chore(deps): bump markdown-it from 14.3.0 to 15.0.0

[dependabot]

Bumps markdown-it from 14.3.0 to 15.0.0.

Changelog

Sourced from markdown-it's changelog.

[15.0.0] - 2026-07-30

Added

• Exposed parser internals classes as static properties on markdownit.
• Bundled TypeScript declarations. Remove @types/markdown-it if you used it.
• Added the markdown-it/browser export with bundled ESM and UMD builds.
• Added colored CLI help on supported terminals via argparse 3.
• Added reference labels to link/image tokens, #938.
• Added reference_definition tokens. They remain stripped by default for backwards compatibility, #1055. Also adjusted the line-break heuristic to keep output exactly the same.

Changed

• [breaking] linkify-it => v6
  • No fuzzy links by default.
  • No auth part check by default.
  • Unicode punctuation terminates the link by default (should help with CJK).
  • See linkify-it changelog for other changes.
• Package root now resolves to prebuilt ESM and CJS files instead of raw sources. Distribution files were reorganized under dist/ and dist/browser/.
• Migrated to Typescript.
• entities => v8. Can be rolled back to v7 if compatibility issues happen.
• Moved validateLink, normalizeLink and normalizeLinkText from properties to prototype methods.
• Reworked issue templates and contribution guidelines.

Removed

• [breaking] Removed package-internal subpath exports (markdown-it/lib/* and similar). Use the static classes exposed on markdownit instead.
• [breaking] Removed obsolete StateBlock#ddIndent, #1139. Update markdown-it-deflist to keep it working.

Fixed

• Preserve a literal backslash before a terminating space in link destinations, matching CommonMark 6.3, #1188.
• Recognize lowercase declarations as HTML blocks, matching CommonMark 4.6, #1189.
• Require semicolons for named entities in all decoding paths, completing the fix for #1096.
• Enhanced the text_join rule to process image alt text.
• Include inline code content in image alt text, #1142.

Commits

• 157b33b 15..0.0 released
• f73cb76 doc: rename files
• 3bc8e2d Add TS types
• 2620dce Update contribution guidelines and issue templates
• 7d365fe doc: migration info
• 5c9b7ce Update changelog
• 5a996d5 doc: fix @example tags display
• f5083f4 doc: continue restructuring & theme fixing
• 54289c4 Show inline code content in image alt tag #1142
• 974e2d7 text_join rule fix: process image alt content too (fixes lost escapes and...
• Additional commits viewable in compare view

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6cdf939a1b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Migrate markdown-it deep type imports before bumping

When installing this dependency set and running npm run typecheck/npm run build, the project still imports StateBlock, StateInline, and Token from markdown-it/lib/... in src/components/markdown-runtime.ts, but markdown-it 15 no longer exposes those internal subpaths and only publishes the bundled dist/root exports. With moduleResolution: "Bundler", those type-only deep imports become unresolved, so this version bump blocks the build unless the imports are moved to the public root exports (or the package stays on v14 until that migration is done).

Useful? React with 👍 / 👎.

[helebest]

Automated dependency review — markdown-it 14.3.0 → 15.0.0 ⚠️ Not merging

Step 1 — Code review

This is a major version bump with breaking changes that are not source-compatible with this repo as-is.

markdown-it 15 bundles its own TypeScript declarations (changelog: "Bundled TypeScript declarations. Remove @types/markdown-it if you used it.") and was migrated to TypeScript. The repo still depends on @types/markdown-it, and the two declaration sets conflict — MarkdownIt is now exported as a value/class rather than a namespace usable as a type, and the plugin/rule callback parameters lose their inferred types.

