fix(deps): update dependency marked to v18

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
marked (source)	^15.0.12 → ^18.0.7

---

Release Notes

markedjs/marked (marked)

v18.0.7

Compare Source

v18.0.6

Compare Source

v18.0.5

Compare Source

Bug Fixes

• parse empty list item with trailing space (#​3984) (b55410f)

v18.0.4

Compare Source

Bug Fixes

• cache list indentation regexes (#​3969) (a37983f)
• fix cli not reading stdin (#​3967) (11adb69)

v18.0.3

Compare Source

Bug Fixes

• avoid task checkbox for setext heading text (#​3960) (2608e81)

v18.0.2

Compare Source

Bug Fixes

• fix infinite loop for indented code blank line (#​3947) (58a52e8)

v18.0.1

Compare Source

Bug Fixes

• rules: ensure lookbehind regex is evaluated correctly by minifiers (#​3945) (abd907a)

v18.0.0

Compare Source

Bug Fixes

• Bump typescript from 5.9.3 to 6.0.2 (#​3934) (e8efc51)
• prevent GFM table tokens from greedily capturing trailing newlines (#​3926) (40f2665)
• prevent heading and def tokens from greedily capturing multiple newlines (#​3925) (b379e3e)
• trim blank lines from block tokens (#​3939) (b70895f)

BREAKING CHANGES

• trim trailing blank lines from block tokens
• update Typescript to v6

v17.0.6

Compare Source

Bug Fixes

• avoid race condition in async parallel parse/parseInline with hooks (#​3924) (6e96fa7)
• cli: honor positional input file (#​3922) (a1c2617)
• cli: use file URL for config import (#​3923) (73e1f3f)

v17.0.5

Compare Source

Bug Fixes

• Fix catastrophic backtracking (ReDoS) in link/reflink label regex (#​3918) (4625980)
• prevent quadratic complexity in emStrongLDelim regex (#​3906) (c732dd2)
• prevent single-tilde strikethrough false positives (#​3910) (5e03369)
• re-assign tokenizer.lexer and renderer.parser at start of each parse call (#​3907) (f3a3ec0)
• trim trailing whitespace from lheading text (#​3920) (3ea7e88)

v17.0.4

Compare Source

Bug Fixes

• prevent ReDoS in inline link regex title group (#​3902) (46fb9b8)

v17.0.3

Compare Source

Bug Fixes

• escape image alt text (#​3896) (909fe44)

v17.0.2

Compare Source

Bug Fixes

• fix blockquote after list (#​3888) (2a475a1)
• fix empty list item (#​3890) (3fc6a44)
• fix list item wrong indent (#​3889) (e031175)
• fix list with tabs (#​3891) (9fc4f8e)
• fix strikethrough flanking rules (#​3882) (1a5b124)

v17.0.1

Compare Source

Bug Fixes

• fix block elements in task item (#​3828) (921ee22)

v17.0.0

Compare Source

Bug Fixes

• only create tokens inside tokenizers (#​3755) (7b19231)

BREAKING CHANGES

• Change how consecutive text tokens work in lists
• Simplify listItem renderer
• Checkbox token is added in list tokenizer
• Checkbox token add type and raw property
• Change loose list text tokens to paragraph type in the list tokenizer

v16.4.2

Compare Source

Bug Fixes

• Avoid RegExp lookbehind assertions (#​3816) (#​3817) (c056df0)

v16.4.1

Compare Source

Bug Fixes

• resolve even-numbered backtick precedence issue (#​3776) (#​3786) (1da8fb5)

v16.4.0

Compare Source

Bug Fixes

• Fix backtick and code rendering in links (#​3783) (302ee59)
• fix links with square brackets in inline code break wrapping italics (#​3785) (e3c0d3e)
• Make www case-sensitive when detecting link starts (#​3770) (626d961)

Features

• Add async provideParser provideLexer (#​3756) (09577e5)

v16.3.0

Compare Source

Features

• add emStrongMask hook (#​3749) (cd2b5f4)

v16.2.1

Compare Source

Bug Fixes

• allow escaped newline in link text (#​3752) (30c6630)

v16.2.0

Compare Source

Features

• add def token in tokens and renderer (#​3745) (0769124)

v16.1.2

Compare Source

Bug Fixes

• fix multiline list item adds extra newline to raw (#​3735) (e76453e)

v16.1.1

Compare Source

Bug Fixes

• fix stong and em tokens in angle brackets (#​3731) (ad8535c)

v16.1.0

Compare Source

Features

• add generic types for parser and renderer output (#​3722) (39a0ee3)

v16.0.0

Compare Source

Bug Fixes

• remove cjs build & update min node to 20 (#​3687) (0a35d8f)

BREAKING CHANGES

• minify ./lib/marked.esm.js and ./lib/marked.umd.js

• remove ./marked.min.js use ./lib/marked.umd.js instead

• remove ./lib/marked.cjs

• update minimum supported node version to 20 to support require('marked.esm.js'). see https://nodejs.org/docs/latest-v20.x/api/modules.html#loading-ecmascript-modules-using-require

• This seems to break Jest since it doesn't work with esm by default.

  You need to transform marked with:

  transformIgnorePatterns: ['/node_modules/(?!(marked)/)'],
  

  see Jest docs for more info

---

Configuration

📅 Schedule: (in timezone Asia/Kolkata)

• Branch creation
  • "on tuesday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

? Verifying lockfile against supply-chain policies (353 entries)...
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 85, reused 0, downloaded 0, added 0
Progress: resolved 87, reused 0, downloaded 0, added 0
Progress: resolved 106, reused 0, downloaded 0, added 0
Progress: resolved 225, reused 0, downloaded 0, added 0
✗ Lockfile failed supply-chain policy check (353 entries in 5.2s)
[ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION] 1 lockfile entries failed verification:
  react@19.2.8 was published at 2026-07-21T15:41:27.000Z, within the minimumReleaseAge cutoff (2026-07-20T22:32:41.364Z)

The lockfile contains entries that the active policies reject. This can mean the lockfile is stale, or that someone committed a lockfile that bypassed the policy locally — inspect recent changes to pnpm-lock.yaml before trusting it. If the changes look expected, run "pnpm clean --lockfile" and then "pnpm install" to rebuild from a fresh resolution. Alternatively, relax the policy that flagged them.
Progress: resolved 334, reused 0, downloaded 0, added 0