v18.0.9`

Compare Source

`v18.0.8`

Compare Source

Bug Fixes

fall back to default checkbox renderer when extension returns false (#4023) (e1b6139)

Bug Fixes

parse empty list item with trailing space (#3984) (b55410f)

`v18.0.4`

Compare Source

Bug Fixes

cache list indentation regexes (#3969) (a37983f)
fix cli not reading stdin (#3967) (11adb69)

`v18.0.3`

Compare Source

Bug Fixes

avoid task checkbox for setext heading text (#3960) (2608e81)

`v18.0.2`

Compare Source

Bug Fixes

fix infinite loop for indented code blank line (#3947) (58a52e8)

`v18.0.1`

Compare Source

Bug Fixes

rules: ensure lookbehind regex is evaluated correctly by minifiers (#3945) (abd907a)

`v18.0.0`

Compare Source

Bug Fixes

Bump typescript from 5.9.3 to 6.0.2 (#3934) (e8efc51)
prevent GFM table tokens from greedily capturing trailing newlines (#3926) (40f2665)
prevent heading and def tokens from greedily capturing multiple newlines (#3925) (b379e3e)
trim blank lines from block tokens (#3939) (b70895f)

BREAKING CHANGES

trim trailing blank lines from block tokens
update Typescript to v6

`v17.0.6`

Compare Source

Bug Fixes

avoid race condition in async parallel parse/parseInline with hooks (#3924) (6e96fa7)
cli: honor positional input file (#3922) (a1c2617)
cli: use file URL for config import (#3923) (73e1f3f)

`v17.0.5`

Compare Source

Bug Fixes

Fix catastrophic backtracking (ReDoS) in link/reflink label regex (#3918) (4625980)
prevent quadratic complexity in emStrongLDelim regex (#3906) (c732dd2)
prevent single-tilde strikethrough false positives (#3910) (5e03369)
re-assign tokenizer.lexer and renderer.parser at start of each parse call (#3907) (f3a3ec0)
trim trailing whitespace from lheading text (#3920) (3ea7e88)

`v17.0.4`

Compare Source

Bug Fixes

prevent ReDoS in inline link regex title group (#3902) (46fb9b8)

`v17.0.3`

Compare Source

Bug Fixes

escape image alt text (#3896) (909fe44)

`v17.0.2`

Compare Source

Bug Fixes

fix blockquote after list (#3888) (2a475a1)
fix empty list item (#3890) (3fc6a44)
fix list item wrong indent (#3889) (e031175)
fix list with tabs (#3891) (9fc4f8e)
fix strikethrough flanking rules (#3882) (1a5b124)

`v17.0.1`

Compare Source

Bug Fixes

fix block elements in task item (#3828) (921ee22)

`v17.0.0`

Compare Source

Bug Fixes

only create tokens inside tokenizers (#3755) (7b19231)

BREAKING CHANGES

Change how consecutive text tokens work in lists
Simplify listItem renderer
Checkbox token is added in list tokenizer
Checkbox token add type and raw property
Change loose list text tokens to paragraph type in the list tokenizer

`v16.4.2`

Compare Source

Bug Fixes

Avoid RegExp lookbehind assertions (#3816) (#3817) (c056df0)

`v16.4.1`

Compare Source

Bug Fixes

resolve even-numbered backtick precedence issue (#3776) (#3786) (1da8fb5)

`v16.4.0`

Compare Source

Bug Fixes

Fix backtick and code rendering in links (#3783) (302ee59)
fix links with square brackets in inline code break wrapping italics (#3785) (e3c0d3e)
Make www case-sensitive when detecting link starts (#3770) (626d961)

Features

Add async provideParser provideLexer (#3756) (09577e5)

`v16.3.0`

Compare Source

Features

add emStrongMask hook (#3749) (cd2b5f4)

`v16.2.1`

Compare Source

Bug Fixes

allow escaped newline in link text (#3752) (30c6630)

`v16.2.0`

Compare Source

Features

add def token in tokens and renderer (#3745) (0769124)

