This PR contains the following updates:
🔒 Security Advisories
This PR resolves 2 known vulnerabilities across 1 package.
| Package | Severity | Advisory | Fixed in | Summary |
|---|---|---|---|---|
markdown-it | 🟡 Moderate | GHSA-253c-mchw-3w2r | 15.0.1 | markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds |
markdown-it | 🟡 Moderate | GHSA-6v5v-wf23-fmfq (CVE-2026-48988) | 14.2.0 | markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations |
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| markdown-it (source) | 14.1.1 -> 15.0.3 |
Release Notes
markdown-it/markdown-it (markdown-it)
14.1.1 -> 15.0.3
Markdown-it - modern pluggable markdown parser.
📊 Package Statistics
- markdown-it: 28,802,285 weekly downloads
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Buddy 🤖
{"schemaVersion":1,"updates":[{"name":"markdown-it","current":"14.1.1","target":"15.0.3","type":"major","file":"benchmark/package.json","dependencyType":"dependencies"}],"group":"Security Updates","generatedAt":"2026-10-16T02:29:15.400Z"} -->