fix(deps): update dependency marked to v17.0.6

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
marked (source)	17.0.3 → 17.0.6

---

Release Notes

markedjs/marked (marked)

v17.0.6

Compare Source

Bug Fixes

• avoid race condition in async parallel parse/parseInline with hooks (#​3924) (6e96fa7)
• cli: honor positional input file (#​3922) (a1c2617)
• cli: use file URL for config import (#​3923) (73e1f3f)

v17.0.5

Compare Source

Bug Fixes

• Fix catastrophic backtracking (ReDoS) in link/reflink label regex (#​3918) (4625980)
• prevent quadratic complexity in emStrongLDelim regex (#​3906) (c732dd2)
• prevent single-tilde strikethrough false positives (#​3910) (5e03369)
• re-assign tokenizer.lexer and renderer.parser at start of each parse call (#​3907) (f3a3ec0)
• trim trailing whitespace from lheading text (#​3920) (3ea7e88)

v17.0.4

Compare Source

Bug Fixes

• prevent ReDoS in inline link regex title group (#​3902) (46fb9b8)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.89%. Comparing base (c21ddc9) to head (d3cd0cf).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #58   +/-   ##
=======================================
  Coverage   88.89%   88.89%           
=======================================
  Files           6        6           
  Lines        1369     1369           
  Branches      253      253           
=======================================
  Hits         1217     1217           
  Misses        152      152           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[timoa]

🛑 DevSecOps Renovate sweep (TIM-117) — CI gate

Required check Lint, Test, Build & Security is failing on this PR, so the autopilot is skipping it. The CI gate requires a fully green rollup before auto-merge.

Please investigate the failing check (or re-run it after fixes) and re-trigger the sweep if appropriate.

🤖 Automated by DevSecOps autopilot

[timoa]

DevSecOps autopilot (TIM-119) — skipped: Lint, Test, Build & Security check failed. marked v17.0.6 is a major-line jump (was on v17 already per the prefix), but the v17 series has breaking changes vs older majors. Patch-level fix(deps) but CI red blocks auto-merge. Please rebase and re-run.

[timoa]

Skipping — CI is red on this PR (🚫 Lint, Test, Build & Security). This is a same-minor patch chain (marked 17.0.3 → 17.0.6) — content is fine, no security impact observed in the release notes — but lint is blocking merge. The next autopilot run will retry once CI is green. Not auto-merged.

[timoa]

Renovate PR — DevSecOps sweep (2026-08-14).

CI gate failure blocks auto-merge. Failed check(s):

• Lint, Test, Build & Security

Please fix the failing checks. The next sweep will re-evaluate once CI is green.

[timoa]

Renovate sweep — skipped, blocked. Patch bump (marked 17.0.3 → 17.0.6) but CI gate failure: Lint, Test, Build & Security is FAILING. Patches should not break, so this needs investigation — note that 17.0.4/17.0.5 contained ReDoS fixes and the project may have tests that exercise the patched code paths. Please investigate the failing CI and either fix and merge, or close.

[timoa]

Autopilot: marked 17.0.3 → 17.0.6 (patch bump; includes ReDoS link-title regex fix in v17.0.4 — security-relevant). CI blocked: Lint, Test, Build & Security = FAILURE. Please investigate the lint failure (likely a downstream impact unrelated to marked), re-run CI, and prioritize merging for the ReDoS fix.

[timoa]

DevSecOps sweep: skipping — required check 'Lint, Test, Build & Security' is FAILING. marked 17.0.3 → 17.0.6 includes ReDoS bug fixes (notably v17.0.5's link regex fix) — worth investigating whether Lint/Test failures are caused by the security patch and rerunning.

[timoa]

Renovate daily sweep (DevSecOps autopilot, 2026-08-18): this PR bumps marked 17.0.3 → 17.0.6 (patch delta, fix(deps): prefix). Security relevance: v17.0.4 and v17.0.5 include ReDoS / catastrophic-backtracking fixes in the link/reflink label regex and emStrongLDelim regex — recommend prioritizing human review. CI is failing on Lint, Test, Build & Security (other checks green). Files: package.json + pnpm-lock.yaml. Skipping auto-merge — please address the Lint, Test, Build & Security failure and merge promptly to land the ReDoS fixes.

[timoa]

Daily Renovate sweep: blocked. marked 17.0.3 → 17.0.6 is a patch bump, but the Lint, Test, Build & Security check failed on this PR. No auto-merge attempted. Please fix CI and merge manually.

[timoa]

Skipping — CI gate failure: Lint, Test, Build & Security FAILED on this PR. PR bumps marked 17.0.3 → 17.0.6 (patch releases within v17 — fixes several ReDoS issues). Please triage the failing checks before merging.

[timoa]

DevSecOps daily sweep: blocked on failing CI. marked 17.0.3 → 17.0.6 is a patch bump (would normally be auto-merge eligible) but Lint, Test, Build & Security returned FAILURE. Needs a rebase and the lint/test failures fixed before I can approve.

[timoa]

DevSecOps sweep TIM-173: skipped — failing CI. Lint, Test, Build & Security failed. marked 17.0.3 → 17.0.6 (patch). CI gate blocks auto-merge. Please fix CI and re-run, or merge manually once green.

[timoa]

DevSecOps auto-merge is blocked: Lint, Test, Build & Security check failed on the latest run (FAILURE). PR: marked v17.0.3 → v17.0.6 (patch, includes ReDoS fixes — security-relevant). Please inspect the failing job, fix or rerun CI, then re-trigger the sweep. The patch range contains security fixes for the markdown parser.

[timoa]

This PR is auto-flagged for human review — CI gate failure.

PR #58 bumps marked from 17.0.3 to 17.0.6 — a patch bump, normally auto-mergeable, but Lint, Test, Build & Security is FAILING, so the autopilot's CI gate blocks auto-merge.

Please inspect the failing job, confirm the failures are unrelated to this patch, and merge manually if so.

[timoa]

DevSecOps autopilot: skipped — CI failing (Lint, Test, Build & Security = FAILURE). marked 17.0.3 → 17.0.6 is a patch within the same major and includes ReDoS fixes; please re-run checks and investigate the failure before merging.

[timoa]

DevSecOps autopilot sweep (2026-08-29). CI failed (Lint, Test, Build & Security) — skipping. This PR is also labelled fix(deps) and includes ReDoS security fixes — please rebase and re-run urgently, then re-evaluate on the next daily sweep.

[timoa]

🤖 Renovate autopilot (DevSecOps, daily sweep @ 2026-08-30):

Skipped — CI gate failure. Required check Lint, Test, Build & Security is FAILING.

This PR bumps marked 17.0.3 → 17.0.6 (patch). The 17.0.4–17.0.6 releases contain ReDoS / regex-CPU security fixes. The diff touches package.json and pnpm-lock.yaml only — no workflow files.

Action needed: Investigate the Lint/Test/Build failure on main. This PR is otherwise a clean auto-merge candidate (security-related patch, no hard exclusions). Recommend prioritizing CI fix so this can be merged on the next sweep — it carries a security fix.

[timoa]

DevSecOps daily Renovate sweep — skipped, blocked.

Lint, Test, Build & Security check is failing on this PR (marked 17.0.3 → 17.0.6 patch). The autopilot will not auto-merge with a failing required status check. To unblock: investigate the lint/build failure.

Heads up — this range contains three ReDoS / quadratic-complexity fixes (link/reflink label regex, emStrongLDelim, inline link title group) that are security-adjacent even though no security label is set. Worth getting green and merged promptly once the lint issue is resolved.

No auto-merge performed.

[timoa]

DevSecOps autopilot (daily Renovate sweep). Not merging — CI gate failure. Lint, Test, Build & Security failed on the latest run (2026-08-03). This is a patch bump of marked from 17.0.3 to 17.0.6 (Renovate tagged it as fix(deps)); the changelog lists several ReDoS fixes and CLI bugfixes. Please investigate the Lint/Test/Build failure, re-run CI, and I will pick it up on the next sweep.

[timoa]

🤖 Renovate autopilot skipping this PR — required CI check failed.

Reason: Lint, Test, Build & Security check failed.

⚠️ Security-adjacent: This PR bundles a fix for a ReDoS vulnerability in the marked regex (v17.0.5 shipped 'Fix catastrophic backtracking (ReDoS) in link/reflink label regex'). The bump is patch-level but the security motivation is worth noting. Please prioritise fixing CI for this PR.

[timoa]

DevSecOps Renovate sweep 2026-09-03: CI is not fully green — the 'Lint, Test, Build & Security' check failed. Skipping auto-merge per the CI gate. Note: marked 17.0.4-17.0.6 carry ReDoS/quadratic-complexity fixes, so a rebase once main is green is the right path.

[timoa]

Daily Renovate sweep (DevSecOps autopilot, 2026-09-04): skipping — CI failure on Lint, Test, Build & Security. marked 17.0.3 → 17.0.6 is a patch bump (ReDoS hardening in the link/reflink regex and tokenizer reset fixes). Low content risk but CI is currently red — please fix before merging.

[timoa]

Renovate sweep — not auto-merged. Patch bump (marked → 17.0.6) would normally qualify, but Lint, Test, Build & Security is failing. CI gate blocks merge.

[timoa]

🤖 Skipping — CI failure. Lint, Test, Build & Security is FAILING on this Renovate PR (marked bump to v17.0.6). The autopilot will not merge PRs whose required status checks are not fully green. Please fix the failing job (see https://github.com/timoa/workflow-metrics/actions/runs/31370365845) and re-trigger, or merge manually once CI is green.

[timoa]

Holding (DevSecOps autopilot). CI gate failure on the Lint, Test, Build & Security check. This is a patch bump of marked (17.0.3 → 17.0.6; fix(deps): prefix from Renovate — also includes a couple of ReDoS fixes upstream). No version-class escalation — once the lint failure is fixed, this PR would qualify for auto-merge on the next sweep. Skipping for now.

[timoa]

🤖 DevSecOps autopilot (TIM-258) — skipping (CI blocked).

marked 17.0.3 → 17.0.6 is a patch bump (with security fixes for ReDoS / quadratic complexity) but the Lint, Test, Build & Security check is FAILING on this PR, so the CI gate is not green. Auto-merge blocked.

Skipping. Please address the failing CI; given the security nature of these patch fixes, a manual merge after fixing CI is recommended.

[timoa]

Skipped by DevSecOps Renovate sweep: CI is failing on this PR (Lint/Test/Build/Security). The autopilot does not auto-merge PRs with red CI. Please investigate the failure or rebase on main once it's fixed.

[timoa]

Skipped: CI is failing on this branch — Lint, Test, Build & Security reported failure on 2026-08-03. The marked 17.0.3 → 17.0.6 bump includes security fixes (ReDoS in inline link regex, label regex). Please rebase on main and push to retrigger CI. (DevSecOps daily sweep)

[timoa]

Skipping auto-merge (devsecops sweep, 2026-09-11).

This patch bump (marked 17.0.3 → 17.0.6) has a failing Lint, Test, Build & Security check, so the CI gate is not green. Please rebase / push a fix and re-run CI, or merge manually once green. Note: this PR has been open since 2026-05-05 — consider rebasing or closing.