chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - #215

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-markdown-it-vulnerability
Open

chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]#215
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-markdown-it-vulnerability

Conversation

@renovate

@renovaterenovateBot commented Apr 9, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

PackageChangeAgeConfidence
markdown-it>=14.1.0 → >=14.1.1ageconfidence

markdown-it is has a Regular Expression Denial of Service (ReDoS)

CVE-2026-2327 / GHSA-38c4-r59v-3vqw

More information

Details

Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.

Severity

  • CVSS Score: 5.5 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

markdown-it/markdown-it (markdown-it)

v14.1.1

Compare Source

Security
  • Fixed regression from v13 in linkify inline rule. Specific patterns could
    cause high CPU use. Thanks to @​ltduc147 for report.

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovaterenovateBot added the dependencies Upgrade or downgrade of project dependencies. label Apr 9, 2026
@renovate
renovateBot requested a review from a teamApril 9, 2026 00:34
@renovate
renovateBot requested review from a team and sullivanpj as code ownersApril 9, 2026 00:34
@renovate

renovateBot commented Apr 9, 2026

Copy link
Copy Markdown
ContributorAuthor

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

@renovate
renovateBot enabled auto-merge (squash) April 9, 2026 00:34
@renovaterenovateBot added the dependencies Upgrade or downgrade of project dependencies. label Apr 9, 2026
@deepsource-io

deepsource-ioBot commented Apr 9, 2026•
edited
Loading

Copy link
Copy Markdown

DeepSource Code Review

We reviewed changes in 242a5a8...6603879 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall GradeSecurity

Reliability

Complexity

Hygiene

Code Review Summary

AnalyzerStatusUpdated (UTC)Details
JavaScriptAug 15, 2026 1:53a.m.Review ↗
ShellAug 15, 2026 1:53a.m.Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot closed this Apr 27, 2026
auto-merge was automatically disabled April 27, 2026 17:55

Pull request was closed

@renovate
renovateBot deleted the renovate/npm-markdown-it-vulnerability branch April 27, 2026 17:55
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedchore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Apr 27, 2026
@renovaterenovateBot reopened this Apr 27, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch 3 times, most recently from fb1f18f to 0dabef2CompareApril 29, 2026 09:38
@renovate
renovateBot enabled auto-merge (squash) April 29, 2026 09:38
@socket-security

socket-securityBot commented Apr 29, 2026•
edited
Loading

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch 2 times, most recently from 955e7ec to 0770a6fCompareMay 18, 2026 12:36
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]May 28, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch 2 times, most recently from af398da to 6256de2CompareMay 28, 2026 23:08
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]May 28, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch from 6256de2 to 26e66aaCompareJune 1, 2026 20:16
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 1, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch from 26e66aa to 2251ab9CompareJune 2, 2026 01:57
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jun 2, 2026
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 11, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch from cf90379 to 7dfa5aeCompareJune 19, 2026 00:58
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch from 7dfa5ae to e9331f4CompareJuly 11, 2026 17:08
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 11, 2026
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 11, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch from e9331f4 to 6a4a9f8CompareJuly 11, 2026 23:16
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch from 6a4a9f8 to 57bb2efCompareJuly 18, 2026 04:13
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch 2 times, most recently from 8e66a96 to 0596a2cCompareJuly 20, 2026 21:08
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 20, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch from 0596a2c to 474203cCompareJuly 21, 2026 05:01
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 21, 2026
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 24, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch from 474203c to 7ea7532CompareJuly 24, 2026 22:11
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 25, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch 2 times, most recently from 2462980 to 869c9eaCompareJuly 30, 2026 17:49
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 30, 2026
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 30, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch from 869c9ea to 78928eeCompareJuly 30, 2026 23:13
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch from 78928ee to 183c57cCompareAugust 12, 2026 04:16
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch from 183c57c to 323fe14CompareAugust 12, 2026 10:31
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch from 323fe14 to 49d7527CompareAugust 14, 2026 21:09
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 14, 2026
@renovaterenovateBot changed the title chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 15, 2026
@renovate
renovateBotforce-pushed the renovate/npm-markdown-it-vulnerability branch from 49d7527 to 6603879CompareAugust 15, 2026 01:51
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - #215
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-markdown-it-vulnerability
Open
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]#215
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-markdown-it-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
markdown-it>=14.1.0 → >=14.1.1ageconfidence
markdown-it is has a Regular Expression Denial of Service (ReDoS)
CVE-2026-2327 / GHSA-38c4-r59v-3vqw
More information
Details
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.
Severity
  • CVSS Score: 5.5 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
markdown-it/markdown-it (markdown-it)
v14.1.1
Compare Source
Security
  • Fixed regression from v13 in linkify inline rule. Specific patterns could
    
