From b474e0054f5ff053e18342b00e1b6977735e70fc Mon Sep 17 00:00:00 2001
From: sec-check <280983584+hivecommons-hive[bot]@users.noreply.github.com>
Date: Wed, 21 Oct 2026 04:18:27 -0400
Subject: [PATCH] fix(deps): raise markdown-it override floor to 15.0.3

markdownlint-cli2 pins markdown-it 15.0.1, which resolved to 15.0.2 and
sits inside the affected range of GHSA-gfr2-rv44-r23c and
GHSA-vfgh-jcmw-g37q (quadratic-time rendering). The existing
>=14.1.1 override no longer excludes it; 15.0.3 is the patched release.

Closes #406

Signed-off-by: sec-check <280983584+hivecommons-hive[bot]@users.noreply.github.com>
---
 package-lock.json | 18 +++++++++---------
 package.json      |  2 +-
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0e6c27a..be69e14 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10535,9 +10535,9 @@
       }
     },
     "node_modules/markdown-it": {
-      "version": "15.0.2",
-      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-15.0.2.tgz",
-      "integrity": "sha512-q4IGxMv56jCqT4OCRCADBoDP3LO4MhmTXjFbphHPXs4g3j9Xg5RDnxqN8IF/3vIWEU+VCnUq+7JUg/cfy2E6Qw==",
+      "version": "15.0.3",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-15.0.3.tgz",
+      "integrity": "sha512-+Az7Ojz3iRGu8KYMvJ6xVhvrxP3eE+vEtJX75Ow88XBpcQNV/0lGX5ZynIIBftREo4DC2jsveAMDaeltmm8QvQ==",
       "dev": true,
       "funding": [
         {
@@ -10551,9 +10551,9 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "argparse": "^3.0.0",
-        "entities": "^8.0.0",
-        "linkify-it": "^6.0.0",
+        "argparse": "^3.0.3",
+        "entities": "^8.1.0",
+        "linkify-it": "^6.1.0",
         "mdurl": "^2.1.0",
         "punycode.js": "^2.3.1",
         "uc.micro": "^3.0.0"
@@ -10563,9 +10563,9 @@
       }
     },
     "node_modules/markdown-it/node_modules/argparse": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-3.0.2.tgz",
-      "integrity": "sha512-mFdDM6WqWKraGLsVb+C9CahPnzTXOefAOLq3jYcca2YZ8bEWpr++Tzj+zSaKW9+X9L5uSxcm1AZ3Y6aZJ09OhQ==",
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-3.0.3.tgz",
+      "integrity": "sha512-Sn98ftV3KfsO8xfLPHG6oT8y+b0yvbrLgZjgPDXsharNY15tTAjqIsIju4S32nl6/iEUNNE4v+yL2Zhm8ooP3w==",
       "dev": true,
       "funding": [
         {
diff --git a/package.json b/package.json
index a20917d..89b64fd 100644
--- a/package.json
+++ b/package.json
@@ -74,7 +74,7 @@
     "smol-toml": ">=1.9.0",
     "follow-redirects": ">=1.16.0",
     "js-yaml": ">=5.2.2",
-    "markdown-it": ">=14.1.1",
+    "markdown-it": ">=15.0.3",
     "nanoid": ">=3.3.17",
     "postcss": ">=8.5.18",
     "sharp": ">=0.35.3",