Step 2 — Regression verification: FAILED ❌

The required Verify job fails at tsc --noEmit with ~40 errors in src/components/markdown-runtime.ts, e.g.:

src/components/markdown-runtime.ts(76,31): error TS2749: 'MarkdownIt' refers to a value, but is being used as a type here. Did you mean 'typeof MarkdownIt'?
src/components/markdown-runtime.ts(77,51): error TS7006: Parameter 'state' implicitly has an 'any' type.
... (repeated for plugin/rule callbacks through line 354)

This is a genuine regression introduced by the bump, not an environmental/flake issue.

Step 3/4 — Decision

Per the fail-fast policy, stopping — not merging. Landing markdown-it 15 requires a code change (drop @types/markdown-it, adapt markdown-runtime.ts to the bundled types — typeof MarkdownIt for the type positions and explicit parameter types on the rule/renderer callbacks) and a re-run of the full reader test suite, which is out of scope for an automated dependency merge. Leaving this PR open for a maintainer to take on as a dedicated change. If markdown-it 15 isn't wanted soon, ·@·d·ependabot i·gnore t·his major version will stop the reminders.

---

Generated by Claude Code

[helebest]

Dependabot PR review — blocked by a breaking change ⛔ (not merged)

Step 1 — Code review
markdown-it 14.3.0 → 15.0.0 is a major upgrade. Beyond the version bump in package.json/package-lock.json, v15 changes the package's TypeScript type surface (the MarkdownIt export is no longer usable as a type, and plugin/renderer callback params are no longer implicitly typed), which the app's src/components/markdown-runtime.ts relies on.

Step 2 — Regression verification — FAILED
The CI Verify job fails at tsc --noEmit (this run is against current main, so it is a real break, not a stale base). Representative errors:

src/components/markdown-runtime.ts(76,31): error TS2749: 'MarkdownIt' refers to a value, but is being used as a type here. Did you mean 'typeof MarkdownIt'?
src/components/markdown-runtime.ts(77,51): error TS7006: Parameter 'state' implicitly has an 'any' type.
… (~40 TS2749 / TS7006 errors across markdown-runtime.ts)

Decision (fail-fast): Not merging. This upgrade requires source-code changes to adapt markdown-runtime.ts (and any other markdown-it consumers) to v15's typings — a code change that needs its own review and its own passing Verify, not a clean dependency merge. Per the project's TDD/verify gate, the fix must be in the code, not by weakening typecheck. Leaving this PR open for a maintainer to adapt the call sites (or for Dependabot to be superseded by a dedicated migration PR).

---

Generated by Claude Code

[helebest]

Automated dependency review — markdown-it 14.3.0 → 15.0.0 (major)

Step 1 · Code review — ⛔ blocking issue found
This is a major version bump with a breaking change to markdown-it's TypeScript typings, and the app's src/components/markdown-runtime.ts does not compile against v15.

Step 2 · Regression verification — ❌ FAILED
CI Verify fails at the tsc --noEmit typecheck step (head 6cdf939), with ~40 errors, e.g.:

src/components/markdown-runtime.ts(76,31): error TS2749: 'MarkdownIt' refers to a value,
    but is being used as a type here. Did you mean 'typeof MarkdownIt'?
src/components/markdown-runtime.ts(77,51): error TS7006: Parameter 'state' implicitly has an 'any' type.
... (repeated across the plugin/rule callbacks)

Root cause: markdown-it 15 changed how its default export is typed — MarkdownIt is now only a value, so the existing MarkdownIt-as-a-type annotations no longer resolve, and the previously-inferred callback parameter types collapse to implicit any (rejected under strict). The Container scan (trivy) failure is a downstream consequence of the same break (the Docker image runs npm run build, which runs the same typecheck).

Decision — not merging. Per fail-fast, this PR cannot be squash-merged as-is. It requires accompanying source changes to src/components/markdown-runtime.ts (and likely a matching @types/markdown-it bump — currently pinned at ^14.1.2) to adapt to the v15 typings before the bump can land. Recommend handling as a dedicated code change rather than an unattended dependency auto-merge.

(Note: the Dependency audit red is a pre-existing/environmental advisory in the transitive googleapis/@google-cloud tree, unrelated to this bump.)

