Fix Markdown integration gaps within bundle budgets

[tannerlinsley]

Changes

• Forward code-fence metadata to pre[data-meta] and highlighter options in HTML, React, and Octane.
• Support portable inline component nodes through the existing component maps and HTML hooks.
• Add an opt-in URL policy callback with the default sanitized result and explicit rejection, without changing the default policy.
• Use single-pass attribute escaping and expand regression tests, documentation, and shipped skills.

The Changeset schedules @tanstack/markdown@0.0.15. This adds no runtime dependencies. Main renderer bundles grow 74-78 gzip bytes, about 1.1%, with exact minified, gzip, and Brotli ceilings enforced for all 22 measured entries. Standalone extensions are unchanged.

Compatibility notes: metadata-bearing code fences gain an escaped data-meta attribute, and exhaustive InlineNode switches need an inlineComponent case. Math stays outside the core. URL callback results are trusted and do not apply to raw HTML or supplied ASTs.

Validation

• pnpm run changeset:status: one patch release.
• pnpm run verify: 245 tests, typecheck, build, documentation, shipped skills, conformance, size budgets, benchmarks, and package dry-run pass.
• pnpm run corpus:audit:external: 10,517 Markdown files across 20 pinned repositories, no parser/determinism errors or unexplained target-profile content differences.
• Revision comparisons retain all 403 passing CommonMark examples and show no new content differences across 16,825 external and TanStack files under both profiles.
• Repeated warmed benchmarks show no consistent end-to-end slowdown; no speedup claim is made.

The corpus text-extraction helper now strips markup before decoding entities, so escaped code and metadata are not mistaken for HTML. Updated reports reflect that accounting correction, not new parser regressions.

Fixes #7
Fixes #9
Fixes #11

Summary by CodeRabbit

• New Features

  • Added support for inline components across HTML, React, and Octane rendering, including nested inline content and configurable fallback tags.
  • Added configurable URL policies for links and images, including approved replacements or removal of unsafe destinations.
  • Code-fence metadata is now available to highlighters and exposed as data-meta on rendered code blocks.

• Bug Fixes

  • Improved attribute escaping, including backticks, and strengthened URL and metadata handling across renderers.

• Documentation

  • Expanded guidance for URL policies, inline components, fence metadata, extensions, security, and performance.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 4b5a5578-a5f7-4be9-a0e3-ad6ff81e701f

📥 Commits

Reviewing files that changed from the base of the PR and between fca831e and fe3e463.

📒 Files selected for processing (37)

• .changeset/portable-markdown-integrations.md
• README.md
• docs/comparison.md
• docs/core-concepts/security.md
• docs/guides/extensions.md
• docs/guides/performance.md
• docs/guides/syntax-highlighting.md
• docs/overview.md
• docs/reference/parser.md
• docs/reference/types.md
• reports/benchmarks.json
• reports/benchmarks.md
• reports/conformance.json
• reports/conformance.md
• reports/external-corpus.json
• reports/external-corpus.md
• reports/sizes.json
• reports/sizes.md
• scripts/audit-corpus.ts
• scripts/conformance-data.ts
• skills/custom-extensions/SKILL.md
• skills/docs-features/references/docs-metadata.md
• skills/production-pipelines/SKILL.md
• skills/render-markdown/references/ast-and-options.md
• src/html.ts
• src/inline.ts
• src/octane.ts
• src/react.ts
• src/types.ts
• src/utils.ts
• tests/audit-regressions.test.tsx
• tests/bundle-size.test.ts
• tests/corpus-audit.test.ts
• tests/inline-component.types.ts
• tests/issue-regressions.test.tsx
• tests/markdown.test.tsx
• tests/url-policy.test.tsx

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

The Markdown AST now supports portable inline components, configurable URL filtering, and code-fence metadata forwarding across HTML, React, and Octane renderers. Escaping, regression coverage, documentation, bundle budgets, and generated reports were updated.

Portable markdown integrations

Layer / File(s)	Summary
Inline component contracts and rendering src/types.ts, src/html.ts, src/react.ts, src/octane.ts, docs/..., skills/..., tests/...	Adds InlineComponentNode to the inline AST and renders inline children with renderer component mappings.
URL policy parsing and rendering src/types.ts, src/inline.ts, docs/..., skills/..., tests/url-policy.test.tsx	Adds urlTransform for policy-processed Markdown link and image destinations.
Fence metadata and escaping src/types.ts, src/html.ts, src/react.ts, src/octane.ts, src/utils.ts, tests/...	Forwards raw fence metadata to highlighters and rendered pre elements, and expands shared escaping for backticks.
Regression and audit behavior scripts/..., tests/...	Updates corpus text extraction and adds coverage for inline rendering, line endings, metadata, semantic components, and escaped content.
Release documentation and measurements README.md, docs/..., reports/..., tests/bundle-size.test.ts, .changeset/...	Updates API guidance, bundle-size ceilings, release notes, benchmarks, conformance data, corpus reports, and size reports.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~30 minutes

Change: Feature · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to fe3e4

The Markdown integration changes are covered across supported renderers and preserve the documented security and rendering contracts. No merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 28 functions across 15 files. (22 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: fixing Markdown integration gaps while preserving bundle-size budgets. It is concise and specific enough for project history.
Linked Issues check	✅ Passed	The PR implements the coding requirements for all linked issues. For #7, CodeBlockNode.meta is forwarded to highlighter options and rendered as escaped data-meta; the summary and regression tests …
Out of Scope Changes check	✅ Passed	The changes stay within the linked objectives. Renderer updates, parser and escaping changes, regression tests, type tests, documentation, skills, bundle budgets, and conformance or corpus updates sup…

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 28 functions across 15 files. (22 skipped: 22 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch taren/release-markdown-integrations

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}