[dependabot]

Bumps marked from 9.1.6 to 18.1.1.

Release notes

Sourced from marked's releases.

v18.1.1

18.1.1 (2026-10-12)

Bug Fixes

• cli: honor an explicitly empty string input (#4113) (ec3a4e5)
• end blockquote before a lazy line after a heading, hr or html block (#4115) (9e64a6a)
• keep a backslash in a code span from hiding emphasis (#4117) (6a57018)
• keep a decoded character reference from forming a new one (#4111) (6bbac0c), closes #38 #112
• let indented and type 3-5 html blocks interrupt a paragraph (#4124) (eaa1fff)
• make walkTokens linear by appending values in place (#4121) (627d9ae), closes #4120
• match pre, script, style and textarea as whole tag names (#4114) (0db74cb)
• preserve enclosing link state after parsing images (#4123) (cc07bb9)
• respect tab stops in list continuation indentation (#4119) (4bd2528)

Performance Improvements

• avoid repeated raw string copies in nested lists (#4082) (7e8754d)

v18.1.0

18.1.0 (2026-10-05)

Bug Fixes

• avoid cubic backtracking on unicode whitespace in a link destination (#4106) (0d20220)
• load CLI configs with top-level await (#4100) (c61543e)
• reject unbalanced parentheses in link destinations (#4107) (3363c99)

Features

• add linkParenPossible to lexer state to fail fast for link token generation (#4070) (4ee44f7)

v18.0.14

18.0.14 (2026-09-22)

Bug Fixes

• allow indented lines in setext heading text (#4095) (7d05530)
• decode numeric character references in text (#4076) (cead8de)
• keep text after empty nested blockquote (#4101) (1b89557), closes #4098
• preserve internal tabs in list item content (#4086) (e136da7)
• strip whitespace when normalizing link reference labels (#4091) (c7ee43a)
• support GFM protocol autolinks (#4067) (7f7a496)

v18.0.13

... (truncated)

Commits

• cdbdc01 chore(release): 18.1.1 [skip ci]
• 2134976 docs: add AGENTS.md (#4125)
• 699a969 chore(deps-dev): bump handlebars from 4.7.9 to 4.7.10 (#4133)
• 6a57018 fix: keep a backslash in a code span from hiding emphasis (#4117)
• eaa1fff fix: let indented and type 3-5 html blocks interrupt a paragraph (#4124)
• 7e8754d perf: avoid repeated raw string copies in nested lists (#4082)
• cc07bb9 fix: preserve enclosing link state after parsing images (#4123)
• 627d9ae fix: make walkTokens linear by appending values in place (#4121)
• 4bd2528 fix: respect tab stops in list continuation indentation (#4119)
• 9e64a6a fix: end blockquote before a lazy line after a heading, hr or html block (#4115)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for marked since your current version.

[hansi-codes]

🟡 Tier B · Needs changes before merging

A clean npm ci now fails because the lockfile omits Nitro's lru-cache peer entry, and the open renderer finding remains unfixed.

This PR upgrades the site's Marked dependency from 9.1.6 to 18.1.1. It updates the npm lockfile and removes Nitro's nested lru-cache lock entry.

Verdict	New comments	Fixed	Still open
🛑 Changes requested	1	0	1

	Finding	Where
🟠	Restore Nitro's optional lru-cache lock entry	package-lock.json:1962

Fix with agent prompt

### Issue 1
package-lock.json:1962
**Restore Nitro's optional lru-cache lock entry**

A clean `npm ci` fails with `Missing: lru-cache@11.5.3 from lock file`: Nitro still declares `lru-cache` as an optional peer, but this update removes `node_modules/nitro/node_modules/lru-cache` from the lockfile. This makes the CI install step fail before the build can run.

### Issue 2
package.json:19
**Update the image renderer for Marked's token API**

Marked 18 passes an image token object to custom renderer callbacks rather than the old positional `(href, title, text)` arguments. The unchanged handler in `src/app/projects.$projectId.tsx` therefore fails its URL check and returns `undefined`, so Markdown images in project descriptions no longer render correctly.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

📂 Walkthrough · 2

File	Change
package.json	Bumps the Marked dependency to ^18.1.1.
package-lock.json	Locks Marked to 18.1.1 and removes Nitro's nested lru-cache entry.

⏳ Still open from earlier reviews · 1

• 🟡 Update the image renderer for Marked's token API · package.json:19

---

_{Reviewed 5ce9b1e · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🔵 Tier A · See the inline comments. Summary

[hansi-codes]

Update the image renderer for Marked's token API

Marked 18 passes an image token object to custom renderer callbacks rather than the old positional (href, title, text) arguments. The unchanged handler in src/app/projects.$projectId.tsx therefore fails its URL check and returns undefined, so Markdown images in project descriptions no longer render correctly.

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 19

Comment:
**Update the image renderer for Marked's token API**

Marked 18 passes an image token object to custom renderer callbacks rather than the old positional `(href, title, text)` arguments. The unchanged handler in `src/app/projects.$projectId.tsx` therefore fails its URL check and returns `undefined`, so Markdown images in project descriptions no longer render correctly.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{🟡 Minor · bug · Reply if this doesn't apply.}

[hansi-codes]

🟡 Tier B · 1 blocking finding to address. Summary

[hansi-codes]

Restore Nitro's optional lru-cache lock entry

A clean npm ci fails with Missing: lru-cache@11.5.3 from lock file: Nitro still declares lru-cache as an optional peer, but this update removes node_modules/nitro/node_modules/lru-cache from the lockfile. This makes the CI install step fail before the build can run.

Prompt To Fix With AI

This is a comment left during a code review.
Path: package-lock.json
Line: 1962

Comment:
**Restore Nitro's optional lru-cache lock entry**

A clean `npm ci` fails with `Missing: lru-cache@11.5.3 from lock file`: Nitro still declares `lru-cache` as an optional peer, but this update removes `node_modules/nitro/node_modules/lru-cache` from the lockfile. This makes the CI install step fail before the build can run.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{🟠 Major · bug · Reply if this doesn't apply.}