(I really need to put more care into reading posts.)
~14h ago an update to observable’s stdlib was published that made some changes to how marked is integrated:
Edit: One difference appears to be that the old implementation would always return a promise.
Edit 2: Looks like marked got updated from 0.3.12 to 0.6.1 in the process.
Edit 3: I believe the old behavior was due to faulty parsing, and the current behavior is the correct one. So I’m guessing that existing notebooks will have to be fixed manually.
Those security fixes aren’t relevant to our usage. We don’t rely on Marked to do any sanitization and there’s no threat of DoS because Marked is running on the client.
If and when we upgrade Marked in the future (or replace it with a different Markdown implementation), our plan is to implement versioning pinning for the Observable standard library so that this change only becomes available to new notebooks and old notebooks that explicitly opt-in to the upgrade.