cause high CPU use. Thanks to @​ltduc147 for report.
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Apr 9, 2026
@renovate
renovateBot
requested a review
from a teamApril 9, 2026 00:34
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersApril 9, 2026 00:34
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
@renovate
renovateBot
enabled auto-merge (squash)
April 9, 2026 00:34
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Apr 9, 2026
@deepsource-io
deepsource-ioBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...6603879 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptAug 15, 2026 1:53a.m.Review ↗
ShellAug 15, 2026 1:53a.m.Review ↗
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-markdown-it-vulnerability

branch
April 27, 2026 17:55
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedchore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
3 times, most recently
from
fb1f18f to
0dabef2CompareApril 29, 2026 09:38
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:38
@socket-security
socket-securityBot
commented
Apr 29, 2026•

edited

Loading

Copy link


Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
955e7ec to
0770a6fCompareMay 18, 2026 12:36
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]May 28, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
af398da to
6256de2CompareMay 28, 2026 23:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]May 28, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
6256de2 to
26e66aaCompareJune 1, 2026 20:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
26e66aa to
2251ab9CompareJune 2, 2026 01:57
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jun 2, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 11, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
cf90379 to
7dfa5aeCompareJune 19, 2026 00:58
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
7dfa5ae to
e9331f4CompareJuly 11, 2026 17:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 11, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 11, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
e9331f4 to
6a4a9f8CompareJuly 11, 2026 23:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
6a4a9f8 to
57bb2efCompareJuly 18, 2026 04:13
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
8e66a96 to
0596a2cCompareJuly 20, 2026 21:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
0596a2c to
474203cCompareJuly 21, 2026 05:01
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 21, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 24, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
474203c to
7ea7532CompareJuly 24, 2026 22:11
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 25, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
2462980 to
869c9eaCompareJuly 30, 2026 17:49
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 30, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
869c9ea to
78928eeCompareJuly 30, 2026 23:13
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
78928ee to
183c57cCompareAugust 12, 2026 04:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
183c57c to
323fe14CompareAugust 12, 2026 10:31
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
323fe14 to
49d7527CompareAugust 14, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 14, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
49d7527 to
6603879CompareAugust 15, 2026 01:51
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - #215
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-markdown-it-vulnerability
Open
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]#215
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-markdown-it-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
markdown-it>=14.1.0 → >=14.1.1ageconfidence
markdown-it is has a Regular Expression Denial of Service (ReDoS)
CVE-2026-2327 / GHSA-38c4-r59v-3vqw
More information
Details
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.
Severity
  • CVSS Score: 5.5 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
markdown-it/markdown-it (markdown-it)
v14.1.1
Compare Source
Security
  • Fixed regression from v13 in linkify inline rule. Specific patterns could
    
cause high CPU use. Thanks to @​ltduc147 for report.
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Apr 9, 2026
@renovate
renovateBot
requested a review
from a teamApril 9, 2026 00:34
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersApril 9, 2026 00:34
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
@renovate
renovateBot
enabled auto-merge (squash)
April 9, 2026 00:34
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Apr 9, 2026
@deepsource-io
deepsource-ioBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...6603879 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptAug 15, 2026 1:53a.m.Review ↗
ShellAug 15, 2026 1:53a.m.Review ↗
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-markdown-it-vulnerability

