[dependabot]

Bumps markdown-it-py from 4.2.0 to 4.3.0.

Release notes

Sourced from markdown-it-py's releases.

v4.3.0

This release fixes two quadratic-time parsing paths that let crafted input stall rendering for minutes (security), aligns several parsing rules with CommonMark 0.31.2 and markdown-it 15.0.x, turns parser rules that never advance into a RuntimeError instead of an infinite loop, makes rendering linear on PyPy and free-threaded CPython, and adds support for Python 3.14. Python 3.10 is still supported. If you write plugins or render rules, or edit SyntaxTreeNode trees, please read the upgrade notes at the end.

🔒 Security

• 👌 Fix quadratic-time inline parsing of long runs of characters that start an inline rule without completing one (such as &, <, ~ or incomplete entities), which let a few hundred kilobytes of input stall rendering for seconds to minutes, in #423, thanks to @​hdimer (#411)
• 👌 Reject unterminated inline HTML (<!--, <?, <![CDATA[, <!X) in constant time when html is enabled (as in the default commonmark preset), instead of rescanning to the end of the input for every opener, in #428

✨ New

• ✨ Add --enable-tables to the CLI for file, standard input and interactive parsing in #425, thanks to @​user01010111 (#422); requested by @​hartwork in #352
• ⬆️ Add support for Python 3.14 in #462

👌 Improved

• 👌 Raise RuntimeError instead of looping forever when a block or inline rule reports a match without advancing (or moves backwards), or when no block rule matches a line, as markdown-it does, in #444, thanks to @​rupayon123, @​hukkin (#336) and @​inchang-ing (#443); requested by @​acaprino in #441
• 👌 Fix quadratic-time HTML rendering on PyPy, GraalPy and free-threaded CPython by joining the rendered fragments once, in #458, thanks to @​DicksonWu654
• 👌 Make StateBase.src a plain attribute, for about 4–11% faster parsing on CPython, in #450, thanks to @​deadstrobe5
• 👌 Build block line markers with one scan per line instead of one step per character in #449, thanks to @​John-Cusack
• 👌 Name the Windows end-of-input keys (Ctrl-Z then Enter) in the CLI's interactive prompt and -h text in #463

🐛 Fixed

• 🐛 Fix HTML blocks of types 1–5 (comments, processing instructions, declarations, CDATA, script/pre/style/textarea) ending at a blank line inside a list item or blockquote, porting markdown-it 14.2.0, in #406, thanks to @​binggao1230; reported by @​Jayman2000 in #377
• 🐛 Fix HTML block starts per CommonMark 0.31.2: lowercase declarations such as <!doctype html> start a block and interrupt a paragraph, and tag names match case-insensitively in ASCII only, in #440, thanks to @​rupayon123; reported by @​p5ych0 in #437
• 🐛 Fix code spans rendered as literal backticks after an unclosed link or image label, and count only U+0020 spaces (not tabs or no-break spaces) when deciding whether to strip a code span's padding, porting markdown-it 15.0.1, in #439, thanks to @​SparkUiX; reported by @​felzab in #438
• 🐛 Trim and split with the CommonMark whitespace set instead of Python's, so U+001C–U+001F and U+0085 are no longer dropped from paragraphs, headings, table cells and fence info strings, and distinct reference labels no longer match each other, in #433, thanks to @​Nexory (#418)
• 🐛 Preserve IPv6 host brackets (e.g. http://[::1]:8000/) in normalized link and image URLs, porting markdown-it 15.0.1, in #459, thanks to @​Jinyong-Li
• 🐛 Fix task-list detection consuming a literal [ ]/[x] at the start of an indented code block in a list item in #451, thanks to @​AryanRG
• 🐛 Fix an IndexError in the html_block and heading rules at the end of the input (a table in a blockquote that ends on >) in #416, thanks to @​saket3395; reported by @​WilcoPancras in #415
• 🐛 Keep backslash escapes and entities in image alt text (![a \* b](https://github.com/executablebooks/markdown-it-py/blob/HEAD/u) gives alt="a * b"), porting markdown-it 15.0.0, in #446, thanks to @​gyanu2507; reported by @​kdeldycke in #445
• 🐛 Keep code span text in image alt text, porting markdown-it 15.0.0, in #460, thanks to @​jayhemnani9910
• 🐛 Keep hard breaks and inline HTML in image alt text in #409, thanks to @​chuenchen309
• 🐛 Keep edits to the children of inline and image nodes in SyntaxTreeNode.to_tokens() in #453, thanks to @​KennyMcSimpson; edited tokens are copied, so the token stream the tree was built from is left unchanged (#464)
• 🐛 Fix rule chains staying stale after Ruler.enable, disable or enableOnly raised on an unknown rule name in #457, thanks to @​IlyaKhalafi; reported in #456
• 🐛 Fix MarkdownIt.enable() and disable() applying a generator of rule names only to the core chain in #447, thanks to @​muneikh
• 🐛 Fix the CLI's interactive mode joining input lines with an extra newline, which split every line into its own paragraph and broke hard line breaks, in #425; reported by @​jamesquilty in #172
• 🐛 CLI helpers create a default parser only when none is given in #455, thanks to @​Quinnod345

