[dependabot]

Bumps the security-critical group with 2 updates in the / directory: marked and dompurify.

Updates marked from 18.0.14 to 18.1.1

Release notes

Sourced from marked's releases.

v18.1.1

18.1.1 (2026-10-12)

Bug Fixes

• cli: honor an explicitly empty string input (#4113) (ec3a4e5)
• end blockquote before a lazy line after a heading, hr or html block (#4115) (9e64a6a)
• keep a backslash in a code span from hiding emphasis (#4117) (6a57018)
• keep a decoded character reference from forming a new one (#4111) (6bbac0c), closes #38 #112
• let indented and type 3-5 html blocks interrupt a paragraph (#4124) (eaa1fff)
• make walkTokens linear by appending values in place (#4121) (627d9ae), closes #4120
• match pre, script, style and textarea as whole tag names (#4114) (0db74cb)
• preserve enclosing link state after parsing images (#4123) (cc07bb9)
• respect tab stops in list continuation indentation (#4119) (4bd2528)

Performance Improvements

• avoid repeated raw string copies in nested lists (#4082) (7e8754d)

v18.1.0

18.1.0 (2026-10-05)

Bug Fixes

• avoid cubic backtracking on unicode whitespace in a link destination (#4106) (0d20220)
• load CLI configs with top-level await (#4100) (c61543e)
• reject unbalanced parentheses in link destinations (#4107) (3363c99)

Features

• add linkParenPossible to lexer state to fail fast for link token generation (#4070) (4ee44f7)

Commits

• cdbdc01 chore(release): 18.1.1 [skip ci]
• 2134976 docs: add AGENTS.md (#4125)
• 699a969 chore(deps-dev): bump handlebars from 4.7.9 to 4.7.10 (#4133)
• 6a57018 fix: keep a backslash in a code span from hiding emphasis (#4117)
• eaa1fff fix: let indented and type 3-5 html blocks interrupt a paragraph (#4124)
• 7e8754d perf: avoid repeated raw string copies in nested lists (#4082)
• cc07bb9 fix: preserve enclosing link state after parsing images (#4123)
• 627d9ae fix: make walkTokens linear by appending values in place (#4121)
• 4bd2528 fix: respect tab stops in list continuation indentation (#4119)
• 9e64a6a fix: end blockquote before a lazy line after a heading, hr or html block (#4115)
• Additional commits viewable in compare view

Updates dompurify from 3.4.16 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

• Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
• Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
• Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
• Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
• Added a purify-edge test runner as a compatibility check, thanks @​anzal1
• Clarified the IN_PLACE documentation in the README about possible risks
• Updated several dependencies

Commits

• a77a3e7 release: 3.4.17 (#1672)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions