[chrisjsewell]

Release markdown-it-py 4.3.0.

What

• markdown_it/__init__.py: __version__ 4.2.0 → 4.3.0 (the only version location: pyproject.toml reads it via dynamic = ["version"]).
• CHANGELOG.md:
  • the 4.3.0 entry, covering every merged PR since v4.2.0, with upgrade notes for the behaviour changes;
    the lines that were under ## Unreleased are folded into it;
  • the missing compare link on the 4.2.0 entry;
  • the 4.1.0, 4.0.0 and 2.0.1 headings now carry their real release dates (2026-05-06, 2025-08-11 and 2022-01-24), in separate commits.

The entry is dated 2026-11-10: re-date it to the tag day if the tag is pushed later.

The two 🔒 Security lines (#423, #428) get a GitHub security advisory after the release; its draft is ready.

Checked locally

• pytest tests/ --cov=markdown_it (.[testing,linkify,coverage], Python 3.13): 1190 passed.
• pre-commit run --all-files: clean.
• Docs as Read the Docs builds them (Python 3.13, .[linkify,plugins,rtd], sphinx -T -nW --keep-going): no warnings.
• python -m build and twine check --strict dist/*: both files pass; the build job's tag check passes for v4.3.0 against them and fails for v4.2.0.
• mdit-py-plugins master against this branch: 728 passed, 1 xfailed.
• MyST-Parser master with this branch and mdit-py-plugins master (Sphinx 9.2, docutils 0.23): 1514 passed, 11 skipped.

Release checklist

• CI on this PR is green: allgood, and also test-plugins (it is not part of allgood).
• Trusted publisher and environment: the PyPI publisher for tests.yml / environment pypi is registered; gh api repos/executablebooks/markdown-it-py/environments shows pypi with one deployment policy, v* (tag), and no required reviewers.
• Squash-merge with the title and message below.
• Tag the squash commit: git fetch origin && git tag v4.3.0 <squash-sha> && git push origin v4.3.0.
• The tag run's build (tag check) and Publish to PyPI jobs are green. If publishing fails, fix the configuration and re-run the failed job; do not delete or move the tag.
• curl -s -o /dev/null -w '%{http_code}' https://pypi.org/integrity/markdown-it-py/4.3.0/markdown_it_py-4.3.0-py3-none-any.whl/provenance returns 200 (4.2.0 returns 404).
• Draft the GitHub Release for v4.3.0 from the changelog entry.
• Publish the security advisory for 👌 Fix quadratic inline tokenization on runs of special characters #423/👌 Reject unterminated inline HTML in constant time #428 (affected <= 4.2.0, patched 4.3.0) and link it from the GitHub Release; same day as mdit-py-plugins 0.7.0 and its advisory.
• Read the Docs builds v4.3.0, and stable moves to it (it is on v4.2.0 now).
• conda-forge (markdown-it-py-feedstock): run deps are unchanged (python >=3.10, mdurl >=0.1,<1); the host pin flit-core >=3.4,<4 is still inside the new flit_core >=3.4,<5 build range, and the sdist now ships tests/; the bot's version PR is enough.
• Follow-ups: release mdit-py-plugins 0.7.0; tell mdformat (Backslash escapes and entities are deleted from image alt text hukkin/mdformat#599) that image children are now joined text tokens, so it must escape alt text; offer Token.require_map() on Provide a typed way to require a token source map #430 for 4.4.0; plan 4.4.0 (sync port.yaml to markdown-it 15.0.x; the smartquotes and linkify fixes from markdown-it's recent advisories); the AGENTS.md / CLAUDE.md PR.

Squash commit

Title: 🚀 RELEASE: v4.3.0 (#466)

Bump __version__ to 4.3.0 and write the 4.3.0 changelog entry,
folding in the lines that were under Unreleased.
Add the missing 4.2.0 compare link, and correct the 4.1.0, 4.0.0 and 2.0.1 release dates.