📚 Documentation

• 📚 Add a "Third-party renderers" section (mdformat, mdit_plain, MyST-Parser) and document RendererProtocol for writing your own renderer, in #463
• 📚 Document that MarkdownIt passes itself to renderer_cls, unlike markdown-it's renderer constructor, in #421, thanks to @​user01010111
• 📚 Clarify that the name given to add_render_rule must match a token type in #432, thanks to @​hikmetba-bit
• 📚 Fix typos and use HTTPS for the CommonMark spec links in #402, #407 and #408, thanks to @​nikolas, @​maxtaran2010 and @​deeferentleeg

... (truncated)

Changelog

Sourced from markdown-it-py's changelog.

4.3.0 - 2026-11-10

This release fixes two quadratic-time parsing paths that let crafted input stall rendering for minutes (security), aligns several parsing rules with CommonMark 0.31.2 and markdown-it 15.0.x, turns parser rules that never advance into a RuntimeError instead of an infinite loop, makes rendering linear on PyPy and free-threaded CPython, and adds support for Python 3.14. Python 3.10 is still supported. If you write plugins or render rules, or edit SyntaxTreeNode trees, please read the upgrade notes at the end.

🔒 Security

• 👌 Fix quadratic-time inline parsing of long runs of characters that start an inline rule without completing one (such as &, <, ~ or incomplete entities), which let a few hundred kilobytes of input stall rendering for seconds to minutes, in #423, thanks to @​hdimer (#411)
• 👌 Reject unterminated inline HTML (<!--, <?, <![CDATA[, <!X) in constant time when html is enabled (as in the default commonmark preset), instead of rescanning to the end of the input for every opener, in #428

✨ New

• ✨ Add --enable-tables to the CLI for file, standard input and interactive parsing in #425, thanks to @​user01010111 (#422); requested by @​hartwork in #352
• ⬆️ Add support for Python 3.14 in #462

👌 Improved

• 👌 Raise RuntimeError instead of looping forever when a block or inline rule reports a match without advancing (or moves backwards), or when no block rule matches a line, as markdown-it does, in #444, thanks to @​rupayon123, @​hukkin (#336) and @​inchang-ing (#443); requested by @​acaprino in #441
• 👌 Fix quadratic-time HTML rendering on PyPy, GraalPy and free-threaded CPython by joining the rendered fragments once, in #458, thanks to @​DicksonWu654
• 👌 Make StateBase.src a plain attribute, for about 4–11% faster parsing on CPython, in #450, thanks to @​deadstrobe5
• 👌 Build block line markers with one scan per line instead of one step per character in #449, thanks to @​John-Cusack
• 👌 Name the Windows end-of-input keys (Ctrl-Z then Enter) in the CLI's interactive prompt and -h text in #463

