chore(deps-dev)(deps-dev): Bump markdown-it from 14.3.0 to 15.0.0

[dependabot]

Bumps markdown-it from 14.3.0 to 15.0.0.

Changelog

Sourced from markdown-it's changelog.

[15.0.0] - 2026-07-30

Added

• Exposed parser internals classes as static properties on markdownit.
• Bundled TypeScript declarations. Remove @types/markdown-it if you used it.
• Added the markdown-it/browser export with bundled ESM and UMD builds.
• Added colored CLI help on supported terminals via argparse 3.
• Added reference labels to link/image tokens, #938.
• Added reference_definition tokens. They remain stripped by default for backwards compatibility, #1055. Also adjusted the line-break heuristic to keep output exactly the same.

Changed

• [breaking] linkify-it => v6
  • No fuzzy links by default.
  • No auth part check by default.
  • Unicode punctuation terminates the link by default (should help with CJK).
  • See linkify-it changelog for other changes.
• Package root now resolves to prebuilt ESM and CJS files instead of raw sources. Distribution files were reorganized under dist/ and dist/browser/.
• Migrated to Typescript.
• entities => v8. Can be rolled back to v7 if compatibility issues happen.
• Moved validateLink, normalizeLink and normalizeLinkText from properties to prototype methods.
• Reworked issue templates and contribution guidelines.

Removed

• [breaking] Removed package-internal subpath exports (markdown-it/lib/* and similar). Use the static classes exposed on markdownit instead.
• [breaking] Removed obsolete StateBlock#ddIndent, #1139. Update markdown-it-deflist to keep it working.

Fixed

• Preserve a literal backslash before a terminating space in link destinations, matching CommonMark 6.3, #1188.
• Recognize lowercase declarations as HTML blocks, matching CommonMark 4.6, #1189.
• Require semicolons for named entities in all decoding paths, completing the fix for #1096.
• Enhanced the text_join rule to process image alt text.
• Include inline code content in image alt text, #1142.

Commits

• 157b33b 15..0.0 released
• f73cb76 doc: rename files
• 3bc8e2d Add TS types
• 2620dce Update contribution guidelines and issue templates
• 7d365fe doc: migration info
• 5c9b7ce Update changelog
• 5a996d5 doc: fix @example tags display
• f5083f4 doc: continue restructuring & theme fixing
• 54289c4 Show inline code content in image alt tag #1142
• 974e2d7 text_join rule fix: process image alt content too (fixes lost escapes and...
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@prisma/composer@277

npm i https://pkg.pr.new/@prisma/composer-cli@277

npm i https://pkg.pr.new/@prisma/composer-prisma-cloud@277

commit: 5f1f1e4

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a2ba3d32-b911-4d93-841a-87dd52097d13

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[prisma-gizmo]

✅ Gizmo reviewed 5f1f1e4 — posted 1 inline comment(s) this pass.

Open findings: 🟡 2 minor

Change walkthrough

This PR is a routine dev-dependency maintenance bump: it raises markdown-it from ^14.1.0 to ^15.0.0 in the website workspace, with the regenerated pnpm-lock.yaml pulling in the corresponding transitive updates (argparse@3, entities@8, linkify-it@6, mdurl@2.1, uc.micro@3), plus incidental lockfile churn from unrelated dependency refreshes already in the tree (@mongodb-js/saslprep, mysql2/sql-escaper, postcss/nanoid, vite's picomatch pin).

Fit with the codebase. markdown-it is used in exactly one place: website/scripts/render.ts, which renders the canonical guides in docs/guides/ to HTML for the docs site. The usage there is limited to the default-import constructor (html, linkify, highlight options), the fence and link_open renderer rules, and md.render — all stable across the 14→15 major. None of the v15 breaking changes (removed markdown-it/lib/* subpath exports, StateBlock#ddIndent removal, validateLink/normalizeLink moving from properties to prototype methods, linkify-it's no-fuzzy-links default) have any effect here: the repo has no deep imports into markdown-it internals, and linkify: false disables the linkify-it path entirely.

Consequences for rendered output. Two v15 fixes are visible to the site's build: CommonMark 6.3 conformance for literal backslashes before terminating spaces in link destinations, and lowercase HTML block declarations. Since guides are rendered with html: false and rewritten link_open hrefs, the realistic impact is minor rendering-fidelity improvements to guide content; image alt-text handling (inline code included in alt) also changes but the guides' HTML is generated fresh at build time via pnpm run render, so nothing is cached against the old behavior.

[prisma-gizmo]

New findings: 🟡 1 minor · trace

[prisma-gizmo]

🟡 Minor · consistency — Stale @types/markdown-it@14 left installed alongside markdown-it 15, which now bundles its own types

markdown-it 15.0.0 ships its own bundled TypeScript declarations and the upstream changelog explicitly instructs: "Remove @types/markdown-it if you used it." The bump on line 28 leaves the v14 typings (website/package.json line 27, resolved as @types/markdown-it: 14.1.2 in pnpm-lock.yaml) installed alongside markdown-it 15.0.0. The stale @types package describes the markdown-it 14 API (e.g. validateLink/normalizeLink as properties, which are prototype methods in 15), so it is dead weight under moduleResolution: bundler and a version-skew trap if any tooling resolves types through it. The repo's own tsc --noEmit typecheck runs against the bundled v15 types, so leaving this entry can only mask API drift, not catch it.

Recommended fix

Remove the "@types/markdown-it": "^14.1.2" entry from devDependencies in website/package.json (line 27) and rerun pnpm install to drop it from the lockfile, per the markdown-it 15 migration note.

[prisma-gizmo]

New findings: 🟡 1 minor · trace

Still open from previous reviews: 🟡 1 minor

[prisma-gizmo]

🟡 Minor · correctness — Bump left stale @types/markdown-it@^14.1.2 behind, which markdown-it 15 supersedes with bundled types

markdown-it 15.0.0 ships its own TypeScript declarations, and the upstream changelog explicitly instructs: "Remove @types/markdown-it if you used it." The PR bumps website/package.json:28 to ^15.0.0 but keeps @types/markdown-it@^14.1.2 in devDependencies on line 27. The v14 hand-written declarations now describe an API that no longer matches the installed runtime (e.g. validateLink/normalizeLink moved from properties to prototype methods in v15). TypeScript currently resolves the real package's bundled types first, so this is mostly dead weight today, but the stale stub is a silent drift hazard for anything that consults @types directly and contradicts the documented migration step for the major bump.

Recommended fix

Remove the "@types/markdown-it": "^14.1.2", line from devDependencies (line 27) and run pnpm install so the lockfile drops the stale @types/markdown-it@14 snapshot.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.