Alternatives to the "marked" markdown renderer...

[Tony Atkins]

Hi, All:

[I posted this earlier, crossposting as suggested by Justin to include a
wider audience.]

As you may remember from previous discussions regarding Snyk
<http://snyk.io/>, the largest source of vulnerabilities in the work I
maintain is the "marked <https://github.com/chjj/marked>" library, which is
also used in the Docpad Infusion docs site.   After waiting months for a
"marked" release that includes the fix for a previous vulnerability, I
discovered this week that even more vulnerabilities have been reported
since I last looked.

It seemed like a good time to look around for replacements, I did so and
wrote up a technology evaluation on the wiki:

http://wiki.gpii.net/w/Technology_Evaluation_-_Rendering_Markdown

Please take a moment to review, especially those of you who regularly
contribute to the Infusion Docpad docs.  I would like to confirm that the
list of candidates and requirements is reasonable, and to get feedback on
my conclusion, which is that "markdown-it" and the associated Docpad plugin
are our best candidates to replace "marked" at the moment.

Although I will also mention this in the architecture meeting tomorrow and
ask for feedback there, feedback in the next day or so would be much
appreciated.  Unless there are strong objections coming out of tomorrow's
meeting, I plan to work on replacing "marked" in gpii-handlebars by the end
of the week.

Cheers,


Tony
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.idrc.ocad.ca/pipermail/fluid-work/attachments/20170919/a7e3406e/attachment.htm>