`v16.1.2`

Compare Source

Bug Fixes

fix multiline list item adds extra newline to raw (#3735) (e76453e)

`v16.1.1`

Compare Source

Bug Fixes

fix stong and em tokens in angle brackets (#3731) (ad8535c)

`v16.1.0`

Compare Source

Features

add generic types for parser and renderer output (#3722) (39a0ee3)

`v16.0.0`

Compare Source

Bug Fixes

remove cjs build & update min node to 20 (#3687) (0a35d8f)

BREAKING CHANGES

minify ./lib/marked.esm.js and ./lib/marked.umd.js
remove ./marked.min.js use ./lib/marked.umd.js instead
remove ./lib/marked.cjs
update minimum supported node version to 20 to support require('marked.esm.js'). see https://nodejs.org/docs/latest-v20.x/api/modules.html#loading-ecmascript-modules-using-require
This seems to break Jest since it doesn't work with esm by default.

You need to transform marked with:
```
transformIgnorePatterns: ['/node_modules/(?!(marked)/)'],
```
see Jest docs for more info

`v15.0.12`

Compare Source

Bug Fixes

use esbuild for accurate sourcemaps (#3670) (7a6b2d7)

`v15.0.11`

Compare Source

Bug Fixes

fix image alt text rendered to match common mark (#3668) (2c0e47a)

`v15.0.10`

Compare Source

Bug Fixes

fix non-breaking space in link url (#3667) (e071e25)

`v15.0.9`

Compare Source

Bug Fixes

fix link url with no closing parenthesis (#3664) (72b6373)

`v15.0.8`

Compare Source

Bug Fixes

fix emstrong inside escaped backticks (#3652) (721dc58)

`v15.0.7`

Compare Source

Bug Fixes

fix table rendered as heading (#3612) (9ae87de)

`v15.0.6`

Compare Source

Bug Fixes

fix strikethrough inside strong and em to follow gfm (#3577) (7712a53)

`v15.0.5`

Compare Source

Bug Fixes

allow strikethrough inside strong and em to follow gfm (#3569) (8a01658)

`v15.0.4`

Compare Source

Bug Fixes

fix list with no items looping forever (#3560) (e4198ed)

`v15.0.3`

Compare Source

Bug Fixes

update punctuation regex syntax to fix babel mistaken transpile (#3547) (9b988c4)

`v15.0.2`

Compare Source

Bug Fixes

update punctuation regex syntax for compatibility (#3540) (fd015f1)

`v15.0.1`

Compare Source

Bug Fixes

Remove unused plus typescript tightening (#3527) (1f579f7)

`v15.0.0`

Compare Source

Bug Fixes

escape html in renderer (#3495) (58d66e5)
Move all regexps to rules (#3519) (1f88deb)

BREAKING CHANGES

escape html in renderers instead of tokenizers for all tokens.

`v14.1.4`

Compare Source

Bug Fixes

fix del with escaped tilde (#3517) (0afe87d)
fix html comment after list (#3518) (a612576)

`v14.1.3`

Compare Source

Bug Fixes

include single nested parens in emStrong link mask (#3475) (2b7efa8)
kill SIGINT signal at man for marked --help (#3483) (b1fd3ea)

`v14.1.2`

Compare Source

Bug Fixes

fix html following list (#3444) (9d7b728)

`v14.1.1`

Compare Source

Bug Fixes

Don't replace tabs with spaces (#3438) (9ed6456)

`v14.1.0`

Compare Source

Bug Fixes

don't export block or inline (#3427) (3f0430a)

Features

add provideLexer and provideParser hooks (#3424) (447f5af)

`v14.0.0`

Compare Source

Bug Fixes

allow async option to dictate type returned (#3341) (b5a5004)
Remove useNewRenderer (#3342) (e64f226)

BREAKING CHANGES

Remove old renderer
throw an error if async: false is set when an extension sets async: true

