Skip to content

build(deps): bump markdown-it, markdownlint and markdownlint-cli2 - #1870

Open
dependabot[bot] wants to merge 2 commits into
developfrom
dependabot/npm_and_yarn/multi-8ce6a77369
Open

build(deps): bump markdown-it, markdownlint and markdownlint-cli2#1870
dependabot[bot] wants to merge 2 commits into
developfrom
dependabot/npm_and_yarn/multi-8ce6a77369

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor

Summary\n\n[Brief description of changes]\n\nBumps markdown-it to 14.3.0 and updates ancestor dependencies markdown-it, markdownlint and markdownlint-cli2. These dependencies need to be updated together.\n\nUpdates from 13.0.1 to 14.3.0\n
\nChangelog\n

Sourced from markdown-it's changelog.

\n
\n

[14.3.0] - 2026-07-02

\n

Changed

\n
    \n
  • Reworked build pipeline & tools.
  • \n
  • Added source maps.
  • \n
  • Bumped linkify-it to 5.0.2.
  • \n
\n

Fixed

\n
    \n
  • Preserve backslash-space hard line breaks, matching CommonMark 6.7, #1185.
  • \n
\n

[14.2.0] - 2026-05-24

\n

Added

\n
    \n
  • isPunctCharCode to utilities.
  • \n
\n

Fixed

\n
    \n
  • Don't end HTML comment blocks on a blank line, #1155.
  • \n
  • Properly recognize astral chars (surrogates) in delimiter scans for\nemphasis-like markers, #1072. Big thanks to @​tats-u for his global efforts\nwith improving CJK support.
  • \n
  • Preserve unicode whitespaces when trimm headings/paragraphs, #1074.
  • \n
  • More strict entities decode to avoid false positives ;, #1096.
  • \n
  • Restore block parser state on fail in lheading rule, #1131.
  • \n
\n

Security

\n
    \n
  • Fixed poor smartquotes perfomance on > 70k quotes in single block
  • \n
  • Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.
  • \n
\n

[14.1.1] - 2026-01-11

\n

Security

\n
    \n
  • Fixed regression from v13 in linkify inline rule. Specific patterns could\ncause high CPU use. Thanks to @​ltduc147 for report.
  • \n
\n

[14.1.0] - 2024-03-19

\n

Changed

\n
    \n
  • Updated CM spec compatibility to 0.31.2, #1009.
  • \n
\n

Fixed

\n
    \n
  • Fixed quadratic complexity when parsing references, #996.
  • \n
  • Fixed quadratic output size with pathological user input in tables, #1000.
  • \n
\n

[14.0.0] - 2023-12-08

\n

Changed

\n
    \n
  • Drop ancient browsers support (use .fromCodePoint and other features).
  • \n
  • Rewrite to ESM (including all plugins/deps). CJS fallback still available.\nNo signatures changed, except markdown-it-emoji plugin.
  • \n
  • Dropped dist/ folder from repo, build on package publish.
  • \n
\n\n
\n

... (truncated)

\n
\n
\nCommits\n
    \n
  • ff0ee08 14.3.0 released
  • \n
  • 52e2749 Bump linkify-it / vite deps
  • \n
  • 56c2404 fix: keep backslash-space hard line break (CommonMark 6.7) (#1185)
  • \n
  • 0fbb18b Bump vite from 8.0.14 to 8.0.16 (#1181)
  • \n
  • 83450e2 Rework benchmark deps and bump versions
  • \n
  • 57a6863 benchmark => tinybench
  • \n
  • 7608db1 Update CI config
  • \n
  • 9d8eb42 Added package-lock and updated versions to latest possible
  • \n
  • 0aee70d lint: enable @​stylistic/no-multi-spaces rule
  • \n
  • 8878985 lint => neostandard
  • \n
  • Additional commits viewable in compare view
  • \n
\n
\n
\n\nUpdates from 0.28.2 to 0.41.1\n
\nChangelog\n

Sourced from markdownlint's changelog.

\n
\n

0.41.1

\n
    \n
  • Improve MD029
  • \n
  • Fix module resolution under webpack
  • \n
  • Update dependencies
  • \n
\n

0.41.0

\n
    \n
  • Improve MD022/MD028/MD035/MD042/MD051/MD060
  • \n
  • Remove handling of inline directive syntax (frequent false positives)
  • \n
  • Remove deprecated Options.resultVersion (breaking change)
  • \n
  • Remove deprecated LintResults.toString (breaking change)
  • \n
  • Remove support for end-of-life Node version 20
  • \n
  • Update dependencies
  • \n
\n

0.40.0

\n
    \n
  • Improve MD011/MD013/MD051/MD060
  • \n
  • Update dependencies
  • \n
\n

