fix(x-markdown): update marked to v18 to fix strikethrough parsing - #2023
fix(x-markdown): update marked to v18 to fix strikethrough parsing#2023waterWang wants to merge 1 commit into
Conversation
The tilde-syntax strikethrough (~123~) was rendering as plain text because marked v15 had a known parsing bug. Update from ^15.0.12 to ^18.0.7 where the fix was released. Closes ant-design#2000
dosubot
Bot
added
bug
📝 WalkthroughWalkthrough本次变更将 ChangesXMarkdown 依赖更新
Estimated code review effort: 1（低）| ~5 分钟 Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/x-markdown/package.json`:
- Line 60: 不要仅升级 marked；在项目现有的 Markdown 解析入口增加自定义 tokenizer 或预处理逻辑，使输入 ~123 foo
bar (~123)~ 输出为 <del>123 foo bar (~123)</del>。补充覆盖该输入与期望 HTML
的回归测试，并保留其他删除线语法的现有解析行为。
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 64e3f089-5168-4648-8154-2c39b35d8606
📒 Files selected for processing (1)
packages/x-markdown/package.json
| "html-react-parser": "^5.2.13", | ||
| "katex": "^0.16.22", | ||
| "marked": "^15.0.12" | ||
| "marked": "^18.0.7" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
repo_root="$(git rev-parse --show-toplevel)"
test_file="$repo_root/packages/x-markdown/src/XMarkdown/__tests__/Parser.test.ts"
rg -n '123 foo bar \(~123\)|<del>123 foo bar' "$test_file"
cd "$repo_root"
if [ -f pnpm-lock.yaml ]; then
pnpm --dir packages/x-markdown test
elif [ -f yarn.lock ]; then
yarn --cwd packages/x-markdown test
else
npm --prefix packages/x-markdown test
fiRepository: ant-design/x
Length of output: 150
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- package manifest ---'
sed -n '1,120p' packages/x-markdown/package.json
printf '%s\n' '--- parser test structure and target references ---'
ast-grep outline packages/x-markdown/src/XMarkdown/__tests__/Parser.test.ts
rg -n -C 3 'strikethrough|tilde|del|newline|custom|tag|123 foo bar' \
packages/x-markdown/src/XMarkdown/__tests__/Parser.test.ts || true
printf '%s\n' '--- dependency declarations and lock entries ---'
rg -n -C 2 '"marked"|marked@|marked:' \
packages/x-markdown/package.json package.json pnpm-lock.yaml yarn.lock package-lock.json 2>/dev/null || true
printf '%s\n' '--- repository status and available package scripts ---'
git status --short
node -e 'const p=require("./packages/x-markdown/package.json"); console.log(JSON.stringify(p.scripts,null,2))'Repository: ant-design/x
Length of output: 8896
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- tracked lockfiles ---'
git ls-files | rg '(^|/)(pnpm-lock\.yaml|yarn\.lock|package-lock\.json|bun\.lockb?)$' || true
printf '%s\n' '--- parser implementation and marked usage ---'
rg -n -C 5 'from .*(marked|Parser)|marked\(|parse\(|markedConfig|protectCustomTagNewlines|paragraphTag' \
packages/x-markdown/src/XMarkdown packages/x-markdown/src 2>/dev/null | head -n 260
printf '%s\n' '--- complete parser test file ---'
cat -n packages/x-markdown/src/XMarkdown/__tests__/Parser.test.ts
printf '%s\n' '--- package workspace context ---'
sed -n '1,180p' package.jsonRepository: ant-design/x
Length of output: 38548
🌐 Web query:
marked 18.0.0 release breaking change trailing blank lines 18.0.7 tilde interrupt regex fix
💡 Result:
In the marked library, version 18.0.0 introduced a breaking change that trims trailing blank lines from block tokens [1][2][3]. Additionally, version 18.0.7 included a fix to avoid O(n^2) backtracking in the HTML block close and tilde interrupt regexes [4][5], addressing potential ReDoS (Regular Expression Denial of Service) vulnerabilities [6][5].
Citations:
- 1: https://github.com/markedjs/marked/releases
- 2: https://github.com/chjj/marked/releases/tag/v18.0.0
- 3: https://newreleases.io/project/npm/marked/release/18.0.0
- 4: https://github.com/markedjs/marked/releases/tag/v18.0.7
- 5: markedjs/marked@v18.0.0...v18.0.7
- 6: markedjs/marked@v18.0.5...v18.0.7
🌐 Web query:
marked 18.0.7 parse "~123 foo bar (~123)~" output
💡 Result:
In marked version 18.0.7, the syntax ~123 is treated as standard text unless specifically configured otherwise, as marked does not implement strikethrough (typically denoted by ~~text~~) or other tilde-based formatting by default without extensions or specific configurations [1][2]. Regarding your specific input ~123 foo bar (~123)~, marked 18.0.7 will parse this as plain text wrapped in paragraph tags, resulting in output similar to <p>~123 foo bar (~123)~</p>. It is worth noting that version 18.0.7 included specific bug fixes related to tilde characters, specifically: - Avoidance of O(n^2) backtracking in tilde interrupt regexes [3][4]. - Preservation of code spans adjacent to tildes [3][4]. These updates ensure that the parser handles tildes more efficiently and correctly in contexts where they might interact with other markdown elements, but they do not change the default behavior of treating single tildes as literal characters [3][4].
