Move the 'marked' lib to the settings app and update it

[ChristophWurst]

The marked dependency was out of date and isn't used by any app except
the settings pages. Hence it's move there and updated to resolve security
vulnerabilities.

Replaces #13462

[kesselb]

https://github.com/search?l=JavaScript&p=1&q=org%3Anextcloud+%22marked%22&type=Code

It could be that these apps need an update then:

• https://github.com/nextcloud/files_texteditor (https://github.com/nextcloud/files_texteditor/blob/2e83ba84b22d5cfe464c66d528c3f34e01408b97/js/public-share.js#L14)
• https://github.com/nextcloud/notes (https://github.com/nextcloud/notes/blob/34460518b29148d01132482ef9ecc2cbb8bb07db/js/vendor/simplemde/src/js/simplemde.js#L14)

[nickvergessen]

Can we leave it in core? there are quite some apps using it.
Announcements also has an open PR to make use of it, would make it 4 versions of marked being shipped?

[ChristophWurst]

I assumed it was just settings. That is the issue with this kind of dependency loading. You never know who it uses. And when you update them you don't know which apps break. On that note, there were actually breaking changes in this update, but none effected settings as far as I can tell.

We should aim to get rid of that. Dependencies should be shipped with the apps. This lib is 20kb in size, so the duplication overhead is negligible IMO.

Edit: we're facing a well known problem here: https://en.wikipedia.org/wiki/Dependency_hell. In contrast to php/composer, Javascript will allow us to fix it.

[rullzer]

Can we leave it in core? there are quite some apps using it.

Maybe for 1 more version. But apps should ship their own dependencies. Else we can never update a dependency (see jquery) because some app might depends on something

Announcements also has an open PR to make use of it, would make it 4 versions of marked being shipped?

So be it. We do aggressive caching. But else we risk breaking all the apps every time we update a library.

[ChristophWurst]

I'm closing this and will push another PR to bundle a separate version for settings.

@nickvergessen please ship your own for the announcements as well. We'll remove the one from core in Nextcloud 17.

[nickvergessen]

Thats a good enough solution. Just dont want to have breaking js apps all the time, just after we spoke about brekaing apps on php level.

[rullzer]

@nickvergessen well sure. But this is like using private namespace ;)

[juliusknorr]

@ChristophWurst @rullzer I've added a note of the deprecation of the shipped marked to #12915. We should keep track there which libraries we want to get rid of in an upcoming version, so developers can prepare 😉