How does compile -> write to file -> run with node any safer?

[tmfelwu]

At @mdx-js/mdx evaluate it states

Compile and run MDX. When possible, please use compile, write to a file, and then run with Node, or use one of the § Integrations. But if you trust your content, evaluate can work.

I was wondering how is this any safer than directly evaluating in the browser?

Does "to run with node" mean use the webpack loader?

[wooorm]

Does "to run with node" mean use the webpack loader?

Run with node means to have such code in Node:

import content from './my-compiled-mdx.js'

No, the sentence can be split like this:

a) please use compile, write to a file, and then run with Node
b) or use one of the Integrations

Node can load JavaScript files itself, it does not need a bundler such as esbuild/webpack/rollup.

I was wondering how is this any safer than directly evaluating in the browser?

evaluate(compile(x)) is just as safe in Node as in Deno as in a browser. It’s equivalent to using an integration. The problem stems from why and how people use it. And those reasons are more often not a good idea / unsafe.