cnc-markdown
Renders markdown to HTML, sanitised by default. It is a DISPLAY widget — there is no editing here — and the sanitiser is the reason to use it over rendering markdown yourself.
Quick start
Bind markdown source to value. The renderer, the highlighter and the sanitiser are
all fetched from a CDN at mount, so the element is EMPTY server-side and until those imports
resolve.
<cnc-markdown value="# Heading
Some **bold** text and `inline code`."></cnc-markdown>Usage guidance
Leave safe alone for anything a USER wrote. It is the entire security value of the
widget: comments, descriptions, README content and any other text arriving from outside your own
repository should go through the sanitiser, and turning it off for such content is a cross-site
scripting hole rather than a formatting convenience.
Reach for safe="false" only for markdown YOU authored and ship — a help page
that needs an embed, say. Even then, prefer a widget for the thing you are embedding, since
unsafe mode disables the allow-list wholesale rather than opening one hole in it.
Reserve space for it. Nothing renders server-side and three modules are fetched before the first paint, so a page of markdown blocks will reflow as they arrive unless the container has a height.