v4.0.1

Security

• Fixed: Improper neutralization of HTML sanitization by comments that may lead to XSS (CVE-2024-56510 reported by @Ry0taK)

Changed

• Upgrade Marpit to v3.1.2 (#390)
• Upgrade development Node.js LTS and dependent packages to the latest version (#391)

v3.9.1

Security

• Fixed: Improper neutralization of HTML sanitization by comments that may lead to XSS (CVE-2024-56510 reported by @Ry0taK)

v4.0.0

Important

The new slide container styles, block container and safe centering, produce breaking changes to existing slide layouts. (#382)

If you are using the built-in theme that contents are vertically centered (or the custom theme that depends on such themes), you can tweak the style in Markdown or the custom theme to get back the previous flex container.

• For default and uncover theme:

  <style>
    section {
      display: flex;
    }
  </style>

• For gaia theme's lead class:

  <style>
    section.lead {
      display: flex;
    }
  </style>

Breaking

• Drop support against end-of-lifed Node.js versions (v16 and earlier), and now v18+ are required (#359)
• The slide container of built-in themes became the block element and adopted safe centering (#372, #382)

Added

• Transform emojis up to Unicode 15.1 into Twemoji images (#380)

Changed

• Upgrade Marpit to v3.1.1 (#378)
  • Bump markdown-it to v14.1.0, and follow the latest spec of CommonMark 0.31.2
  • Support for CSS nesting (cssNesting constructor option)
• Use simpler CSS minification when minifyCSS option is enabled (#381)
• Relax HTML allowlist: Allowed a lot of HTML elements and attributes by default (#301, #383)
• Make the image background transparent in default theme (#196, #371, #386)

• Upgrade development Node.js to v20 LTS (#359)
• Upgrade dependent packages to the latest version (#380)
• Switch package manager from yarn to npm (#379)
• Migrate ESLint config to Flat config (#385)

Fixed

• Suppress uncaught DOMException error while upgrading <marp-pre> Web Component elements in Firefox (#370, #384)

v3.9.0

Added

• Enabled cssContainerQuery constructor option from Marpit framework by default (#360)

Changed

• Upgrade Marpit to v2.6.1 (#358)
  • Added cssContainerQuery constructor option
  • Added lang global directive and constructor option
• Slightly changed the color scheme of default theme to match as the current GitHub style (#358)
• Upgrade Node.js and dependent packages to the latest version (#358)

v3.8.1

Changed

• Upgrade Marpit to v2.5.3 (#357)

Fixed

• Regression: Auto-scaling for KaTeX block is always enabled regardless of @auto-scaling theme metadata (#353, #354)

v3.8.0

Added

• highlightjs getter, to access the generated highlight.js instance per Marp Core instances (#350)

Changed

• Marp Core instance is no longer using the shared highlight.js instance (#350)
• Upgrade Node.js and dependent packages to the latest version (#351)

v3.7.0

Changed

• Upgrade Marpit to v2.5.0 (#342)
  • Added paginate: skip and paginate: hold
• Upgrade Node.js and dependent packages to the latest version (#345)

Fixed

• Regression: Not working emoji.twemoji.base constructor option (#343, #344)

v3.6.0

Added

• Assign auto-generated slug to id attribute of each headings (#299, #338)
• slug constructor option (#338)

Changed

• Upgrade Node.js and dependent packages (#336)
• Use @twemoji/api package instead of twemoji (#337)

v3.5.0

Changed

• Upgrade marpit-svg-polyfill to v2.1.0 (#329)
• Upgrade Node.js and dependencies (#331)

Deprecated

• An observer() function exported by @marp-team/marp-core/browser, which was actually designed for internal (#330)

v3.4.2

Fixed

• Patch KaTeX style to fix visibility of some math symbol in Chromium-flavored browsers (#326)

Changed

• Upgrade Node and dependent packages (#327)