0.39.0

\n
    \n
  • Add MD060/table-column-style
  • \n
  • Improve MD001/MD007/MD009/MD010/MD029/MD033/MD037/MD059
  • \n
  • Add support for reporting violations as severity warning
  • \n
  • Deprecate resultVersion and toString (breaking change)
  • \n
  • Improve type definitions
  • \n
  • Improve demo web page
  • \n
  • Update dependencies
  • \n
\n

0.38.0

\n
    \n
  • Add MD059/descriptive-link-text
  • \n
  • Improve MD025/MD027/MD036/MD038/MD041/MD043/MD045/MD051/MD052
  • \n
  • markdown-it parser no longer a production dependency (breaking change)\n
      \n
    • Add markdownItFactory option, remove markdownItPlugins option
    • \n
    \n
  • \n
  • Remove support for end-of-life Node version 18
  • \n
  • Improve performance
  • \n
  • Update dependencies
  • \n
\n

0.37.4

\n
    \n
  • Stop using module.createRequire, export resolveModule
  • \n
\n

0.37.3

\n
    \n
  • Tweak package.json dependencies to work with pnpm
  • \n
\n

0.37.2

\n\n
\n

... (truncated)

\n
\n
\nCommits\n
    \n
  • e41e5a4 Update to version 0.41.1.
  • \n
  • bf03d86 Update result object test to normalize versions in URLs for more consistent d...
  • \n
  • c3b6490 Update MD029/ol-prefix to handle space- and zero-padded fixes correctly while...
  • \n
  • d3d4c8b Address new lint violations introduced by previous commit.
  • \n
  • 5161218 Bump eslint-plugin-unicorn from 69.0.0 to 70.0.0
  • \n
  • f4986a9 Bump markdown-it from 14.2.0 to 14.3.0
  • \n
  • 96139fe Bump js-yaml from 5.2.0 to 5.2.1
  • \n
  • ce02ac3 Bump toml from 4.1.1 to 4.1.2
  • \n
  • 4e26a61 Pin CI workflow's pnpm version to "11.11" because "latest" version tag is bro...
  • \n
  • 3e1bbf3 Update test repository snapshots.
  • \n
  • Additional commits viewable in compare view
  • \n
\n
\n
\n\nUpdates from 0.19.0 to 0.23.2\n
\nChangelog\n

Sourced from markdownlint-cli2's changelog.

\n
\n

0.23.2

\n
    \n
  • Update dependencies
  • \n
\n

0.23.1

\n
    \n
  • Show attempted fix counts after fixing
  • \n
  • Update dependencies (including markdownlint)
  • \n
\n

0.23.0

\n
    \n
  • Add overrides configuration option
  • \n
  • Improve options/configuration file handling
  • \n
  • Update dependencies (including markdownlint)
  • \n
  • Remove support for end-of-life Node 20
  • \n
\n

0.22.1

\n
    \n
  • Update dependencies
  • \n
\n

0.22.0

\n
    \n
  • Make --config parameter more flexible
  • \n
  • Support TOML with --config parameter
  • \n
  • Add --configPointer parameter
  • \n
  • Update dependencies
  • \n
\n

0.21.0

\n
    \n
  • Refactor options/configuration file loading
  • \n
  • Update dependencies
  • \n
\n

0.20.0

\n
    \n
  • Update dependencies (including markdownlint)
  • \n
\n

0.19.1

\n
    \n
  • Update --format to avoid trailing newline
  • \n
  • Update dependencies
  • \n
\n
\n
\n
\nCommits\n
    \n
  • b82a6c8 Update to version 0.23.2.
  • \n
  • e4e659d Add a stub for process.nextTick (using queueMicrotask) now that globby (indir...
  • \n
  • 99760af Bump globby from 16.2.1 to 16.2.2
  • \n
  • 3070236 Address new ESLint warnings from previous commit.
  • \n
  • 6e3cc93 Bump eslint-plugin-unicorn from 71.1.0 to 72.0.0
  • \n
  • 4ba8177 Add eslint-package-json/all to lint script, address new issues.
  • \n
  • 9cb99b2 Refactor eslint.config.mjs to use defineConfig, change eslint-plugin-n from "...
  • \n
  • 37fb0ec Address new ESLint warnings from previous commit.
  • \n
  • f7fea61 Bump eslint-node-test from 0.2.0 to 0.3.0
  • \n
  • 85bb5e7 Bump js-yaml from 5.2.1 to 5.2.2
  • \n
  • Additional commits viewable in compare view
  • \n
\n
\n
\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting .\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n
\nDependabot commands and options\n
\n\nYou can trigger Dependabot actions by commenting on this PR:\n- will rebase this PR\n- will recreate this PR, overwriting any edits that have been made to it\n- will show all of the ignore conditions of the specified dependency\n- will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the Security Alerts page.\n\n
\n\n## Test plan\n\n- [ ] Manual testing complete\n- [ ] Automated tests pass\n- [ ] No regressions detected\n\n## Changelog\n\n### Added\n- \n\n### Changed\n- \n\n### Fixed\n-

Bumps [markdown-it](https://github.com/markdown-it/markdown-it) to 14.3.0 and updates ancestor dependencies [markdown-it](https://github.com/markdown-it/markdown-it), [markdownlint](https://github.com/DavidAnson/markdownlint) and [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2). These dependencies need to be updated together.