branch
April 27, 2026 17:55
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedchore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
3 times, most recently
from
fb1f18f to
0dabef2CompareApril 29, 2026 09:38
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:38
@socket-security
socket-securityBot
commented
Apr 29, 2026•

edited

Loading

Copy link


Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
955e7ec to
0770a6fCompareMay 18, 2026 12:36
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]May 28, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
af398da to
6256de2CompareMay 28, 2026 23:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]May 28, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
6256de2 to
26e66aaCompareJune 1, 2026 20:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
26e66aa to
2251ab9CompareJune 2, 2026 01:57
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jun 2, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 11, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
cf90379 to
7dfa5aeCompareJune 19, 2026 00:58
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
7dfa5ae to
e9331f4CompareJuly 11, 2026 17:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 11, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 11, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
e9331f4 to
6a4a9f8CompareJuly 11, 2026 23:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
6a4a9f8 to
57bb2efCompareJuly 18, 2026 04:13
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
8e66a96 to
0596a2cCompareJuly 20, 2026 21:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
0596a2c to
474203cCompareJuly 21, 2026 05:01
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 21, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 24, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
474203c to
7ea7532CompareJuly 24, 2026 22:11
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 25, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
2462980 to
869c9eaCompareJuly 30, 2026 17:49
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 30, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
869c9ea to
78928eeCompareJuly 30, 2026 23:13
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
78928ee to
183c57cCompareAugust 12, 2026 04:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
183c57c to
323fe14CompareAugust 12, 2026 10:31
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
323fe14 to
49d7527CompareAugust 14, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 14, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
49d7527 to
6603879CompareAugust 15, 2026 01:51
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - #215
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-markdown-it-vulnerability
Open
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]#215
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-markdown-it-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
markdown-it>=14.1.0 → >=14.1.1ageconfidence
markdown-it is has a Regular Expression Denial of Service (ReDoS)
CVE-2026-2327 / GHSA-38c4-r59v-3vqw
More information
Details
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.
Severity
  • CVSS Score: 5.5 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
markdown-it/markdown-it (markdown-it)
v14.1.1
Compare Source
Security
  • Fixed regression from v13 in linkify inline rule. Specific patterns could
    
cause high CPU use. Thanks to @​ltduc147 for report.
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Apr 9, 2026
@renovate
renovateBot
requested a review
from a teamApril 9, 2026 00:34
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersApril 9, 2026 00:34
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
@renovate
renovateBot
enabled auto-merge (squash)
April 9, 2026 00:34
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Apr 9, 2026
@deepsource-io
deepsource-ioBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...6603879 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptAug 15, 2026 1:53a.m.Review ↗
ShellAug 15, 2026 1:53a.m.Review ↗
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-markdown-it-vulnerability

branch
April 27, 2026 17:55
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedchore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
3 times, most recently
from
fb1f18f to
0dabef2CompareApril 29, 2026 09:38
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:38
@socket-security
socket-securityBot
commented
Apr 29, 2026•

