
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@nowline/embed
Advanced tools
Browser embed bundle for Nowline. Drop a <script> tag and ```nowline``` blocks render in place.
Browser bundle that finds ```nowline fenced code blocks in a page
and renders them as SVG roadmaps. Mirrors the
Mermaid embed surface — drop a <script>
tag and Nowline blocks light up.
<!-- pin an exact version in production -->
<script src="https://cdn.jsdelivr.net/npm/@nowline/embed@0.4.2/dist/nowline.min.js"></script>
That's it. Every <pre><code class="language-nowline">…</code></pre>
block on the page renders on DOMContentLoaded.
<script src="https://cdn.jsdelivr.net/npm/@nowline/embed@0.4.2/dist/nowline.min.js"></script>
<script>
nowline.initialize({
theme: 'dark', // 'light' | 'dark' | 'auto' (reads prefers-color-scheme once)
startOnLoad: true, // auto-run on DOMContentLoaded
selector: 'pre code.language-nowline',
locale: 'fr-CA',
width: 1024,
});
</script>
Theme precedence (highest to lowest):
initialize({ theme }) flag.nowline v1 theme: directive.prefers-color-scheme — captured once on init, not reactive.For dynamically loaded blocks or custom containers:
<script src="https://cdn.jsdelivr.net/npm/@nowline/embed@0.4.2/dist/nowline.min.js"></script>
<script>
const svg = await nowline.render(`
roadmap "My Roadmap"
swimlane team
item a "Task A" duration:1w
item b "Task B" duration:2w after:a
`);
document.getElementById('target').innerHTML = svg;
</script>
The bundle also exposes nowline.parse(source) for editor-style
applications that want diagnostics without running layout / render, and
nowline.run() (alias of init) to manually re-scan after the page
mutates.
jsDelivr is the documented CDN channel. The bytes are served directly
from the npm tarball — byte-identical to npm pack @nowline/embed@X.Y.Z.
| URL pattern | Stability | Audience |
|---|---|---|
https://cdn.jsdelivr.net/npm/@nowline/embed@X.Y.Z/dist/nowline.min.js | immutable per patch | production embedders pinning a known-good build |
https://cdn.jsdelivr.net/npm/@nowline/embed@X.Y/dist/nowline.min.js | mutable within minor | embedders who want patch fixes auto-rolled in (pre-1.0 the minor is the breaking-change boundary) |
https://cdn.jsdelivr.net/npm/@nowline/embed/dist/nowline.min.js | mutable, latest stable | docs, demos, prototypes |
https://cdn.jsdelivr.net/npm/@nowline/embed@next/dist/nowline.min.js | HEAD-tracking canary (0.0.0-dev.*) | "next" preview, opt-in only |
unpkg also works (https://unpkg.com/@nowline/embed@X.Y.Z/dist/nowline.min.js).
Pin the version in production so a release does not silently re-render
your roadmap. See specs/embed.md for the
full distribution spec.
include-directives are skipped. The embed runs in single-file
mode; a one-shot console.warn fires when a multi-file roadmap is
loaded. Use the CLI or the GitHub Action for multi-file rendering.<script> tags can't read the host
filesystem; logos are not embedded by the browser bundle. The CLI
is the path for embedded raster assets.<script> tags (GitHub READMEs, email,
Slack, Discord, Confluence rich text) cannot run the embed. The
GitHub Action exists for those.Frameworks that bundle their own JS can install the package and import named exports:
import { render, initialize } from '@nowline/embed';
The package is "type": "module" and "sideEffects": false, so a
modern bundler (esbuild, Rollup, Webpack 5+, Vite) tree-shakes the
auto-scan bootstrap when it's unused.
Apache-2.0. See LICENSE.
FAQs
Browser embed bundle for Nowline. Drop a <script> tag and ```nowline``` blocks render in place.
The npm package @nowline/embed receives a total of 10 weekly downloads. As such, @nowline/embed popularity was classified as not popular.
We found that @nowline/embed demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.