From b3240483aa0b2f4d22c06fc8a98f58f960f421fe Mon Sep 17 00:00:00 2001
From: Googler <no-reply@google.com>
Date: Sun, 25 Jan 2026 07:32:26 -0800
Subject: [PATCH] Upgrade to the latest version of the "marked" TS/JS library.

PiperOrigin-RevId: 860826220
---
 lit_nlp/client/lib/utils.ts | 16 +++++++++-------
 lit_nlp/package.json        |  3 +--
 lit_nlp/yarn.lock           | 13 ++++---------
 3 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/lit_nlp/client/lib/utils.ts b/lit_nlp/client/lib/utils.ts
index 6a925074..bf1704fb 100644
--- a/lit_nlp/client/lib/utils.ts
+++ b/lit_nlp/client/lib/utils.ts
@@ -25,7 +25,7 @@
 import * as d3 from 'd3';  // Used for array helpers.
 import {unsafeHTML} from 'lit/directives/unsafe-html.js';
 
-import {marked} from 'marked';
+import {Marked, Renderer, Tokens} from 'marked';
 import {LIT_TYPES_REGISTRY, LitName, LitType, LitTypeTypesList, LitTypeWithParent, MulticlassPreds} from './lit_types';
 import {CallConfig, FacetMap, IndexedInput, ModelInfoMap, Spec} from './types';
 
@@ -527,13 +527,15 @@ export function getTemplateStringFromMarkdown(markdown: string) {
   // Render Markdown with link target _blank
   // See https://github.com/markedjs/marked/issues/144
   // and https://github.com/markedjs/marked/issues/655
-  const renderer = new marked.Renderer();
-  renderer.link = (href, title, text) => {
-    const linkHtml =
-        marked.Renderer.prototype.link.call(renderer, href, title, text);
-    return linkHtml.replace('<a', '<a target=\'_blank\' ');
+  const renderer = new Renderer();
+  renderer.link = function(this: Renderer, token: Tokens.Link): string {
+    const output = Renderer.prototype.link.call(this, token);
+    return output.replace(
+        /^<a /,
+        '<a target="_blank" rel="noopener noreferrer" ',
+    );
   };
-  const htmlStr = marked(markdown, {renderer});
+  const htmlStr = new Marked().use({renderer}).parse(markdown, {async: false});
 
   return unsafeHTML(htmlStr);
 }
diff --git a/lit_nlp/package.json b/lit_nlp/package.json
index 42a26bdd..27c08ae4 100644
--- a/lit_nlp/package.json
+++ b/lit_nlp/package.json
@@ -27,7 +27,7 @@
     "d3": "5.16.0",
     "difflib": "0.2.4",
     "lit": "2.7.6",
-    "marked": "5.1.2",
+    "marked": "17.0.1",
     "megaplot": "github:PAIR-code/megaplot#ca8210d",
     "mobx": "6.1.8",
     "node-polyfill-webpack-plugin": "^2.0.1",
@@ -40,7 +40,6 @@
     "@types/difflib": "0.2.0",
     "@types/eslint": "8.44.1",
     "@types/jasmine": "3.5.10",
-    "@types/marked": "5.0.1",
     "@types/node": "20.4.5",
     "@types/resize-observer-browser": "0.1.7",
     "@types/seedrandom": "3.0.5",
diff --git a/lit_nlp/yarn.lock b/lit_nlp/yarn.lock
index 5c259033..6dcc36fe 100644
--- a/lit_nlp/yarn.lock
+++ b/lit_nlp/yarn.lock
@@ -938,11 +938,6 @@
   resolved "https://registry.yarnpkg.com/@types/json-schema/-/json-schema-7.0.12.tgz#d70faba7039d5fca54c83c7dbab41051d2b6f6cb"
   integrity sha512-Hr5Jfhc9eYOQNPYO5WLDq/n4jqijdHNlDXjuAQkkt+mWdQR+XJToOHrsD4cPaMXpn6KO7y2+wM8AZEs8VpBLVA==
 
-"@types/marked@5.0.1":
-  version "5.0.1"
-  resolved "https://registry.yarnpkg.com/@types/marked/-/marked-5.0.1.tgz#15acd796d722b91bf00738c8c8539aaf5034f0c6"
-  integrity sha512-Y3pAUzHKh605fN6fvASsz5FDSWbZcs/65Q6xYRmnIP9ZIYz27T4IOmXfH9gWJV1dpi7f1e7z7nBGUTx/a0ptpA==
-
 "@types/mime@*":
   version "3.0.1"
   resolved "https://registry.yarnpkg.com/@types/mime/-/mime-3.0.1.tgz#5f8f2bca0a5863cb69bc0b0acd88c96cb1d4ae10"
@@ -3465,10 +3460,10 @@ lru-cache@^6.0.0:
   dependencies:
     yallist "^4.0.0"
 
-marked@5.1.2:
-  version "5.1.2"
-  resolved "https://registry.yarnpkg.com/marked/-/marked-5.1.2.tgz#62b5ccfc75adf72ca3b64b2879b551d89e77677f"
-  integrity sha512-ahRPGXJpjMjwSOlBoTMZAK7ATXkli5qCPxZ21TG44rx1KEo44bii4ekgTDQPNRQ4Kh7JMb9Ub1PVk1NxRSsorg==
+marked@17.0.1:
+  version "17.0.1"
+  resolved "https://registry.yarnpkg.com/marked/-/marked-17.0.1.tgz#9db34197ac145e5929572ee49ef701e37ee9b2e6"
+  integrity sha512-boeBdiS0ghpWcSwoNm/jJBwdpFaMnZWRzjA6SkUMYb40SVaN1x7mmfGKp0jvexGcx+7y2La5zRZsYFZI6Qpypg==
 
 md5.js@^1.3.4:
   version "1.3.5"