[dependabot]

Bumps marked from 18.1.0 to 18.1.3.

Release notes

Sourced from marked's releases.

v18.1.3

18.1.3 (2026-11-02)

Bug Fixes

• allow trailing tabs after a setext heading underline (#4152) (1f1b480)
• avoid quadratic scan for unmatched emphasis delimiters (#4103) (eab1e48), closes #4099
• await promise arrays from walkTokens extensions (#4153) (c38704c)
• cli: honor defaults and config when outputting tokens (#4146) (9470e8f)
• collapse internal whitespace when normalizing link labels (#4157) (02c73e8)
• do not allow a blank line inside a link reference definition label (#4165) (f3d21af)
• don't treat an escaped ) or quote as an inline link or title closer (#4151) (9cb84e0)
• end a list item before a lazy line after an html block (#4159) (7ba42f4)
• end blockquote before a lazy line after a table (#4161) (e7dcf52)
• isolate extension names from Object.prototype (#4177) (5cb03bd)
• keep a block quote open after a lazy line in a nested block quote (#4175) (1d7272f)
• only close a code fence with the opening fence character (#4164) (1d4d8fe)
• preserve zero-valued custom renderer results (#4162) (e43ceef)
• recognize task list items when a tab follows the checkbox (#4163) (64a299d)
• start a GFM www autolink only at a word boundary (#4166) (84beefb)

Performance Improvements

• fix backtracking in padantic html (#4173) (2d4a23c)

v18.1.2

18.1.2 (2026-10-26)

Bug Fixes

• allow a tab or end of input after a type 6 html block tag name (#4128) (e09c40d)
• apply emphasis flanking and rules 9-10 to the whole delimiter run (#4145) (5d8e234)
• cli: await config functions before parsing (#4138) (3a11ad1)
• cli: create no-clobber output files atomically (#4135) (e7c4f64)
• do not continue a block quote paragraph from a whitespace-only line (#4134) (42f34a8)
• expand a tab after the block quote marker to the next tab stop (#4110) (2d3899b)
• honor per-call async options when composing hooks (#4139) (379be9d)
• keep a line starting with # but no space in the list item (#4127) (6b63189)
• keep duplicate link definitions in the tokens (#4132) (2784acc)
• keep lazy lines after a list in a nested blockquote (#4137) (38c7e55)
• keep lazy setext underlines in list items as text (#4126) (398234c)
• render nested image alt formatting as plain text (#4131) (15f59bb)
• stop an unclosed inline raw tag from unescaping later blocks (#4130) (4562b6f)

Performance Improvements

... (truncated)

Commits

• ba50aa9 chore(release): 18.1.3 [skip ci]
• ec34be8 chore(deps-dev): bump eslint from 10.13.0 to 10.14.0 (#4182)
• e4c7453 chore(deps-dev): bump recheck from 4.6.1 to 4.6.2 (#4181)
• 1d7272f fix: keep a block quote open after a lazy line in a nested block quote (#4175)
• 2d4a23c perf: fix backtracking in padantic html (#4173)
• 5cb03bd fix: isolate extension names from Object.prototype (#4177)
• f3d21af fix: do not allow a blank line inside a link reference definition label (#4165)
• 1d4d8fe fix: only close a code fence with the opening fence character (#4164)
• 64a299d fix: recognize task list items when a tab follows the checkbox (#4163)
• e43ceef fix: preserve zero-valued custom renderer results (#4162)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)