`v13.0.3`

Compare Source

Bug Fixes

fix recursion-like stack overflow error caused by the old render… (#3380) (89af0b8)

`v13.0.2`

Compare Source

Bug Fixes

fix list item with blank first line (#3351) (d28e4c6)

`v13.0.1`

Compare Source

Bug Fixes

fix this type in extension methods (#3339) (520b9ad)

`v13.0.0`

Compare Source

Bug Fixes

Fix blockquote code continuation (#3264) (7ab8185)
Add parser as a property on the Renderer object (#3291)
Send block text tokens to the text renderer (#3291)

Features

Send token objects to renderers (#3291) (1ce59ea)
Add space renderer that returns empty string by default (#3291)
Add header and align properties to TableCell token (#3291)
Add TableRow token (#3291)
Add Checkbox token (#3291)

BREAKING CHANGES

Add space token after blockquote and hr if there are multiple newlines

Send token objects to renderers and move logic to parse tokens from the parser to the renderers.

Most extensions that update marked renderers should still work with this version but will break in a future major version.

Extensions that change marked renderers will need to be updated and use new option useNewRenderer and accept a token object instead of multiple parameters. See updated Renderer docs

// v12 renderer extension

const extension = {
  renderer: {
    heading(text, level) {
      // increase level by 1
      return `<h${level + 1}>${text}</h${level + 1}>`;
    }
  }
};

marked.use(extension);

// v13 renderer extension

const extension = {
  useNewRenderer: true,
  renderer: {
    heading(token) {
      // increase depth by 1
      const text = this.parser.parseInline(token.tokens);
      const level = token.depth;
      return `<h${level + 1}>${text}</h${level + 1}>`;
    }
  }
};

marked.use(extension);

`v12.0.2`

Compare Source

Bug Fixes

fix Setext continuation in blockquote (#3257) (e9f0eed)

`v12.0.1`

Compare Source

Bug Fixes

fix setext heading interupts (#3210) (d848445)

`v12.0.0`

Compare Source

Bug Fixes

update to commonmark spec 0.31 (#3176) (3d9017b)

BREAKING CHANGES

changes to spec
Update HTML block tags: add search, remove source
Update punctuation to include unicode punctuation and symbol categories
Update HTML comment to include

`v11.2.0`

Compare Source

Bug Fixes

Fix ENOENT error message in CLI (#3165) (bf44ae8)

Features

flatten childToken arrays (#3172) (4826841)

`v11.1.1`

Compare Source

Bug Fixes

improve lexing inline elements step's performance (#3146) (4f87b2a)

`v11.1.0`

Compare Source

Features

add processAllTokens hook (#3114) (faae243)

`v11.0.1`

Compare Source

Bug Fixes

allow Renderer class in marked.use (#3118) (a287433)

`v11.0.0`

Compare Source

Bug Fixes

clean up rules so they can be typed (#3087) (175fc0c)
fix marked types (#3103) (edae309)

BREAKING CHANGES

Lexer.rules object has been changed so it can be properly types. Some intermediate rules have been removed.

`v10.0.0`

Compare Source

Bug Fixes

run spec tests with testutils (#3017) (014d4e6)

BREAKING CHANGES

drop support for node v16

`v9.1.6`

Compare Source

Bug Fixes

fix instance options sent to lexer and parser (#3073) (f9d08cc)

`v9.1.5`

Compare Source

Bug Fixes

fix emstrong unicode (#3070) (54b6d1c)

`v9.1.4`

Compare Source

Bug Fixes

Fix type declaration bundle(s) (#3038) (a7b402c)

`v9.1.3`

Compare Source

Bug Fixes

fix empty heading breaks paragraph and table (#3050) (a1034e6)

`v9.1.2`

Compare Source

Bug Fixes

trim newline from blockquote token.text (#3037) (92033e5)

`v9.1.1`

Compare Source

Bug Fixes

add marked.min.js to package exports (#3035) (71fc094)

`v9.1.0`

Compare Source

Features

add --no-clobber option to CLI (#3025) (b8adee7)