edited

Loading

Copy link


Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
955e7ec to
0770a6fCompareMay 18, 2026 12:36
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]May 28, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
af398da to
6256de2CompareMay 28, 2026 23:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]May 28, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
6256de2 to
26e66aaCompareJune 1, 2026 20:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
26e66aa to
2251ab9CompareJune 2, 2026 01:57
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jun 2, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 11, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
cf90379 to
7dfa5aeCompareJune 19, 2026 00:58
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
7dfa5ae to
e9331f4CompareJuly 11, 2026 17:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 11, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 11, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
e9331f4 to
6a4a9f8CompareJuly 11, 2026 23:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
6a4a9f8 to
57bb2efCompareJuly 18, 2026 04:13
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
8e66a96 to
0596a2cCompareJuly 20, 2026 21:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
0596a2c to
474203cCompareJuly 21, 2026 05:01
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 21, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 24, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
474203c to
7ea7532CompareJuly 24, 2026 22:11
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 25, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
2462980 to
869c9eaCompareJuly 30, 2026 17:49
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 30, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
869c9ea to
78928eeCompareJuly 30, 2026 23:13
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
78928ee to
183c57cCompareAugust 12, 2026 04:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
183c57c to
323fe14CompareAugust 12, 2026 10:31
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
323fe14 to
49d7527CompareAugust 14, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 14, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
49d7527 to
6603879CompareAugust 15, 2026 01:51
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - #215
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-markdown-it-vulnerability
Open
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]#215
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-markdown-it-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
markdown-it>=14.1.0 → >=14.1.1ageconfidence
markdown-it is has a Regular Expression Denial of Service (ReDoS)
CVE-2026-2327 / GHSA-38c4-r59v-3vqw
More information
Details
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.
Severity
  • CVSS Score: 5.5 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
markdown-it/markdown-it (markdown-it)
v14.1.1
Compare Source
Security
  • Fixed regression from v13 in linkify inline rule. Specific patterns could
    
cause high CPU use. Thanks to @​ltduc147 for report.
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Apr 9, 2026
@renovate
renovateBot
requested a review
from a teamApril 9, 2026 00:34
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersApril 9, 2026 00:34
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
@renovate
renovateBot
enabled auto-merge (squash)
April 9, 2026 00:34
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Apr 9, 2026
@deepsource-io
deepsource-ioBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...6603879 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptAug 15, 2026 1:53a.m.Review ↗
ShellAug 15, 2026 1:53a.m.Review ↗
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-markdown-it-vulnerability

branch
April 27, 2026 17:55
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedchore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
3 times, most recently
from
fb1f18f to
0dabef2CompareApril 29, 2026 09:38
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:38
@socket-security
socket-securityBot
commented
Apr 29, 2026•

edited

Loading

Copy link


Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
955e7ec to
0770a6fCompareMay 18, 2026 12:36
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]May 28, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
af398da to
6256de2CompareMay 28, 2026 23:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]May 28, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
6256de2 to
26e66aaCompareJune 1, 2026 20:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
26e66aa to
2251ab9CompareJune 2, 2026 01:57
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jun 2, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 11, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
cf90379 to
7dfa5aeCompareJune 19, 2026 00:58
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
7dfa5ae to
e9331f4CompareJuly 11, 2026 17:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 11, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 11, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
e9331f4 to
6a4a9f8CompareJuly 11, 2026 23:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
6a4a9f8 to
57bb2efCompareJuly 18, 2026 04:13
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
8e66a96 to
0596a2cCompareJuly 20, 2026 21:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
0596a2c to
474203cCompareJuly 21, 2026 05:01
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 21, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 24, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
474203c to
7ea7532CompareJuly 24, 2026 22:11
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 25, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
2462980 to
869c9eaCompareJuly 30, 2026 17:49
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 30, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
869c9ea to
78928eeCompareJuly 30, 2026 23:13
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
78928ee to
183c57cCompareAugust 12, 2026 04:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
183c57c to
323fe14CompareAugust 12, 2026 10:31
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
323fe14 to
49d7527CompareAugust 14, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 14, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
49d7527 to
6603879CompareAugust 15, 2026 01:51
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - #215
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-markdown-it-vulnerability
Open
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]#215
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-markdown-it-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
markdown-it>=14.1.0 → >=14.1.1ageconfidence
markdown-it is has a Regular Expression Denial of Service (ReDoS)
CVE-2026-2327 / GHSA-38c4-r59v-3vqw
More information
Details
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.
Severity
  • CVSS Score: 5.5 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
markdown-it/markdown-it (markdown-it)
v14.1.1
Compare Source
Security
  • Fixed regression from v13 in linkify inline rule. Specific patterns could
    
