diff --git a/.gitattributes b/.gitattributes
index 8f2d8c3587..3d7e847130 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,2 +1,3 @@
+* eol=lf
test/* linguist-vendored
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 8d009543f2..14f6a4b8a2 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -14,8 +14,15 @@ on:
schedule:
- cron: '0 9 * * 3'
+permissions:
+ contents: read
+
jobs:
analyze:
+ permissions:
+ actions: read # for github/codeql-action/init to get workflow details
+ contents: read # for actions/checkout to fetch code
+ security-events: write # for github/codeql-action/autobuild to send a status report
name: Analyze
runs-on: ubuntu-latest
@@ -30,7 +37,7 @@ jobs:
steps:
- name: Checkout repository
- uses: actions/checkout@v2
+ uses: actions/checkout@v3
with:
# We must fetch at least the immediate parents so that if this is
# a pull request then we can checkout the head.
@@ -43,7 +50,7 @@ jobs:
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
- uses: github/codeql-action/init@v1
+ uses: github/codeql-action/init@v2
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,7 +61,7 @@ jobs:
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
- uses: github/codeql-action/autobuild@v1
+ uses: github/codeql-action/autobuild@v2
# ℹ️ Command-line programs to run using the OS shell.
# 📚 https://git.io/JvXDl
@@ -68,4 +75,4 @@ jobs:
# make release
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v1
+ uses: github/codeql-action/analyze@v2
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 48c71ebbaf..da0309349a 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -5,16 +5,20 @@ on:
branches:
- master
+permissions:
+ contents: read
+
jobs:
Test:
if: "!contains(github.event.head_commit.message, '[skip ci]')"
strategy:
matrix:
- node_version: ['lts/*', 'node']
+ # lowest verison here should also be in `engines` field
+ node_version: [12, 'lts/*', 'node']
runs-on: ubuntu-latest
steps:
- name: Checkout Code
- uses: actions/checkout@v2
+ uses: actions/checkout@v3
- name: Install Node
uses: dcodeIO/setup-node-nvm@master
with:
@@ -31,13 +35,15 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout Code
- uses: actions/checkout@v2
+ uses: actions/checkout@v3
- name: Install Dependencies
run: npm ci
- name: Lint ✨
run: npm run test:lint
Release:
+ permissions:
+ contents: write
needs: [Test, Lint]
if: |
github.ref == 'refs/heads/master' &&
@@ -45,7 +51,11 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout Code
- uses: actions/checkout@v2
+ uses: actions/checkout@v3
+ - name: Install Node
+ uses: dcodeIO/setup-node-nvm@master
+ with:
+ node-version: 'lts/*'
- name: Install Dependencies
run: npm ci
- name: Build 🗜️
@@ -63,6 +73,8 @@ jobs:
run: npx semantic-release
Skip:
+ permissions:
+ contents: none
if: contains(github.event.head_commit.message, '[skip ci]')
runs-on: ubuntu-latest
steps:
diff --git a/.releaserc.json b/.releaserc.json
new file mode 100644
index 0000000000..83b6c07f89
--- /dev/null
+++ b/.releaserc.json
@@ -0,0 +1,9 @@
+{
+ "plugins": [
+ "@semantic-release/commit-analyzer",
+ "@semantic-release/release-notes-generator",
+ "@semantic-release/npm",
+ "@semantic-release/github",
+ "@semantic-release/git"
+ ]
+}
diff --git a/Makefile b/Makefile
index 7deead54c1..2bd63016a2 100644
--- a/Makefile
+++ b/Makefile
@@ -1,9 +1,9 @@
all:
- @cp lib/marked.js marked.js
- @uglifyjs --comments '/\*[^\0]+?Copyright[^\0]+?\*/' -o marked.min.js lib/marked.js
+ @cp lib/marked.cjs marked.cjs
+ @uglifyjs --comments '/\*[^\0]+?Copyright[^\0]+?\*/' -o marked.min.js lib/marked.cjs
clean:
- @rm marked.js
+ @rm marked.cjs
@rm marked.min.js
bench:
diff --git a/README.md b/README.md
index 9f48278366..59017f687b 100644
--- a/README.md
+++ b/README.md
@@ -29,19 +29,39 @@ Also read about:
* [Options](https://marked.js.org/#/USING_ADVANCED.md)
* [Extensibility](https://marked.js.org/#/USING_PRO.md)
+## Compatibility
+
+**Node.js:** Only [current and LTS](https://nodejs.org/en/about/releases/) Node.js versions are supported. End of life Node.js versions may become incompatible with Marked at any point in time.
+
+**Browser:** Not IE11 :)
+
## Installation
-**CLI:** `npm install -g marked`
+**CLI:**
+
+```sh
+npm install -g marked
+```
+
+**In-browser:**
-**In-browser:** `npm install marked`
+```sh
+npm install marked
+npm install @types/marked # For TypeScript projects
+```
## Usage
-### Warning: 🚨 Marked does not [sanitize](https://marked.js.org/#/USING_ADVANCED.md#options) the output HTML. Please use a sanitize library, like [DOMPurify](https://github.com/cure53/DOMPurify) (recommended), [sanitize-html](https://github.com/apostrophecms/sanitize-html) or [insane](https://github.com/bevacqua/insane) on the output HTML! 🚨
+### Warning: 🚨 Marked does not [sanitize](https://marked.js.org/#/USING_ADVANCED.md#options) the output HTML. Please use a sanitize library, like [DOMPurify](https://github.com/cure53/DOMPurify) (recommended), [sanitize-html](https://github.com/apostrophecms/sanitize-html) or [insane](https://github.com/bevacqua/insane) on the *output* HTML! 🚨
+
+```
+DOMPurify.sanitize(marked.parse(``));
+```
**CLI**
``` bash
+# Example with stdin input
$ marked -o hello.html
hello world
^D
@@ -49,6 +69,11 @@ $ cat hello.html
hello world
``` +```bash +# Print all options +$ marked --help +``` + **Browser** ```html @@ -63,7 +88,7 @@ $ cat hello.html