[dependabot]

Bumps markdown-it to 14.3.3 and updates ancestor dependency @wordpress/scripts. These dependencies need to be updated together.

Updates markdown-it from 12.3.2 to 14.3.3

Changelog

Sourced from markdown-it's changelog.

[14.3.3] - 2026-10-16

Security

• Backported 15.0.3 fixes.

[14.3.2] - 2026-09-12

Security

• Backported 15.0.2 fixes.

[14.3.1] - 2026-08-27

Security

• Backported 15.0.1 fixes.

[14.3.0] - 2026-07-02

Changed

• Reworked build pipeline & tools.
• Added source maps.
• Bumped linkify-it to 5.0.2.

Fixed

• Preserve backslash-space hard line breaks, matching CommonMark 6.7, #1185.

[14.2.0] - 2026-05-24

Added

• isPunctCharCode to utilities.

Fixed

• Don't end HTML comment blocks on a blank line, #1155.
• Properly recognize astral chars (surrogates) in delimiter scans for emphasis-like markers, #1072. Big thanks to @​tats-u for his global efforts with improving CJK support.
• Preserve unicode whitespaces when trimm headings/paragraphs, #1074.
• More strict entities decode to avoid false positives ;, #1096.
• Restore block parser state on fail in lheading rule, #1131.

Security

• Fixed poor smartquotes perfomance on > 70k quotes in single block
• Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.

[14.1.1] - 2026-01-11

Security

• Fixed regression from v13 in linkify inline rule. Specific patterns could

... (truncated)

Commits

• d372f0d 14.3.3 released
• d99f488 Backported 15.0.3 fixes
• efb9993 14.3.2 released
• daf5a3c Backported 15.0.2 fixes
• a855f10 14.3.1 released
• ad70f6b Backported 15.0.1 fixes
• b407f3b Ignore generated API docs in lint
• bf025ad Prepare package.json for v14 backports
• 2d9bbea fix: recognize lowercase declarations as HTML blocks (CommonMark 4.6) (#1189)
• a311cfb fix: keep literal backslash before space in link destination (CommonMark 6.3)...
• Additional commits viewable in compare view

Updates @wordpress/scripts from 27.9.0 to 37.0.0

Changelog

Sourced from @​wordpress/scripts's changelog.

37.0.0 (2026-10-20)

Breaking Changes

• Update the bundled webpack-dev-server from ^5.2.1 to ^6.0.0 and @pmmmwh/react-refresh-webpack-plugin from ^0.5.11 to ^0.6.3. Custom devServer configs need migrating: SockJS is removed, so drop webSocketServer: 'sockjs' and client.webSocketTransport: 'sockjs' to use the default ws; the proxy bypass option is removed in favor of http-proxy-middleware's context or router; custom middleware runs on Express 5; and getFilenameFromUrl() is now asynchronous. See the webpack-dev-server 6.0.0 release notes (#84674).

Enhancements

• test-e2e and test-playwright: Add a --wp-env-config option for the custom config file that the environment for the tests is started from with wp-env --config, such as .wp-env.test.json. When WP_BASE_URL is not set, the tests run on the port from that file merged with its override file, such as .wp-env.test.override.json, and any WP_ENV_* environment variables (#84654).

Bug Fixes

• test-e2e and test-playwright: When WP_BASE_URL is not set and the wp-env config disables the tests environment with "testsEnvironment": false, run the tests on the port of the development environment instead of falling back to http://localhost:8889, which may belong to another project's environment (#84654).

36.1.0 (2026-10-07)

Enhancements

• lint-js: Allow unit-test titles passed through variables (#83995).

Bug Fixes

• Add the stylelint-scss dependency, a peer of @wordpress/stylelint-config (#83765).
• build, start and lint-pkg-json: Resolve the default browserslist and npm-package-json-lint configs when dependencies are not hoisted to the project root (npm install-strategy=linked, pnpm). lint-pkg-json now defaults to config/npmpackagejsonlint.js; config/npmpackagejsonlint.json stays for projects that reference it (#83902).
• lint-js, lint-style and lint-md-docs: a file passed right after --fix is now treated as a file instead of that flag's value, so only the listed files get processed. Same for --require-pragma in format (#83521).

36.0.0 (2026-09-23)

Breaking Changes

• Switch test-unit-js to consumer-installed Vitest 5 and Vite 7/8 at the 36.0.0 boundary. Run once by default, discover consumer Vitest/Vite config, and use Vitest lint defaults for test/spec files. Keep test-unit-jest as a maintenance-only adapter for consumer-installed Jest, with no scheduled removal. Remove the bundled Jest dependencies, preset config, Babel transformer, and GitHub Actions reporter. Retire the Jest preset and console package source; published versions remain available. Jest projects must install their own dependencies and configure the published preset if needed. See the migration guide. (#82843).

• Require Node.js ^22.22.2 || ^24.15.0 || >=26.0.0 and update the bundled markdownlint-cli from ^0.31.1 to ^0.49.1, which moves markdownlint from 0.25 to 0.41. lint-md-docs now runs the rules added since then (MD051 through MD060) by default, so projects may see new reports. The header rule aliases (for example header-increment) no longer work in configuration files; use the heading names (#81917).

• lint-style: Use stylelint's resolveConfig for config detection instead of a static extension list, supporting all current and future config file formats without manual maintenance overhead. Note that resolveConfig also searches ancestor directories and the global config directory (~/.config/stylelint), so a project with no local config may now pick up an unrelated config found there instead of the bundled default (#79280).

Enhancements

• check-engines: Check only the tools listed in engines, instead of always passing --node and --npm. Without an engines field in the project, it now checks only the Node.js version (#83326).
• lint-md-docs: Detect .markdownlint.jsonc so the bundled default config is not used when one is present (#81917).
• format: Format .cjs and .mjs files when expanding a directory (#82731).
• format: Format .cts and .mts files when expanding a directory (#83071).
• The default ESLint config now lints .jsx, .ts, .tsx, .mts and .cts files, which ESLint's own file discovery skips (#83071).
• build and start: Discover .cjs, .cts and .mts entry points, resolve them from extensionless imports, and transpile .cjs and .cts modules (#83071).
• The bundled wp-prettier dependency has been upgraded from 3.0.3 to 3.9.6 (#82731).

Bug Fixes

• Update the bundled webpack to ^5.111.0, which fixes a code-generation regression in webpack 5.110.3 that can make production bundles fail at startup (#82698).

... (truncated)

Commits

• 8d30f92 chore(release): publish
• e7922b3 Update changelog files
• e4d93b0 Merge changes published in the Gutenberg plugin "release/24.3" branch
• fa4301b Update changelog files
• 5c222d1 Merge changes published in the Gutenberg plugin "release/24.3" branch
• 2555c8d Update changelog files
• 558d1e6 Merge changes published in the Gutenberg plugin "release/24.3" branch
• 12441e2 chore(release): publish
• 36c194f Update changelog files
• 7b99cae Merge changes published in the Gutenberg plugin "release/24.2" branch
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7c5e5479-7b71-4ec2-bfdc-95bc875ea350

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}