cause high CPU use. Thanks to @​ltduc147 for report.
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Apr 9, 2026
@renovate
renovateBot
requested a review
from a teamApril 9, 2026 00:34
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersApril 9, 2026 00:34
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
@renovate
renovateBot
enabled auto-merge (squash)
April 9, 2026 00:34
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Apr 9, 2026
@deepsource-io
deepsource-ioBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...6603879 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptAug 15, 2026 1:53a.m.Review ↗
ShellAug 15, 2026 1:53a.m.Review ↗
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-markdown-it-vulnerability

branch
April 27, 2026 17:55
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedchore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
3 times, most recently
from
fb1f18f to
0dabef2CompareApril 29, 2026 09:38
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:38
@socket-security
socket-securityBot
commented
Apr 29, 2026•

edited

Loading

Copy link


Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
955e7ec to
0770a6fCompareMay 18, 2026 12:36
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]May 28, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
af398da to
6256de2CompareMay 28, 2026 23:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]May 28, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
6256de2 to
26e66aaCompareJune 1, 2026 20:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
26e66aa to
2251ab9CompareJune 2, 2026 01:57
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jun 2, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 11, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
cf90379 to
7dfa5aeCompareJune 19, 2026 00:58
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
7dfa5ae to
e9331f4CompareJuly 11, 2026 17:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 11, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 11, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
e9331f4 to
6a4a9f8CompareJuly 11, 2026 23:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
6a4a9f8 to
57bb2efCompareJuly 18, 2026 04:13
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
8e66a96 to
0596a2cCompareJuly 20, 2026 21:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
0596a2c to
474203cCompareJuly 21, 2026 05:01
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 21, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 24, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
474203c to
7ea7532CompareJuly 24, 2026 22:11
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 25, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
2462980 to
869c9eaCompareJuly 30, 2026 17:49
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 30, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
869c9ea to
78928eeCompareJuly 30, 2026 23:13
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
78928ee to
183c57cCompareAugust 12, 2026 04:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
183c57c to
323fe14CompareAugust 12, 2026 10:31
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
323fe14 to
49d7527CompareAugust 14, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 14, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
49d7527 to
6603879CompareAugust 15, 2026 01:51
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - #215
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-markdown-it-vulnerability
Open
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]#215
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-markdown-it-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
markdown-it>=14.1.0 → >=14.1.1ageconfidence
markdown-it is has a Regular Expression Denial of Service (ReDoS)
CVE-2026-2327 / GHSA-38c4-r59v-3vqw
More information
Details
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.
Severity
  • CVSS Score: 5.5 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
markdown-it/markdown-it (markdown-it)
v14.1.1
Compare Source
Security
  • Fixed regression from v13 in linkify inline rule. Specific patterns could
    
cause high CPU use. Thanks to @​ltduc147 for report.
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Apr 9, 2026
@renovate
renovateBot
requested a review
from a teamApril 9, 2026 00:34
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersApril 9, 2026 00:34
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
@renovate
renovateBot
enabled auto-merge (squash)
April 9, 2026 00:34
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Apr 9, 2026
@deepsource-io
deepsource-ioBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...6603879 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptAug 15, 2026 1:53a.m.Review ↗
ShellAug 15, 2026 1:53a.m.Review ↗
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-markdown-it-vulnerability

branch
April 27, 2026 17:55
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedchore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
3 times, most recently
from
fb1f18f to
0dabef2CompareApril 29, 2026 09:38
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:38
@socket-security
socket-securityBot
commented
Apr 29, 2026•

