marked.js 18.0.11: md2rich Upgrade Notes for 2026

On August 24, 2026 the marked.js maintainers tagged v18.0.11. It was the third patch release in a month: v18.0.9 on August 4, v18.0.10 on August 18, v18.0.11 on August 24. All three were pure bug-fix releases. None added features. None broke the public renderer API. md2rich, the tool behind this site, currently pins [email protected] from jsDelivr, so the question I get asked most in feedback is: should we upgrade?

This post is the answer. It covers what v17 and v18 actually changed, what the three August patches fixed, the bundle-size delta, and how the upgrade decision lands for a client-side Markdown-to-rich-text converter whose entire job is to round-trip writer text into LinkedIn, X Articles, Medium, and Notion.

What marked.js v17 and v18 changed

The v17.0.0 release went out on November 7, 2025. The headline items in the changelog were all about list rendering: consecutive text tokens inside lists were simplified, the listItem renderer was streamlined, and the checkbox token gained a type and raw property. None of those changes touch the default renderer that md2rich uses. They only matter if you override renderer.listitem, renderer.checkbox, or build custom tokenizers.

The v18.0.0 release went out on April 7, 2026. The breaking changes were small: trailing blank lines are now trimmed from block tokens (so a paragraph followed by three blank lines no longer carries the whitespace forward into the next token), and the TypeScript dependency moved from 5.9 to 6.0. Neither of these shows up in HTML output for a writer who pastes their Markdown into a converter. The trimming is the only visible change, and it makes block-by-block sanitization slightly cleaner.

Between v18.0.0 and v18.0.11, the maintainers shipped twelve patch releases. The first five (18.0.1 through 18.0.5) were minor dependency and CLI cleanups. The last three were the substantive bug fixes.

The August 2026 patch series, decoded

Each patch release shipped with three entries in the changelog. All were tagged Bug Fixes. Reading them in order gives a clear picture of what kinds of Markdown the v18 line is finally getting right.

v18.0.9 (2026-08-04)

• Unmatched strong run before emphasis stays literal. The parser used to interpret **foo *bar* as the start of a strong-emphasis run that never closed, producing broken HTML. v18.0.9 leaves the asterisks literal so the writer sees the source as-is.
• Spurious deeper nesting in blockquote continuations. A blockquote that contained a multi-paragraph list used to nest deeper than the source indicated. v18.0.9 keeps the continuation at the same level as the opening line.
• Pedantic **foo: and **"word" emphasis parsing. v18.0.9 follows the CommonMark spec rule that trailing colons and quoted words are not emphasis delimiters, which 11.1.1 got wrong.

v18.0.10 (2026-08-18)

• em/strong mask length drift. The internal mask the tokenizer builds for emphasis delimiters used to drift in length versus the source after a reflink replacement. v18.0.10 keeps the mask the same length as the source, which closes a long-standing class of misaligned emphasis bugs.
• EOF backtick fences after paragraphs. A paragraph followed by a closing backtick fence used to swallow the fence as part of the paragraph text. v18.0.10 recognizes the fence and ends the paragraph cleanly.
• Task checkbox placement after loose lists. v18.0.10 places task-list checkboxes at the correct position after a loose list, which 18.0.7 and 18.0.8 were getting wrong in edge cases. This is a v18-internal regression that 18.0.10 closes.

v18.0.11 (2026-08-24)

• Nested link inside a link. The tokenizer used to allow a link inside the text of another link. v18.0.11 rejects the inner link and keeps the outer one, which matches CommonMark.
• Reflink mask preamble rebuild. Each call to inlineTokens now rebuilds the reference-link mask preamble independently instead of reusing a stale one, which closes a class of "the first parse is correct, subsequent parses are wrong" bugs.
• Emphasis preserved in the text of a rejected reference link. If a reference link is rejected (because the label does not match a defined reference), the emphasis inside it is preserved instead of being eaten by the tokenizer.

None of these are headline features. They are all edge cases. But for a writer who has ever pasted Markdown into a converter and seen their second paragraph lose its bold, their task list checkboxes appear in the wrong place, or their blockquote suddenly gain a level of indentation, the August patch series is the fix.

The bundle-size math

The UMD minified bundle for marked 18.0.11 is 44,598 bytes on jsDelivr. The non-minified ESM build is 43,800 bytes. The marked 11.1.1 build md2rich currently loads is 35,141 bytes minified. The delta is about 9 KB minified, roughly a 25 percent size increase.

For a privacy-first client-side renderer that loads the parser from a CDN on first use, the cost is real but small. On a fast connection the user will not notice. On a slow 3G connection the 9 KB adds about 200 ms. The gain is correctness on edge cases that previously surfaced as visible HTML breakage. For most writer-driven workflows (a 600-word LinkedIn post, a 1,200-word X Article) the parser will never hit the edge cases v18 fixes. For technical writers who paste GitHub-rendered Markdown with task lists, reflinks, and blockquote lists, the edge cases are routine.

The other number to weigh is total downloads. marked.js pulled 274.7 million downloads in the last 30 days and 73.3 million in the last week alone. It is the most-deployed client-side Markdown parser by a wide margin. Upgrading to 18.0.11 aligns md2rich with the version that ships in the most production environments.

Why md2rich has not switched yet

The honest answer is that the upgrade is on the to-do list, not blocked. The marked.parse() signature did not change between 11.1.1 and 18.0.11. The marked.setOptions() shape did not change. The output is HTML in both versions, and the HTML is then run through DOMPurify 3.0.8 for sanitization before being inserted into the editor preview. The integration points are stable.

What is on the to-do list is a regression pass against the 80+ canonical test documents md2rich has accumulated, to verify that the 18.x line produces the same output for the common case and the expected different output for the edge cases the August patches targeted. The risk is small but non-zero: a writer's existing Markdown might render slightly differently between 11.1.1 and 18.0.11, and the first deployment should ship with a way to compare the two outputs side by side.

A worked example: how the v18 fixes change real output

Take this Markdown snippet, which mixes a reference link with emphasis inside the link text:

I read [the *emphasis inside* article][1] yesterday.

[1]: https://example.com/post

In marked 11.1.1 the reference link is rendered, but the emphasis inside the link text is stripped to plain text. The HTML output looks like:

<p>I read <a href="https://example.com/post">the emphasis inside article</a> yesterday.</p>

In marked 18.0.11 the emphasis is preserved:

<p>I read <a href="https://example.com/post">the <em>emphasis inside</em> article</a> yesterday.</p>

For a writer who pastes a blog post that has a reference link with an italicized phrase in the link text, the 18.0.11 behavior is what they expect. The 11.1.1 behavior is what they get on md2rich today.

Alternatives worth knowing about

marked.js is not the only client-side Markdown parser. markdown-it is the closest match and ships with a plugin ecosystem that covers most of what GFM provides (task lists, footnotes, attribute lists). The trade-off is bundle size: markdown-it is roughly 110 KB minified, three times the marked 18.0.11 build. For md2rich the size delta is not worth the plugin surface area.

micromark is a smaller, CommonJS-first parser that the remark and rehype ecosystem builds on top of. It is the right choice if you need a parse tree you can transform. For a renderer whose job is HTML output, the parse tree is overkill.

Quikdown is a 17 KB bidirectional Show HN parser from 2026 with strong performance characteristics. It is worth watching but is not yet at the version stability that a production renderer wants to bet on. md2rich has not migrated.

The upgrade checklist

If you maintain a client-side Markdown renderer and want to move from marked 11.x or 12.x to 18.0.11, the checklist is short:

1. Update the import line from [email protected] to [email protected] in your CDN reference.
2. Run your existing render test corpus. Expect the common-case output to be identical.
3. Spot-check reference links with emphasis inside, task lists after loose lists, and blockquote continuations with lists. These are where the August patches change behavior.
4. Confirm that any custom renderer overrides (especially listitem and checkbox) handle the v17 token shape changes.
5. Re-run your sanitizer pass on the new HTML output. DOMPurify 3.0.8 is unaffected by the parser upgrade.