🐛 Fixed

• 🐛 Fix HTML blocks of types 1–5 (comments, processing instructions, declarations, CDATA, script/pre/style/textarea) ending at a blank line inside a list item or blockquote, porting markdown-it 14.2.0, in #406, thanks to @​binggao1230; reported by @​Jayman2000 in #377
• 🐛 Fix HTML block starts per CommonMark 0.31.2: lowercase declarations such as <!doctype html> start a block and interrupt a paragraph, and tag names match case-insensitively in ASCII only, in #440, thanks to @​rupayon123; reported by @​p5ych0 in #437
• 🐛 Fix code spans rendered as literal backticks after an unclosed link or image label, and count only U+0020 spaces (not tabs or no-break spaces) when deciding whether to strip a code span's padding, porting markdown-it 15.0.1, in #439, thanks to @​SparkUiX; reported by @​felzab in #438
• 🐛 Trim and split with the CommonMark whitespace set instead of Python's, so U+001C–U+001F and U+0085 are no longer dropped from paragraphs, headings, table cells and fence info strings, and distinct reference labels no longer match each other, in #433, thanks to @​Nexory (#418)
• 🐛 Preserve IPv6 host brackets (e.g. http://[::1]:8000/) in normalized link and image URLs, porting markdown-it 15.0.1, in #459, thanks to @​Jinyong-Li
• 🐛 Fix task-list detection consuming a literal [ ]/[x] at the start of an indented code block in a list item in #451, thanks to @​AryanRG
• 🐛 Fix an IndexError in the html_block and heading rules at the end of the input (a table in a blockquote that ends on >) in #416, thanks to @​saket3395; reported by @​WilcoPancras in #415
• 🐛 Keep backslash escapes and entities in image alt text (![a \* b](https://github.com/executablebooks/markdown-it-py/blob/master/u) gives alt="a * b"), porting markdown-it 15.0.0, in #446, thanks to @​gyanu2507; reported by @​kdeldycke in #445
• 🐛 Keep code span text in image alt text, porting markdown-it 15.0.0, in #460, thanks to @​jayhemnani9910
• 🐛 Keep hard breaks and inline HTML in image alt text in #409, thanks to @​chuenchen309
• 🐛 Keep edits to the children of inline and image nodes in SyntaxTreeNode.to_tokens() in #453, thanks to @​KennyMcSimpson; edited tokens are copied, so the token stream the tree was built from is left unchanged (#464)
• 🐛 Fix rule chains staying stale after Ruler.enable, disable or enableOnly raised on an unknown rule name in #457, thanks to @​IlyaKhalafi; reported in #456
• 🐛 Fix MarkdownIt.enable() and disable() applying a generator of rule names only to the core chain in #447, thanks to @​muneikh
• 🐛 Fix the CLI's interactive mode joining input lines with an extra newline, which split every line into its own paragraph and broke hard line breaks, in #425; reported by @​jamesquilty in #172
• 🐛 CLI helpers create a default parser only when none is given in #455, thanks to @​Quinnod345

📚 Documentation

• 📚 Add a "Third-party renderers" section (mdformat, mdit_plain, MyST-Parser) and document RendererProtocol for writing your own renderer, in #463
• 📚 Document that MarkdownIt passes itself to renderer_cls, unlike markdown-it's renderer constructor, in #421, thanks to @​user01010111
• 📚 Clarify that the name given to add_render_rule must match a token type in #432, thanks to @​hikmetba-bit

... (truncated)

Commits

• d504583 🚀 RELEASE: v4.3.0 (#466)
• 9aa1aae 👌 Fix quadratic-time rendering on PyPy and other interpreters (#458)
• 17b7227 👌 Copy edited tokens in SyntaxTreeNode.to_tokens instead of writing in place ...
• 2542e66 🐛 Fix HTML block start conditions per CommonMark 0.31.2 (#440)
• cb36d3a 🐛 FIX: HTML block types 1–5 ending at a blank line inside a container (#406)
• f5af61f 🐛 FIX: Preserve code spans after unclosed link and image labels (#439)
• 1c70dce 👌 Make StateBase.src a plain attribute (#450)
• 2787da1 🐛 Keep code span text in image alt text (#460)
• 01d077a 🐛 FIX: Keep literal task markers in indented code blocks in list items (#451)
• 2fcca3a 🐛 Keep backslash escapes and entities in image alt text (#446)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

Deployment failed for project tinlyt-web with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/lloydcoders-projects?upgradeToPro=build-rate-limit

[vercel]

Deployment failed for project tinlyt-web with the following error:

Resource is limited - try again in 1 day (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/lloydcoders-projects?upgradeToPro=build-rate-limit