---

Generated by Claude Code

[helebest]

Automated Dependabot review — markdown-it 14.3.0 → 15.0.0

1. Code review. This is a major release whose breaking changes affect this codebase directly:

• Removes the package-internal subpath exports (markdown-it/lib/*). src/components/markdown-runtime.ts imports types from exactly those paths (markdown-it/lib/rules_block/state_block.mjs, .../rules_inline/state_inline.mjs, markdown-it/lib/token.mjs).
• Ships bundled TypeScript declarations (so @types/markdown-it should be removed) and changes the exported type shape — MarkdownIt is now a value rather than a type.

2. Regression verification (CI Verify job). ❌ Failed at the tsc typecheck, e.g.:

src/components/markdown-runtime.ts(169,36): error TS2749: 'MarkdownIt' refers to a value, but is being used as a type here. Did you mean 'typeof MarkdownIt'?
src/components/markdown-runtime.ts(140,39): error TS7006: Parameter 'tokens' implicitly has an 'any' type.

(~30 further TS7006 implicit-any errors where the renderer-rule callbacks lost their parameter types.) Gate integrity, CodeQL, and gitleaks pass; trivy / Dependency audit are pre-existing main failures.

3. Decision. ⛔ Not merging. markdown-it 15 requires a source migration that Dependabot cannot generate: replace the markdown-it/lib/* type imports with the static classes now exposed on the default export, remove @types/markdown-it, and re-type the affected renderer rules. This should land as a dedicated, maintainer-authored PR.

---

Generated by Claude Code

[helebest]

Automated review — ❌ blocked at regression verification (fail-fast)

Step 1 · Code review — The diff bumps markdown-it 14.3.0 → 15.0.0 (a major) in package.json + package-lock.json, pulling its transitive deps forward (entities 4→8, linkify-it 5→6, uc.micro 2→3, argparse 2→3, mdurl 2.0→2.1). No source or @types/markdown-it changes are included.

Step 2 · Regression verification — FAILED. A fresh Verify run (2026-08-15, on top of current main) fails at the typecheck step, in src/components/markdown-runtime.ts:

error TS2749: 'MarkdownIt' refers to a value, but is being used as a type here. Did you mean 'typeof MarkdownIt'?   (×3: lines 169, 253, 337)
error TS7006: Parameter 'tokens'/'idx'/'options'/'env'/'self' implicitly has an 'any' type   (~30 occurrences: lines 140, 170, 333–354)

Root cause: markdown-it 15 ships its own bundled type definitions, which supersede the separately-installed @types/markdown-it@14.1.2 still pinned in devDependencies. In the new types, the default export MarkdownIt is a value-only class (v14's @types exposed it as a merged namespace+value usable as a type), and the renderer-rule callback signatures are no longer inferred — so markdown-runtime.ts, which annotates instances as : MarkdownIt and relies on inferred (tokens, idx, options, env, self) parameter types on md.renderer.rules.*, no longer typechecks.

This is a real, breaking API/type change, so it cannot land as a bare version bump.

Decision: Per fail-fast, processing stops here and this PR is not merged.

Recommended remediation (a small source migration, not a lockfile-only change):

1. Reconcile the types — with v15's bundled .d.ts, the standalone @types/markdown-it is likely redundant and mismatched; remove it (or bump it to a v15-compatible line if one exists).
2. In src/components/markdown-runtime.ts, use the v15 type surface — e.g. type instances via InstanceType<typeof MarkdownIt> (or the bundled MarkdownIt type export) instead of : MarkdownIt, and give the renderer-rule callbacks explicit parameter types (the bundled Renderer.RenderRule signature) so the implicit-any errors clear.
3. Re-run npm run typecheck + the MarkdownView unit tests + markdown e2e before merging.

Given it needs code changes and re-review, it's best handled as a dedicated follow-up rather than an auto-merge.

The Dependency audit / Container scan (trivy) jobs are red on the pre-existing main baseline and are unrelated to this finding. Gate integrity, gitleaks, and CodeQL are green.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — markdown-it 14.3.0 → 15.0.0 — ❌ blocked

1. Code review

Major version bump (14 → 15). markdown-it is central to the Markdown reader (src/components/markdown-runtime.ts, MarkdownView, bilingual view). Notably, the companion type package @types/markdown-it remains at ^14.1.2, so the v15 type surface and the v14 typings are now out of sync.

2. Regression verification — FAILED

The required Verify job fails at typecheck (tsc --noEmit), which runs under strict:

src/components/markdown-runtime.ts(345,63): error TS7006: Parameter 'self' implicitly has an 'any' type.
src/components/markdown-runtime.ts(354,37): error TS7006: Parameter 'tokens' implicitly has an 'any' type.
src/components/markdown-runtime.ts(354,45): error TS7006: Parameter 'index' implicitly has an 'any' type.
src/components/markdown-runtime.ts(354,52): error TS7006: Parameter 'options' implicitly has an 'any' type.
src/components/markdown-runtime.ts(354,61): error TS7006: Parameter 'env' implicitly has an 'any' type.
src/components/markdown-runtime.ts(354,66): error TS7006: Parameter 'self' implicitly has an 'any' type.

The custom renderer rules (md.renderer.rules.* around lines 345/354) no longer receive inferred parameter types under markdown-it 15, so strict flags them as implicit any. This is a real breaking change surfaced by the upgrade, not a base-branch or transient issue.

3. Decision

Not merging (fail-fast on a failed required check). Unlike the other open bumps, this one requires a code change, not just a lockfile update.

Suggested remediation (follow-up PR):

1. Bump @types/markdown-it to the matching v15 line (or drop it if markdown-it 15 now ships its own types), and
2. Add explicit types to the renderer-rule callbacks in src/components/markdown-runtime.ts (tokens, index, options, env, self) per markdown-it 15's Renderer.RenderRule signature, then re-run npm run verify.

Left open for that follow-up.

---

Generated by Claude Code

[helebest]

Automated review — held at Step 1 (not auto-merging)

This is a major bump (markdown-it 14.3.0 → 15.0.0) of a core rendering dependency, and it will break the build as-is. It requires source changes, so I am not auto-merging it under the fail-fast policy — it needs dedicated, human-reviewed handling.

Breaking changes that affect this repo

The 15.0.0 changelog removes package-internal subpath exports (markdown-it/lib/*). src/components/markdown-runtime.ts depends on exactly those:

import type StateBlock from "markdown-it/lib/rules_block/state_block.mjs";
import type StateInline from "markdown-it/lib/rules_inline/state_inline.mjs";
import type Token from "markdown-it/lib/token.mjs";

Under v15 those paths no longer resolve, so npm run typecheck (and therefore the required Verify check) would fail. The migration path is to consume the now-bundled TypeScript declarations / the static classes exposed on markdownit, and to drop @types/markdown-it (v15 ships its own types).

Other v15 behavior changes worth validating before merge

• linkify-it → v6: no fuzzy links / no auth-part check by default; Unicode punctuation now terminates links (CJK-affecting). src/utils/markdown.ts uses linkify: true.
• validateLink / normalizeLink / normalizeLinkText moved from properties to prototype methods — this repo relies on normalizeLink's non-ASCII percent-encoding behavior (markdown-runtime.ts:195, documented in docs/ui-system.md), so the reader's image/link resolution must be re-verified.
• entities → v8 and named-entity/HTML-block parsing tweaks — worth a visual reader pass in light + dark.

Recommendation

Handle as a dedicated change: bump + migrate the markdown-it/lib/* type imports, remove @types/markdown-it, then run the full verify gate and the dikw-web-verify-frontend browser pass on the Base reader. Leaving this PR open for that work; not merging.

---

Generated by Claude Code