chore(deps): bump marked from 15.0.12 to 18.0.7

[dependabot]

Bumps marked from 15.0.12 to 18.0.7.

Release notes

Sourced from marked's releases.

v18.0.7

18.0.7 (2026-07-21)

Bug Fixes

• Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexes (#4014) (f945fc5), closes #3991
• Avoid O(n^2) masked source rebuild in inline tokenizer (#4017) (9154f8f)
• keep empty list after blockquote as a sibling block (#4004) (3f144a0)
• preserve code spans adjacent to tildes (#4012) (0de7188)
• Recognize setext headings whose first line starts with # (#4015) (f056437), closes #1
• treat a line of only tabs as a blank line between paragraphs (#4007) (bc2f121)

v18.0.6

18.0.6 (2026-07-09)

Bug Fixes

• Avoid O(n^2) backtracking in inline link href regex (#4013) (a009808)
• Fix ordered lists after blockquotes (#4003) (33928d0)
• keep trailing text on HTML block close line for PI, declarations, and CDATA (#3991) (bbb84c8)

v18.0.5

18.0.5 (2026-06-04)

Bug Fixes

• parse empty list item with trailing space (#3984) (b55410f)

v18.0.4

18.0.4 (2026-05-19)

Bug Fixes

• cache list indentation regexes (#3969) (a37983f)
• fix cli not reading stdin (#3967) (11adb69)

v18.0.3

18.0.3 (2026-05-01)

Bug Fixes

• avoid task checkbox for setext heading text (#3960) (2608e81)

v18.0.2

18.0.2 (2026-04-18)

... (truncated)

Commits

• a8971a1 chore(release): 18.0.7 [skip ci]
• d899c2e chore(deps): bump actions/setup-node from 6 to 7 (#4025)
• 7fbf82e chore(deps-dev): bump semantic-release from 25.0.7 to 25.0.8 (#4026)
• 738edf2 chore(deps-dev): bump brace-expansion from 5.0.2 to 5.0.6 (#4027)
• 9154f8f fix: Avoid O(n^2) masked source rebuild in inline tokenizer (#4017)
• f945fc5 fix: Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexe...
• 3f144a0 fix: keep empty list after blockquote as a sibling block (#4004)
• 0de7188 fix: preserve code spans adjacent to tildes (#4012)
• f056437 fix: Recognize setext headings whose first line starts with # (#4015)
• 12bfa94 chore(deps-dev): bump semantic-release from 25.0.5 to 25.0.7 (#4020)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for marked since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[zjshen14]

CI is failing on Typecheck, Lint, Test. This is a 3-major-version jump (15.0.12 → 18.0.7) and the failure is expected — marked v16–v18 introduced breaking changes to the renderer API.

What to check in src/cli/renderer.ts:

marked v16 removed the Renderer constructor override pattern in favour of a use({ renderer: { ... } }) extension model. If renderer.ts constructs a subclass or overrides renderer methods directly, that code will need to be migrated to the marked.use() API. Specifically:

• new marked.Renderer() → still works but method signatures changed
• marked.setOptions({ renderer }) → replaced by marked.use({ renderer })
• Inline HTML rendering and code-block hooks have new option shapes

Node engine: The engine requirement moved from >= 18 to >= 20, which is fine — this project already requires Node 20+.

Recommendation: Review the marked v16 migration guide and update src/cli/renderer.ts to use the marked.use() extension API. Once CI is green this can merge.

---

Generated by Claude Code