Citations:
- 1: https://marked.js.org/
- 2: https://github.com/markedjs/marked?tab=readme-ov-file
- 3: https://github.com/markedjs/marked/releases
- 4: https://newreleases.io/project/yarn/marked/release/18.0.7
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- local dependency availability ---'
node -e 'try { console.log(require.resolve("marked")); } catch (e) { console.log("marked is not installed"); }'
printf '%s\n' '--- marked package metadata from the registry ---'
curl -fsSL https://registry.npmjs.org/marked/18.0.7 |
node -e '
let s = "";
process.stdin.on("data", d => s += d);
process.stdin.on("end", () => {
const p = JSON.parse(s);
console.log(JSON.stringify({
version: p.version,
engines: p.engines,
exports: p.exports,
dist: p.dist && { tarball: p.dist.tarball, integrity: p.dist.integrity }
}, null, 2));
});
'
printf '%s\n' '--- marked 18.0.7 strikethrough rule source ---'
curl -fsSL https://unpkg.com/marked@18.0.7/lib/marked.esm.js |
rg -n -C 3 'tilde|del|~~|gfm' | head -n 120Repository: ant-design/x
Length of output: 37196
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
node - <<'JS'
const versions = ['15.0.12', '18.0.7'];
for (const version of versions) {
const source = await (await fetch(`https://unpkg.com/marked@${version}/lib/marked.esm.js`)).text();
const module = await import(`data:text/javascript,${encodeURIComponent(source)}`);
const marked = module.marked ?? module.default;
const input = '~123 foo bar (~123)~';
const result = marked(input);
console.log(JSON.stringify({ version, input, result }));
if (version === '18.0.7' && !result.includes('<del>123 foo bar (~123)</del>')) {
process.exitCode = 1;
}
}
JSRepository: ant-design/x
Length of output: 518
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- tilde and strikethrough handling in the package ---'
rg -n -C 4 'strikethrough|strike|tilde|~~|~123|markedConfig|Tokenizer|del\(' \
packages/x-markdown packages 2>/dev/null | head -n 260
printf '%s\n' '--- Parser constructor and configuration ---'
sed -n '1,130p' packages/x-markdown/src/XMarkdown/core/Parser.ts
printf '%s\n' '--- Parser preprocessing and parse path ---'
sed -n '250,375p' packages/x-markdown/src/XMarkdown/core/Parser.tsRepository: ant-design/x
Length of output: 29747
不要仅升级 marked，请修复目标输入的解析行为。
marked@18.0.7 对 ~123 foo bar (~123)~ 的输出为 <p>~123 foo bar (<del>123)</del></p>\n。如果必须输出 <del>123 foo bar (~123)</del>，请增加自定义 tokenizer 或预处理逻辑，并添加回归测试。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/x-markdown/package.json` at line 60, 不要仅升级 marked；在项目现有的 Markdown
解析入口增加自定义 tokenizer 或预处理逻辑，使输入 ~123 foo bar (~123)~ 输出为 <del>123 foo bar
(~123)</del>。补充覆盖该输入与期望 HTML 的回归测试，并保留其他删除线语法的现有解析行为。
nrps9909
left a comment
nrps9909
left a comment
There was a problem hiding this comment.
Exact head 46a386328c2dbda4f5b92b98e34ca54afa93d4 is not the current PR head, so this review command should not have reached submission.
nrps9909
left a comment
nrps9909
left a comment
There was a problem hiding this comment.
Correction to my immediately preceding review: the reviewed and current exact head is 46a386328c2dbda4f5b92cf3e7a551c2bb33fd54; the shorter SHA in that review body was a transcription error. The CHANGES_REQUESTED state is intentional for the following verified reasons:
- This PR changes only
packages/x-markdown/package.json; the rootpackage-lock.jsonstill records the workspace dependency asmarked: ^15.0.12and lockspackages/x-markdown/node_modules/markedto15.0.12. Please regenerate and commit the lockfile so clean installs reproduce the change. marked@18.0.7declares Node>=20, while.github/workflows/markdown-benchmark.ymlstill runs Node 18. Published package metadata confirms 15.0.12 requires Node >=18, but 16.4.2, 17.0.1, and 18.0.7 all require Node >=20. This bump therefore silently drops Node 18 consumers unless the project makes and documents that support change.- Please add a regression for the issue’s exact input
~123 foo bar (~123). I reproduced Marked 15 emitting a partial<del>for that string and Marked 18 leaving it entirely as text. The PR body currently shows an extra trailing~, which is a different parse case.
Please either retain Node 18 compatibility with a targeted parsing fix, or make Node >=20 an explicit project-level decision and update CI/support metadata consistently, along with the lockfile and exact regression.
3 participants
Background
The tilde-syntax strikethrough (
~123 foo bar (~123)~) was rendering as plain text in XMarkdown because themarkeddependency had a known parsing bug fixed in later versions.Fix
Update
markedfrom^15.0.12to^18.0.7. The issue reporter confirmed this works via package overrides.Related
Closes #2000
Summary by CodeRabbit