`v9.0.3`

Compare Source

Bug Fixes

marked --help (#2991) (43643b3)

`v9.0.2`

Compare Source

Bug Fixes

fix unicode emstrong (#2989) (8ebbb3c)

`v9.0.1`

Compare Source

Bug Fixes

fix unexpected setext heading (#2986) (bcc3067)
single column table (#2985) (0743d4a)

`v9.0.0`

Compare Source

Bug Fixes

Clean up files in repo (#2963) (7d95a91)

BREAKING CHANGES

remove built files from git repo.
If you need to use the latest version of marked on the web you can use a cdn to get marked.min.js from npm:
- https://cdn.jsdelivr.net/npm/marked/marked.min.js

`v8.0.1`

Compare Source

Bug Fixes

deprecated trimLeft/trimRight (#2973) (eda75a6)
fix space removed after checkbox (#2971) (9a2a4ad)

`v8.0.0`

Compare Source

Bug Fixes

remove deprecated options (#2936) (22ebdb2)

Features

add --config options to marked cli (#2937) (fc643a2)

BREAKING CHANGES

deprecated options removed. See https://marked.js.org/using_advanced#options to see how to enable the removed options with extensions.

`v7.0.5`

Compare Source

Bug Fixes

remove unknown from walkTokens return types (#2955) (65934c1)

`v7.0.4`

Compare Source

Bug Fixes

fix more types (#2893) (a990c54)
ignore async: false when async: true is set by an extension (#2920) (b6ee877)

`v7.0.3`

Compare Source

Bug Fixes

Fix unicode Regex miscounting emoji length (#2942) (f3af23e)

`v7.0.2`

Compare Source

Bug Fixes

fix sourcemaps and circular dependencies (#2929) (eb4ce21)
noImplicitAny: true (#2891) (ff1602c)

`v7.0.1`

Compare Source

Bug Fixes

use rollup to output js files (#2916) (610bc45)

`v7.0.0`

Compare Source

Bug Fixes

change defaults for mangle and headerIds to false (#2890) (63a839b)

BREAKING CHANGES

change defaults for mangle and headerIds to false

`v6.0.0`

Compare Source

Bug Fixes

Migrate to Typescript (#2805) (cb54906)

BREAKING CHANGES

Migrate to Typescript

`v5.1.2`

Compare Source

Bug Fixes

Add support for Node 16 (#2886) (e465ce4)

`v5.1.1`

Compare Source

Bug Fixes

fix typo (#2870) (e6a7184)

`v5.1.0`

Compare Source

Bug Fixes

Simplify unicode punctuation (#2841) (f19fe76)

Features

add Marked instance (#2831) (353e13b)

`v5.0.5`

Compare Source

Bug Fixes

Fix more Escape conflicts (#2838) (f879a23)

`v5.0.4`

Compare Source

Bug Fixes

Add Unicode punctuations (#2811) (b213f02)
fix hr after list (#2809) (efc40df)
Replace custom repeatString function with repeat() (#2820) (72ee2d6)

`v5.0.3`

Compare Source

Bug Fixes

fix quadratic execution in em mask (#2818) (a37fe8e)

`v5.0.2`

Compare Source

Bug Fixes

Clarify deprecation messages for default parameters (#2802) (763e9de)

`v5.0.1`

Compare Source

Bug Fixes

only warn if langPrefix is changed (#2796) (d193694)
The deprecated options warnings can be turned off by default by using:
```
marked.use({
  mangle: false,
  headerIds: false,
});
```
For the cli you can use:
```
marked --no-mangle --no-header-ids ...
```

`v5.0.0`

Compare Source

Bug Fixes

deprecate options (#2766) (62d3312)
update min node to v18 (#2767) (c6852f5)

Features

add block param to html renderer (#2768) (fa21b9f)

BREAKING CHANGES

Warnings will be logged to the console if these options are used including headerIds, mangle, and langPrefix which are on by default.
These warnings can be turned off by default by using:
```
marked.use({
  mangle: false,
  headerIds: false,
});
```
If you need these options you can use the extensions listed below.