edited

Loading

Copy link


Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
955e7ec to
0770a6fCompareMay 18, 2026 12:36
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]May 28, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
af398da to
6256de2CompareMay 28, 2026 23:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]May 28, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
6256de2 to
26e66aaCompareJune 1, 2026 20:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
26e66aa to
2251ab9CompareJune 2, 2026 01:57
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jun 2, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 11, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
cf90379 to
7dfa5aeCompareJune 19, 2026 00:58
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
7dfa5ae to
e9331f4CompareJuly 11, 2026 17:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 11, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 11, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
e9331f4 to
6a4a9f8CompareJuly 11, 2026 23:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
6a4a9f8 to
57bb2efCompareJuly 18, 2026 04:13
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
8e66a96 to
0596a2cCompareJuly 20, 2026 21:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
0596a2c to
474203cCompareJuly 21, 2026 05:01
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 21, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 24, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
474203c to
7ea7532CompareJuly 24, 2026 22:11
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 25, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
2462980 to
869c9eaCompareJuly 30, 2026 17:49
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 30, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
869c9ea to
78928eeCompareJuly 30, 2026 23:13
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
78928ee to
183c57cCompareAugust 12, 2026 04:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
183c57c to
323fe14CompareAugust 12, 2026 10:31
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
323fe14 to
49d7527CompareAugust 14, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 14, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
49d7527 to
6603879CompareAugust 15, 2026 01:51
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - #215
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-markdown-it-vulnerability
Open
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]#215
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-markdown-it-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
markdown-it>=14.1.0 → >=14.1.1ageconfidence
markdown-it is has a Regular Expression Denial of Service (ReDoS)
CVE-2026-2327 / GHSA-38c4-r59v-3vqw
More information
Details
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.
Severity
  • CVSS Score: 5.5 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
markdown-it/markdown-it (markdown-it)
v14.1.1
Compare Source
Security
  • Fixed regression from v13 in linkify inline rule. Specific patterns could
    
cause high CPU use. Thanks to @​ltduc147 for report.
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Apr 9, 2026
@renovate
renovateBot
requested a review
from a teamApril 9, 2026 00:34
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersApril 9, 2026 00:34
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
@renovate
renovateBot
enabled auto-merge (squash)
April 9, 2026 00:34
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Apr 9, 2026
@deepsource-io
deepsource-ioBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...6603879 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptAug 15, 2026 1:53a.m.Review ↗
ShellAug 15, 2026 1:53a.m.Review ↗
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-markdown-it-vulnerability

branch
April 27, 2026 17:55
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security] - autoclosedchore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
3 times, most recently
from
fb1f18f to
0dabef2CompareApril 29, 2026 09:38
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:38
@socket-security
socket-securityBot
commented
Apr 29, 2026•

edited

Loading

Copy link


Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
955e7ec to
0770a6fCompareMay 18, 2026 12:36
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]May 28, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
af398da to
6256de2CompareMay 28, 2026 23:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]May 28, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
6256de2 to
26e66aaCompareJune 1, 2026 20:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
26e66aa to
2251ab9CompareJune 2, 2026 01:57
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jun 2, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.2.0 [security]Jun 11, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
cf90379 to
7dfa5aeCompareJune 19, 2026 00:58
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
7dfa5ae to
e9331f4CompareJuly 11, 2026 17:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 11, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 11, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
e9331f4 to
6a4a9f8CompareJuly 11, 2026 23:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
6a4a9f8 to
57bb2efCompareJuly 18, 2026 04:13
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 18, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
8e66a96 to
0596a2cCompareJuly 20, 2026 21:08
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
0596a2c to
474203cCompareJuly 21, 2026 05:01
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 21, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 24, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
474203c to
7ea7532CompareJuly 24, 2026 22:11
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 25, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
2 times, most recently
from
2462980 to
869c9eaCompareJuly 30, 2026 17:49
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Jul 30, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Jul 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
869c9ea to
78928eeCompareJuly 30, 2026 23:13
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
78928ee to
183c57cCompareAugust 12, 2026 04:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
183c57c to
323fe14CompareAugust 12, 2026 10:31
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
323fe14 to
49d7527CompareAugust 14, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]Aug 14, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.3.0 [security]chore(monorepo): update pnpm-workspace.overrides markdown-it to >=14.1.1 [security]Aug 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-markdown-it-vulnerability
branch
from
49d7527 to
6603879CompareAugust 15, 2026 01:51
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants