chore(deps): bump markdown-it from 14.3.0 to 15.0.0

[dependabot]

Bumps markdown-it from 14.3.0 to 15.0.0.

Changelog

Sourced from markdown-it's changelog.

[15.0.0] - 2026-07-30

Added

• Exposed parser internals classes as static properties on markdownit.
• Bundled TypeScript declarations. Remove @types/markdown-it if you used it.
• Added the markdown-it/browser export with bundled ESM and UMD builds.
• Added colored CLI help on supported terminals via argparse 3.
• Added reference labels to link/image tokens, #938.
• Added reference_definition tokens. They remain stripped by default for backwards compatibility, #1055. Also adjusted the line-break heuristic to keep output exactly the same.

Changed

• [breaking] linkify-it => v6
  • No fuzzy links by default.
  • No auth part check by default.
  • Unicode punctuation terminates the link by default (should help with CJK).
  • See linkify-it changelog for other changes.
• Package root now resolves to prebuilt ESM and CJS files instead of raw sources. Distribution files were reorganized under dist/ and dist/browser/.
• Migrated to Typescript.
• entities => v8. Can be rolled back to v7 if compatibility issues happen.
• Moved validateLink, normalizeLink and normalizeLinkText from properties to prototype methods.
• Reworked issue templates and contribution guidelines.

Removed

• [breaking] Removed package-internal subpath exports (markdown-it/lib/* and similar). Use the static classes exposed on markdownit instead.
• [breaking] Removed obsolete StateBlock#ddIndent, #1139. Update markdown-it-deflist to keep it working.

Fixed

• Preserve a literal backslash before a terminating space in link destinations, matching CommonMark 6.3, #1188.
• Recognize lowercase declarations as HTML blocks, matching CommonMark 4.6, #1189.
• Require semicolons for named entities in all decoding paths, completing the fix for #1096.
• Enhanced the text_join rule to process image alt text.
• Include inline code content in image alt text, #1142.

Commits

• 157b33b 15..0.0 released
• f73cb76 doc: rename files
• 3bc8e2d Add TS types
• 2620dce Update contribution guidelines and issue templates
• 7d365fe doc: migration info
• 5c9b7ce Update changelog
• 5a996d5 doc: fix @example tags display
• f5083f4 doc: continue restructuring & theme fixing
• 54289c4 Show inline code content in image alt tag #1142
• 974e2d7 text_join rule fix: process image alt content too (fixes lost escapes and...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[robertvangor]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[robertvangor]

Pi Dependabot assessment

Dependency and version movement

• chore(deps): bump markdown-it from 14.3.0 to 15.0.0

Authoritative changelog / advisory links

• Authoritative upstream references were not fully collected before the worker failure.

Application usage and potentially disruptive effects

• Disruptive-effect and application-usage analysis was not completed because the worker failed before a structured handoff.

Validation

• Recovery assessment remains incomplete: the recovery worker reached the runtime default 30-minute child limit, and the finalize-only fallback could not start because the Pi extension context was stale after session replacement. Partial evidence or GitHub side effects are not treated as a completed structured handoff.

Conversation state / unresolved concerns

• Conversation collection was incomplete because the worker did not return a structured handoff.

Change risk: 10/10 — Compatibility and regression risk remain unbounded because the worker failed before a complete assessment; conservatively scored at the maximum uncertainty level.

Remediation importance: 4/10 — This is an open Dependabot maintenance update, but the failed assessment did not establish an advisory, active exploitation, or compliance urgency.

Final exact head SHA: f2bf8ed5a4e060c2cb695b26813fe91477ee7675

Dev deployment evidence

• Not confirmed for final SHA f2bf8ed
• Reason: No real dev-de1 deployment target for this repository was found. Kubernetes workloads and readable Application deployment metadata contain no requested repository or SHA. The repository workflows provide no dev/static/S3 deployment; its established distribution is release-triggered NPM, whose current artifact is unrelated and does not contain the requested SHA. Exact dev-de1 deployment confirmation therefore cannot be made. Some Application CR namespaces were RBAC-denied, but all workload-level scans and readable target metadata had zero matches.
• observedAtUtc: 2026-08-23T19:20:17Z; source: kubectl; scope: dev-de1; command: kubectl config current-context; kubectl config view --minify; result: Read-only context was dev-de1; server was the observatory-de1 Kubernetes proxy.
• observedAtUtc: 2026-08-23T19:19:00.710955Z; source: kubectl; scope: dev-de1; command: Read-only metadata/image scan across deployments,statefulsets,daemonsets,jobs,cronjobs,pods,services,ingresses,configmaps for repository slug, requested SHA, and image-tag prefixes.; result: Zero target matches: deployments 372, statefulsets 146, daemonsets 21, jobs 314, cronjobs 27, pods 1629, services 797, ingresses 0, configmaps 1018.
• observedAtUtc: 2026-08-23T19:21:58.859847Z; source: kubectl Application CR; scope: dev-de1; command: One-process read-only namespaced scan of application.staffbase.com/v1alpha1 Application metadata, deployment annotations, images, and status.; result: 166 namespaces scanned; 11 Application objects readable and zero matched the repository, plugin-nodejs name, or requested SHA. 149 namespace reads were RBAC-denied; no scan errors.
• observedAtUtc: 2026-08-23T19:24:32.487983Z; source: kubectl Flux; scope: dev-de1; command: Read-only scans of GitRepository, Kustomization, HelmRelease, ImageRepository, ImagePolicy, and ImageUpdateAutomation objects for repository slug and SHA.; result: Object counts were 3, 183, 307, 81, 81, and 79 respectively; zero matching objects.
• observedAtUtc: 2026-08-23T19:23:14Z; source: GitHub raw workflow; url: https://raw.githubusercontent.com/Staffbase/create-staffbase-plugin-nodejs/f2bf8ed5a4e060c2cb695b26813fe91477ee7675/.github/workflows/auto-merge.yml; result: The checked-in workflow is pull_request-only reusable Dependabot auto-merge; it contains no deployment step.
• observedAtUtc: 2026-08-23T19:23:14Z; source: GitHub raw workflow; url: https://raw.githubusercontent.com/Staffbase/create-staffbase-plugin-nodejs/f2bf8ed5a4e060c2cb695b26813fe91477ee7675/.github/workflows/publish-npm.yml; result: The only distribution workflow triggers on release creation and runs npm publish to registry.npmjs.org; it contains no dev, S3/static, or Kubernetes deployment.
• observedAtUtc: 2026-08-23T19:23:27Z; source: NPM registry and git ancestry; url: https://registry.npmjs.org/@staffbase%2fcreate-staffbase-plugin; result: Latest is 1.0.17, published 2026-06-23T09:47:02.368Z, with gitHead 9170996. Requested SHA is absent from published versions; git merge-base --is-ancestor requestedSha latestGitHead exited 1.

Status: blocked

check_after: not set (exact deployment not confirmed)

Residual risks / blocking reason

• No real dev-de1 deployment target for this repository was found. Kubernetes workloads and readable Application deployment metadata contain no requested repository or SHA. The repository workflows provide no dev/static/S3 deployment; its established distribution is release-triggered NPM, whose current artifact is unrelated and does not contain the requested SHA. Exact dev-de1 deployment confirmation therefore cannot be made. Some Application CR namespaces were RBAC-denied, but all workload-level scans and readable target metadata had zero matches.