deprecate options

Option	Replacement
`highlight`, `langPrefix`, and `callback`	marked-highlight
`mangle`	marked-mangle
`baseUrl`	marked-base-url
`smartypants`	marked-smartypants
`xhtml`	marked-xhtml
`headerIds` and `headerPrefix`	marked-gfm-heading-id

minimum supported node version v18

Configuration

📅 Schedule: (UTC)

Branch creation
- Monday through Friday (* * * * 1-5)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

doistbot

This PR bumps marked from v4.3.0 to v18.0.9 in package.json.

Few things worth tightening:

Lockfile is out of sync: package-lock.json still pins marked at 4.3.0 (root devDependencies and node_modules/marked). npm ci will fail until the lockfile is regenerated — run npm install and commit the updated package-lock.json.
TypeScript return type changed in v5+: marked() now returns string | Promise<string>, which will cause type errors in src/prose/prose-example.ts and src/prose/prose.stories.tsx where the result is assigned to dangerouslySetInnerHTML.__html (expecting string). Pass { async: false } to marked() to force the synchronous string overload.

I also left one optional follow-up note in the details below.

Optional follow-up note (1)

package.json:135: @types/marked is still pinned to 4.3.2, the DefinitelyTyped package for marked v4, so it no longer matches the runtime major being installed here. Align or remove it in this bump so TypeScript resolves types for marked 18 rather than stale v4 typings.

_{Share Feedback • Review Logs}

doistbot · 2026-08-18T02:10:05Z

        "less": "4.9.0",
        "lint-staged": "10.5.4",
-        "marked": "4.3.0",
+        "marked": "18.0.9",


package.json now specifies marked@18.0.9, but package-lock.json still pins marked at 4.3.0 (root devDependencies at line 83 and the node_modules/marked entry). npm ci validates that these two files are in sync and will fail until the lockfile is regenerated. Run npm install and commit the resulting package-lock.json changes.

doistbot · 2026-08-18T02:10:05Z

        "less": "4.9.0",
        "lint-staged": "10.5.4",
-        "marked": "4.3.0",
+        "marked": "18.0.9",


marked v5+ changed marked()'s TypeScript return type from string to string | Promise<string>. src/prose/prose-example.ts assigns the return value to dangerouslySetInnerHTML.__html (which expects string) in prose.stories.tsx (lines 70, 89, 116). npm run type-check would fail once the lockfile is updated. Fix by passing { async: false } to force the string overload, e.g. marked(src, { async: false }).

renovate Bot added the dependencies Pull requests that update a dependency file label Aug 18, 2026

doistbot reviewed Aug 18, 2026

View reviewed changes

chore(deps): update dependency marked to v18

c3dc355

renovate Bot force-pushed the renovate/marked-18.x branch from 0facd1b to c3dc355 Compare August 23, 2026 03:38

Navigation Menu

Uh oh!

chore(deps): update dependency marked to v18 - #1171

chore(deps): update dependency marked to v18#1171
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/marked-18.x

renovate Bot commented Aug 18, 2026 •

edited

Loading

Uh oh!

doistbot left a comment

Uh oh!

doistbot Aug 18, 2026

Uh oh!

doistbot Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

BREAKING CHANGES

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

BREAKING CHANGES

Bug Fixes

Bug Fixes

Bug Fixes

Features

Features

Bug Fixes

Features

Bug Fixes

Bug Fixes

Features

Bug Fixes

BREAKING CHANGES

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

BREAKING CHANGES

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

BREAKING CHANGES

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

BREAKING CHANGES

Bug Fixes

Bug Fixes

Bug Fixes

BREAKING CHANGES

Bug Fixes

Features

Bug Fixes

Features

Bug Fixes

Bug Fixes

BREAKING CHANGES

Bug Fixes

BREAKING CHANGES

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

renovate Bot commented Aug 18, 2026 •

edited

Loading