[ekoneil]

What changed

cargo audit fails on main with
RUSTSEC-2026-0433
(high, 7.5): pulldown-cmark 0.13.5 parses nested image wikilinks in quadratic
time. Stet enables Options::ENABLE_WIKILINKS
(crates/stet-core/src/markdown.rs:256), so a crafted document could stall
the editor when opened.

This updates pulldown-cmark to 0.13.6 with
cargo update -p pulldown-cmark --precise 0.13.6. Only that entry in
Cargo.lock changes; no other crate moves and no dependency is added.

Dependabot's #13 includes the same bump, but it's grouped with 20 other
updates (including objc2 0.6 and jupyter-zmq-client 3) and CI fails there.
This lands the security fix on its own; Dependabot will drop it from the group
when it rebases.

Review of the release

• Published 2026-10-30 by a long-standing maintainer who also published
  0.13.3 through 0.13.5; the crate's owners are unchanged.
• From branch_0.13, two commits after v0.13.5: the fix
  (3288371)
  and the version bump, tagged v0.13.6.
• The library change is one line, self.wikilink_stack.clear();, plus a
  comment and a new test that reproduces the advisory's input. build.rs and
  the dependency list are unchanged from 0.13.5.
• The downloaded .crate matches the checksum in Cargo.lock, and its
  src/parse.rs, build.rs and wikilink tests match the GitHub source at the
  tagged commit byte for byte.

Verification

• cargo fmt --check, cargo clippy --all-targets --all-features -D warnings,
  cargo doc with -D warnings, and cargo test --all-targets --all-features
  (307 passed, 2 ignored, as on main) all pass locally.
• STET_FUZZ=20000 cargo test --release -p stet-core incremental_analysis
  passes.
• cargo audit passes; the six allowed warnings are unchanged.

Checklist

• Tests cover the behavior change (upstream's new wikilink test; stet's suite and fuzz soak unchanged)
• Documentation is updated where needed (no behavior or config change)
• No secrets, private fixtures, or generated artifacts are included
• Formatting, clippy, tests, and docs pass locally

🤖 Generated with Claude Code