
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
gray-matter-es
Advanced tools
ESM-only gray-matter implementation.
npm install gray-matter-es
# or
pnpm add gray-matter-es
import * as matter from "gray-matter-es";
// Parse front matter
const file = matter.matter("---\ntitle: Hello\n---\nThis is content");
console.log(file.data); // { title: 'Hello' }
console.log(file.content); // 'This is content'
// Stringify
const str = matter.stringify("content", { title: "Hello" });
// ---
// title: Hello
// ---
// content
// Test if string has front matter
matter.test("---\ntitle: Hello\n---"); // true
// Detect language
matter.language("---json\n{}\n---"); // { raw: 'json', name: 'json' }
You can also import individual functions for tree-shaking:
import { matter, stringify, test, language, clearCache, cache } from "gray-matter-es";
const file = matter("~~~\ntitle: Hello\n~~~\ncontent", {
delimiters: "~~~",
});
const file = matter('---json\n{"title": "Hello"}\n---\ncontent');
console.log(file.data); // { title: 'Hello' }
console.log(file.language); // 'json'
const file = matter("---\ntitle: Hello\n---\nexcerpt\n---\ncontent", {
excerpt: true,
});
console.log(file.excerpt); // 'excerpt\n'
matter(input, options?)Parse front matter from a string or Uint8Array.
Parameters:
input - String, Uint8Array, or object with content propertyoptions - Optional configurationReturns: GrayMatterFile object with:
data - Parsed front matter datacontent - Content after front matterexcerpt - Extracted excerpt (if enabled)orig - Original input as Uint8Arraylanguage - Detected/specified languagematter - Raw front matter stringisEmpty - True if front matter block was emptystringify(data?, options?) - Stringify the file backstringify(file, data?, options?)Stringify data to front matter and append content.
test(str, options?)Test if a string has front matter.
language(str, options?)Detect the language specified after the opening delimiter.
clearCache()Clear the internal cache.
cacheThe internal cache (read-only access).
language - Language to use for parsing (default: 'yaml')delimiters - Custom delimiters (default: '---')excerpt - Enable excerpt extraction (true, string delimiter, or function)excerpt_separator - Custom excerpt separatorengines - Custom parsing/stringifying engines@std/yaml instead of js-yamlmatter.read() (use your own file reading)eval)lang, delims, parsers)section-matter support- const matter = require('gray-matter');
+ import * as matter from 'gray-matter-es';
The main function is now matter.matter() instead of matter():
- const result = matter(str);
+ const result = matter.matter(str);
Other methods remain the same:
matter.stringify(file, data);
matter.test(str);
matter.language(str);
matter.clearCache();
The JavaScript engine has been removed for security reasons (it used eval). If you were using JavaScript front matter:
---js
{
title: "Hello",
date: new Date()
}
---
You'll need to either:
The following deprecated options have been removed:
| Removed Option | Replacement |
|---|---|
lang | language |
delims | delimiters |
parsers | engines |
- matter(str, { lang: 'json', delims: '~~~' });
+ matter(str, { language: 'json', delimiters: '~~~' });
If you were using section-matter functionality, you'll need to handle it separately.
This library uses @std/yaml instead of js-yaml. In most cases, this is a drop-in replacement, but there may be edge cases with non-standard YAML.
This project uses Nix for development environment management. Make sure you have Nix installed with flakes enabled.
# Enter the development shell
nix develop
# Run tests
pnpm run test
# Build
pnpm run build
# Lint & typecheck
pnpm run lint
MIT
FAQs
ES-only gray-matter
The npm package gray-matter-es receives a total of 355 weekly downloads. As such, gray-matter-es popularity was classified as not popular.
We found that gray-matter-es demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.