Upgraded marked lib dependency at the JSDoc 3.6.7 release is broken on nodejs <= 14

[alexbakum]

Within the 3.6.7 marked has been upgraded from v0.8 to v2 (see f7a64bd#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519R24)

marked@2 claims it's compatible with nodejs@8, however that's not true due to the following:

• it claims it's "main" entrypoint file is src/marked.js (see https://github.com/markedjs/v2.1.0/blob/master/package.json#L6)
• src/marked.js uses the optional chaining syntax which is available only at nodejs@14 (MDN support table) (see https://github.com/markedjs/marked/blob/v2.1.0/src/marked.js#L158)

Input code

Does not matter IMO

JSDoc configuration

Does not matter IMO

JSDoc debug output

Does not matter IMO

Expected behavior

JSDoc works at the nodejs@12 env

Current behavior

JSDoc throws SyntaxError: Unexpected token '.' at the nodejs@12 env.

> jsdoc -c jsdoc.json
03:02:16  
/var/jenkins_home/workspace/%stripped%/node_modules/marked/src/marked.js:158
03:02:16            const prevRenderer = extensions.renderers?.[ext.name];
03:02:16                                                      ^
03:02:16  
03:02:16  SyntaxError: Unexpected token '.'
03:02:16      at new Script (vm.js:88:7)
03:02:16      at createScript (vm.js:263:10)
03:02:16      at Object.runInThisContext (vm.js:311:10)
03:02:16      at wrapSafe (internal/modules/cjs/loader.js:1059:15)
03:02:16      at Module._compile (internal/modules/cjs/loader.js:1122:27)
03:02:16      at Object.Module._extensions..js (internal/modules/cjs/loader.js:1178:10)
03:02:16      at Module.load (internal/modules/cjs/loader.js:1002:32)
03:02:16      at Object.load (/var/jenkins_home/workspace/%stripped%/node_modules/requizzle/lib/loader.js:105:18)
03:02:16      at Requizzle.requizzle (/var/jenkins_home/workspace/%stripped%/node_modules/requizzle/lib/requizzle.js:87:31)
03:02:16      at infectProxy (/var/jenkins_home/workspace/%stripped%/node_modules/requizzle/lib/loader.js:79:31)
03:02:16      at Module.targetModule.require (/var/jenkins_home/workspace/%stripped%/node_modules/requizzle/lib/loader.js:97:44)
03:02:16      at require (internal/modules/cjs/helpers.js:77:18)
03:02:16      at Object.<anonymous> (/var/jenkins_home/workspace/%stripped%/node_modules/jsdoc/lib/jsdoc/util/markdown.js:8:16)
03:02:16      at Module._compile (internal/modules/cjs/loader.js:1158:30)
03:02:16      at Object.Module._extensions..js (internal/modules/cjs/loader.js:1178:10)
03:02:16      at Module.load (internal/modules/cjs/loader.js:1002:32)

Your environment

Software	Version
JSDoc	3.6.7
Node.js	12.16.1
npm	6
Operating system	CentOS-like Linux distribution

[alexbakum]

@hegemonic can you look at this please?

[alasdairhurst]

Note that marked is very flaky with node support. Don't trust the package.json. They say they support "latest and LTS versions of Node.js" which changes with time, wheras their major versions do not. Seems like to avoid a breaking change here we can assume that marked is no longer node 8.15 compatible from this point and just pin it to the last version.

Do note that some of the older versions don't support node 8 either. There was a change to a regex which includes unicode matches and that doesn't work until node 10.
Unfortunately it also includes security fixes so you're basically juggling between jsdoc rolling back marked to a version which supported node 8, and introducing a security issue, then releasing a new major version of jsdoc, or introducing a breaking node version change in a minor version of jsdoc.

Either way, anything that consumes marked now ends up "inheriting" it's flaky node support unless it gets pinned.

EDIT: I see JSDOC now drops node 10 support in 4.x, but this impacts 3.x too.

[alexbakum]

Well, I don't trust their (marked) package.json. It's just misleading at the moment.

Landing the security fixes as they come is good. However to me it appears, the marked upgrading was kinda a blind shot, the author may have not expected such a surprise.

And dropping the breaking changes at the patch version update should not happen while one complies to sevmer. Otherwise it should be claimed.

[alexbakum]

@alasdairhurst so this should be fixed according to markedjs/marked#2109

[alasdairhurst]

@alexbakum They just pushed a patch version now which removes the optional chaining (node 14 requirement) and now works and tested with node 12. (changing what was documented as support for node 8 in the package.json)

Basically, they don't "interpret" change in node version support as a breaking change. (aside from what maybe 90% of the npm community thinks). Unfortunately this impacts everything upstream.

Unfortunately that PR doesn't solve the problem for jsdoc :( It now means that jsdoc 3.x still works with node 12, but it should be compatible with node 8.15

[alexbakum]

Well, at least for node 12 (my case) the issue is solved for now.
I'll leave the issue open for maintainers to decide on their opinion.

[alasdairhurst]

For maintainers they can do this:
const marked = require('marked/lib/marked');

This will import the transpiled es5 version of marked and maintain node support.