Updates `markdown-it` from 13.0.1 to 14.3.0
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@13.0.1...14.3.0)

Updates `markdownlint` from 0.28.2 to 0.41.1
- [Changelog](https://github.com/DavidAnson/markdownlint/blob/main/CHANGELOG.md)
- [Commits](DavidAnson/markdownlint@v0.28.2...v0.41.1)

Updates `markdownlint-cli2` from 0.19.0 to 0.23.2
- [Changelog](https://github.com/DavidAnson/markdownlint-cli2/blob/main/CHANGELOG.md)
- [Commits](DavidAnson/markdownlint-cli2@v0.19.0...v0.23.2)

---
updated-dependencies:
- dependency-name: markdown-it
  dependency-version: 14.3.0
  dependency-type: indirect
- dependency-name: markdownlint
  dependency-version: 0.41.1
  dependency-type: direct:development
- dependency-name: markdownlint-cli2
  dependency-version: 0.23.2
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the area:dependencies Composer/npm dependency work label Aug 12, 2026
@github-actions github-actions Bot added meta:dependabot-security Dependabot update appears security-related and eligible for guarded automation lang:js JavaScript/TypeScript lang:json JSON config/content status:needs-review Awaiting code review priority:normal Default priority type:chore Chore / small hygiene change type:bug Bug or defect meta:needs-changelog Requires a changelog entry before merge labels Aug 12, 2026
@github-actions

Copy link
Copy Markdown
Contributor

❌ Branch Name Validation Failed

The branch name dependabot/npm_and_yarn/multi-8ce6a77369 does not follow the LightSpeed branching strategy.

Required Format

{type}/{scope}-{short-title}
  • type: one of the allowed prefixes (lowercase)
  • scope: lowercase, hyphens only (no underscores or uppercase)
  • title: lowercase, hyphens only (no underscores or uppercase)

Allowed Branch Types

feat, fix, hotfix, release, refactor, chore, docs, test, perf, ci, build, deps, security, revert, research, design, a11y, ux, i18n, ops, proto, ds, api, schema, telemetry, content, seo, config, migrate, qa, uat, audit, codex

Valid Examples

  • feat/branch-naming-enforcement
  • fix/validation-script-bug
  • chore/update-dependencies
  • docs/branching-strategy-guide
  • hotfix/critical-security-patch

Invalid Examples

  • claude/my-branch (type "claude" not allowed)
  • Feature/MyBranch (uppercase not allowed)
  • fix-bug (missing type prefix)
  • feat/my_feature (underscores not allowed)
  • feat/MyFeature (uppercase not allowed)

Solution

Rename your branch to follow the pattern and update the PR.

For more information, see docs/BRANCHING_STRATEGY.md.

@ashleyshaw ashleyshaw self-assigned this Aug 12, 2026
@ashleyshaw
ashleyshaw enabled auto-merge (squash) August 12, 2026 16:42
@github-actions github-actions Bot removed the type:chore Chore / small hygiene change label Aug 12, 2026
ashleyshaw pushed a commit that referenced this pull request Aug 12, 2026
- Add exemption for dependabot[bot] and renovate[bot] PR authors
- Skip validation for branches matching dependabot/* and renovate/* patterns
- Allows automated dependency update PRs to merge without branch naming conflict

This resolves merge blocking on PR #1864 and #1870 (dependabot dependency updates)
ashleyshaw pushed a commit that referenced this pull request Aug 12, 2026
- Add exemption for dependabot[bot] and renovate[bot] PR authors
- Skip validation for branches matching dependabot/* and renovate/* patterns
- Allows automated dependency update PRs to merge without branch naming conflict

This resolves merge blocking on PR #1864 and #1870 (dependabot dependency updates)
ashleyshaw added a commit that referenced this pull request Aug 12, 2026
- Add exemption for dependabot[bot] and renovate[bot] PR authors
- Skip validation for branches matching dependabot/* and renovate/* patterns
- Allows automated dependency update PRs to merge without branch naming conflict

This resolves merge blocking on PR #1864 and #1870 (dependabot dependency updates)

Co-authored-by: Test User <test@test.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:dependencies Composer/npm dependency work lang:js JavaScript/TypeScript lang:json JSON config/content meta:dependabot-security Dependabot update appears security-related and eligible for guarded automation meta:needs-changelog Requires a changelog entry before merge priority:normal Default priority status:needs-review Awaiting code review type:bug Bug or defect

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant