npm / marked
marked
What changed in marked 16 to 18, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
5 breaking4 security4 new APIs and options6 performance1 behavior and defaults65 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initmarked 1860 changes
Breaking changes 3
Unbalanced parentheses in link destinations are now rejected.
GFM email autolinks are rejected when their domain ends in an underscore or hyphen.
Trailing blank lines are trimmed from block tokens.
Security 1
Fixed an infinite loop when parsing an indented code blank line.
New APIs and options 1
Adds lexer state that enables failing fast during link token generation.
Performance 5
Nested lists avoid repeated raw string copies, improving parsing performance.
walkTokens now runs in linear time by appending values in place.
Avoids O(n^2) backtracking during HTML block closing and tilde interruption parsing.
Avoids O(n^2) masked source rebuilding during inline tokenization.
Avoids O(n^2) backtracking when processing inline link hrefs.
Fixes and other changes 50
Blockquotes now end before a lazy line following a heading, horizontal rule, or HTML block.
Decoded character references no longer form a new character reference.
The CLI now honors an explicitly empty string input.
Backslashes in code spans no longer hide emphasis.
Indented and type 3–5 HTML blocks can now interrupt a paragraph.
pre, script, style, and textarea are matched as whole tag names.
Enclosing link state is preserved after parsing images.
List continuation indentation now respects tab stops.
CLI configuration files can now be loaded using top-level await.
Avoids cubic backtracking on unicode whitespace in link destinations.
GFM protocol autolinks are now supported.
Setext heading text now allows indented lines.
Internal tabs in list item content are now preserved.
Whitespace is now stripped when normalizing link reference labels.
Numeric character references are now decoded in text.
Text following an empty nested blockquote is now preserved.
Leading whitespace after a hard line break is now removed.
HTML block start conditions are now matched when ending a list item.
A tab following spaces in an indented code block is now stripped.
Raw tokens are now respected when closing link labels.
Reference link labels are now case-folded during parsing.
Tabs are now allowed in the thematic break that ends a list item.
A tab is now allowed before the closing sequence of an ATX heading.
Character references in autolink destinations are now escaped.
Empty code blocks no longer receive an added newline.
Each content line removes up to the fence indentation.
HTML tags containing invalid characters in their names are now rejected.
Link labels now allow one additional level of nested brackets.
inlineTokens rebuilds the reflink-mask preamble for each call.
Links are no longer nested inside other links during parsing.
Rejected reference links retain emphasis in their text.
The em/strong mask now stays the same length as the source, correcting parsing behavior.
Backtick fences at EOF after paragraphs are now parsed correctly.
Task checkboxes are placed after list looseness is finalized, correcting list parsing.
Blockquote continuation no longer produces spurious deeper nesting during Markdown parsing.
Pedantic emphasis parsing is corrected for foo: and "word" patterns.
An unmatched strong run before emphasis now stays literal during Markdown parsing.
Extensions returning false now fall back to the default checkbox renderer.
Treats a line containing only tabs as a blank line between paragraphs.
Preserves code spans when they appear adjacent to tildes.
Keeps an empty list after a blockquote as a sibling block.
Recognizes setext headings whose first line starts with #.
Preserves trailing text on HTML block close lines for processing instructions, declarations, and CDATA.
Fixes parsing of ordered lists that follow blockquotes.
Parsing now handles empty list items that have a trailing space.
The CLI now correctly reads input from stdin.
Setext heading text no longer incorrectly receives a task checkbox.
Ensures the lookbehind regex is evaluated correctly by minifiers.
GFM table tokens no longer greedily capture trailing newlines.
Heading and definition tokens no longer greedily capture multiple newlines.
marked 1723 changes
Breaking changes 2
Consecutive text tokens in lists behave differently, which may affect code consuming or producing list tokens.
The listItem renderer is simplified, potentially requiring updates to custom renderer implementations.
Security 3
Catastrophic backtracking (ReDoS) in the link/reflink label regex was fixed.
Prevents ReDoS in the inline link regular expression title group.
Image alt text is now escaped, preventing unescaped content in rendered output.
New APIs and options 3
The list tokenizer now adds a checkbox token, exposing checkbox information to token consumers.
Checkbox tokens now have a raw property.
Checkbox tokens now have a type property.
Performance 1
Quadratic complexity in the emStrongLDelim regex was prevented.
Behavior and default changes 1
Loose list text tokens now use paragraph type in the list tokenizer.
Fixes and other changes 13
The CLI now uses a file URL when importing configuration.
Avoided a race condition when using async parallel parse or parseInline with hooks.
The CLI now honors a positional input file.
Trailing whitespace is trimmed from lheading text.
renderer.parser is reassigned at the start of each parse call to ensure fresh parser state.
Single-tilde strikethrough false positives were prevented.
tokenizer.lexer is reassigned at the start of each parse call to ensure fresh parser state.
Fixed blockquote parsing after a list.
Fixed parsing of empty list items.
Fixed list parsing when tabs are used.
Fixed incorrect indentation handling for list items.
Fixed strikethrough flanking-rule handling.
Block elements in task items are handled correctly when parsing Markdown.
marked 162 changes
Fixes and other changes 2
Avoids RegExp lookbehind assertions, improving compatibility with runtimes that do not support them.
Resolved an even-numbered backtick precedence issue in parsing.