FAQ

Should md2rich upgrade from marked 11.1.1 to marked 18.x?

It depends on what you publish. If your Markdown uses GFM tables, setext headings, task lists, or reference links with emphasis inside them, the 18.x line fixes real edge cases that 11.1.1 mishandles. The bundle is ~9 KB larger minified (35 KB to 44 KB) and the renderer API for the marked.parse() call did not change. The v17.0.0 breaking changes (consecutive text tokens in lists, checkbox token shape) only affect custom renderer overrides; md2rich uses the default renderer and was not affected.

What changed in marked.js v17 and v18?

v17.0.0 (2025-11-07) changed how consecutive text tokens work inside lists, simplified the listItem renderer, and reshaped the checkbox token to add a type and raw property. v18.0.0 (2026-04-07) trimmed trailing blank lines from block tokens and bumped TypeScript from 5.9 to 6.0. Both were bug-fix releases; only the checkbox token shape is a behavior change that custom renderer overrides need to handle.

What do the August 2026 patch releases fix?

v18.0.9 (2026-08-04) fixed unmatched strong runs before emphasis, deeper-than-needed nesting in blockquote continuations, and pedantic foo: and "word" emphasis parsing. v18.0.10 (2026-08-18) fixed em/strong mask length drift, EOF backtick fences after paragraphs, and task checkbox placement after loose lists. v18.0.11 (2026-08-24) fixed nested links inside links, reflink mask preamble rebuilds, and emphasis preservation inside rejected reference links.

Does marked v18 require Node 20?

The package.json engines field says node >= 20, but the UMD and ESM browser bundles still work in any modern browser without Node at all. md2rich loads marked via the jsDelivr CDN ESM import, which is browser-only and unaffected by the Node engine hint. If you use marked via the CLI on a build server you do need Node 20 or later.

How big is the marked.js v18 browser bundle?

The UMD minified bundle (marked.umd.min.js) is 44,598 bytes (44 KB) on jsDelivr. The non-minified ESM build (marked.esm.js) is 43,800 bytes. The pre-1.0 [email protected] marked.min.js used by md2rich today is 35,141 bytes. The delta is about 9 KB gzipped, which on top of a 35 KB file is roughly a 25 percent size increase.

Are there alternatives to marked.js for client-side Markdown rendering?

Yes. markdown-it is the closest match and ships with a plugin ecosystem (markdown-it-task-lists, markdown-it-footnote, markdown-it-attrs), but it is heavier. micromark is a small CommonJS-first parser that the remark and rehype ecosystem builds on top of. Quikdown is a 17 KB bidirectional Show HN parser from 2026. For most writers pasting into LinkedIn or X Articles, the rendered output difference is small; the choice is bundle size, plugin extensibility, and how aggressively the project tracks CommonMark and GFM updates.

Conclusion: tracked, queued, not shipped yet

The August 2026 patch series is the most useful marked.js has shipped since v18.0.0 in April. The fixes are small in isolation but they close a long tail of edge cases that have bugged writers who paste technical Markdown into converters. md2rich is on the upgrade path; the work is a regression pass against the 80+ canonical test documents and a side-by-side diff of the rendered output between 11.1.1 and 18.0.11.

In the meantime, try md2rich. Paste Markdown, copy rich text. The current build runs marked 11.1.1 with DOMPurify 3.0.8 sanitization. The next build will run marked 18.0.11. The output for the common case will not change; the output for the edge cases will be slightly better.

Filed under: md2rich Blog. Written by the md2rich team (about.me/jasonxmai). Last verified 2026-08-31 against [email protected] release artifacts on jsDelivr and the npm registry.