Example bug that currently exists and is fixed with CodeMirror master:

> Quote.  This is what causes the list parsing bug.

Not a quote.

text

- list.

text

 - not a list?!

[http://mathdown.net/?doc=bTMM6DtiBuk]

There is tons of improvements that landed on CM 5 in recent months.
Closer to CommonMark (esp. lists!) and keeps getting closer;
there was a fix to multiplexed markdown/latex;
etc...

Recent CodeMirror can't be used as-is from submodule — has src/*.js files using require(); to get a combined browser-suitable lib/codemirror.js, would need to use npm module, or run codemirror's build step, or something like that.
I guess it's time to move to npm (revive #109)...

• I've toyed with ideas of npm-as-git-submodule gateway. Didn't find anything ready, not gonna shave this yak this time :) cf. rawdep plan#8
• GitHub pages will no longer work :-(. This was friendly to forks, but the Heroku button is good enough for that.
  • gh-pages could still be used as a deploy target, but that loses much of the appeal for me.
• Rawgit.com for forks / PRs / old commits will not work — but it doesn't anyway with submodules (Support for submodules (also hosted on github) rgrove/rawgit#28).
• I'm still looking for a simpler static-site hosting.
  • probably GitLab pages, which also supports arbitrary build step — pending some security features (Move to Gitlab Pages? #174)
  • I'm also looking at Netlify.com and Surge.sh.

Immediate plan to make progress:

• get Codemirror via npm
• drop documentation about github pages
• document npm install necessary before opening local index.html works.
• replace all submodules with npm for consistency? release on npm CodeMirror-MathJax#45

Another idea I've considered is getting CodeMirror and MathJax from a CDN, eg. cdnjs / jsDelivr.

• Offline is not a consideration — mathdown always needs internet for Firebase.
  • However, developement is slightly harder when you want to modify CodeMirror...
• SubResource Integrity is a must. https://caniuse.com/#feat=subresource-integrity — not ideal, IE and few others missing. But considering the threat assumes compromise of a well-regarded CDN, that could be OK.
  • implementing SRI requires embedding integrity hashes in my html. in principle that should be a build step, in practice easy enough manually.
    • npm 5 has integrity field in package-lock.json, but apparently not exactly related?

No, CDNs are unacceptable due to leakage of secret URL in Referer header.
Neither Referrer-Policy header, referrerpolicy attribute nor rel=noreferrer have bulletproof support.

I've started using my stop-gap CodeMirror fork where I push builds, which allows GitHub pages to keep working — see #180.

But I should just get on with the times & switch to Netlify, which can run npm install (and I believe does support submodules).
Currently mathdown running on it https://elastic-liskov-92f696.netlify.app/.
Netlify is sweet in many ways, deploys preview envs on PRs, supports IPv6 (#121)...