[Brooooooklyn]

Problem

Consumers of @void/md@0.10.6 that don't have markdown-it in their tree fail to build:

error during build: Build failed with 95 errors:
Error: Cannot find module 'markdown-it'
  - node_modules/markdown-it-attrs/index.js

(Real failure on napi.rs website main: run #28873381156.)

Root cause

#256 "Update deps" bumped markdown-it-attrs ^4.3.1 → ^5.0.0. That major added a top-level require('markdown-it'):

// markdown-it-attrs@5.0.0/index.js
const createMarkdownIt = require('markdown-it');        // line 3, module load
...
const defaultFence = createMarkdownIt().renderer.rules.fence;   // line 112, only for the new `fenceAttrsOnPre` option

@void/md ships the markdown-exit fork and no markdown-it, so this previously-optional peer became a hard, unresolvable dependency for any consumer that doesn't happen to have markdown-it installed.

Why CI was green: void's monorepo resolves markdown-it@14.1.1 from other tooling, silently satisfying the peer. Downstream consumers (yarn/npm without markdown-it) don't get that, so they explode on install → build.

Fix

Pin markdown-it-attrs back to ^4.5.0 — the version void shipped through 0.10.5.

	4.5.0	5.0.0
top-level require('markdown-it')	❌ (only JSDoc @typedef)	✅ line 3
{.class #id} / curly_attributes rule	identical	identical
fenceAttrsOnPre option	n/a	new — void never uses it

void applies attrs to its own markdown-exit instance and installs its own shiki fence renderer, so no 5.x behavior is lost.

Validation

• ✅ @void/md build (vp pack) — clean
• ✅ md unit tests 30/30 (compile / plugins / metadata), incl. compile('Hello {.greeting}') and the {1,3-5} fence line-highlight test
• ✅ lockfile: 0 remaining refs to markdown-it-attrs@5

⚠️ Renovate will try to re-bump this to ^5.0.0. Consider a renovate ignore/rule so it doesn't regress, or migrate @void/md off the markdown-exit fork for attrs. Staying on markdown-exit means attrs must not hard-require markdown-it.

🤖 Generated with Claude Code

---

Note

Low Risk
Dependency downgrade only; attrs behavior used by void ({.class}) matches 4.5.0, with no application code changes.

Overview
Downgrades markdown-it-attrs from ^5.0.0 to ^4.5.0 in @void/md so consumers without markdown-it in their dependency tree can build again. Version 5.x loads markdown-it at module init; this package compiles with markdown-exit and does not ship markdown-it, which caused Cannot find module 'markdown-it' for downstream apps.

The lockfile is refreshed for the new attrs version; unrelated resolution/tarball metadata churn in pnpm-lock.yaml is incidental.

^{Reviewed by Cursor Bugbot for commit fa6ef09. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_cd7d1b4a-0036-439b-b4ff-6c5d193dcf8a)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	markdown-it-attrs@​4.5.0

View full report