Marked is a fast markdown parser and compiler that turns Markdown into HTML, designed to be lightweight and implement many markdown features. It can be used in browsers, on servers, or via a command line interface (CLI), and it supports customization through options and extensibility. It also provides documentation and a demo site rendered using Marked.
Project status
- Actively maintained: The repo shows frequent, recent updates (last upstream push 2026-06-08, with tags continuing through 2026-06-04), and recent changes include both bug fixes and ongoing dev/tooling updates.
- Apparent cadence: From v17.0.6 (2026-04-05) to v18.0.5 (2026-06-04) there are multiple patch updates, roughly every 1 to 3 weeks during this period.
AI summary generated
Recent updates
v18.0.6
v18.0.6 is a small patch release focused on three parsing-related bug fixes. The main library changes address link href regex performance, ordered list parsing after blockquotes, and preserving trailing text on closing lines for certain HTML blocks.
v18.0.5
v18.0.5 is a small release focused on a markdown parsing bug fix related to empty list items that include trailing spaces. The code changes are concentrated in the core parsing regex rules and add a regression test and documentation snippet, along with minor dev dependency updates.
v18.0.4
v18.0.4 contains two documented fixes: improving caching for list indentation related regexes, and fixing the CLI behavior when stdin is used. The code diff also shows additional CLI argument handling changes and several dependency bumps for the project itself.
v18.0.3
v18.0.3 contains a targeted bug fix for task list checkbox parsing when the checkbox-like syntax is followed by setext heading markers. The code change refines how the tokenizer decides whether a list item should remain a task, and adds regression tests for tight, unchecked, and loose setext heading scenarios.
v18.0.2
Release v18.0.2 is described as a single bug fix for an infinite loop involving indented code blank lines. The code changes in this release not only refactor the lexer infinite loop handling, they also adjust blank-line trimming behavior in helpers, plus update test coverage for a vertical-tab input case.
v18.0.1
v18.0.1 contains a targeted fix for how lookbehind support detection regexes are handled when bundlers or minifiers optimize the code. The code changes are localized to rule support detection plus minor dependency bumps for dev tooling.
v18.0.0
marked v18.0.0 updates tokenization to trim trailing blank lines from block-level tokens and adjusts how whitespace is captured around block elements like code, headings, HTML blocks, definitions, and tables. The release notes explicitly call out trailing blank line trimming and a TypeScript toolchain bump, but the code diff also shows additional dependency bumps and more nuanced tokenizer behavior changes.
Breakingv17.0.6
v17.0.6 primarily fixes hook-related concurrency issues when using async parsing concurrently via parse and parseInline. It also updates the CLI to better handle positional input files and to import config files using proper file URLs. The code diff additionally includes a few small internal logic tweaks and dev dependency bumps.
v17.0.5
v17.0.5 focuses on regex correctness and safety improvements, primarily addressing ReDoS and pathological performance cases in inline parsing. It also adjusts internal wiring between Lexer, Tokenizer, Parser, and Renderer so repeated parses (and multiple instances) behave consistently.
Securityv17.0.4
v17.0.4 is released as a bug fix focused on preventing a ReDoS issue in the inline link regex title group. The code changes also introduce internal changes to HTML escaping utilities and adjust the link parsing regex around whitespace/newlines.
v17.0.3
v17.0.3 contains a targeted security-oriented bug fix for image alt text escaping during HTML rendering. It also updates some development and tooling dependencies and adds regression tests covering malicious alt text content.
Security