From 6d3d78305c31347eeed51cd28228f859272bdf36 Mon Sep 17 00:00:00 2001 From: Chris Sewell Date: Tue, 10 Nov 2026 15:55:59 +0100 Subject: [PATCH 1/4] =?UTF-8?q?=F0=9F=93=9A=20Fix=20the=204.1.0=20and=204.?= =?UTF-8?q?0.0=20release=20dates=20in=20the=20changelog?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 4.1.0 was released on 2026-05-06 (not 2025-05-06) and 4.0.0 on 2025-08-11 (not 2024-08-10), as the tags and the GitHub releases show. --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 040ff138..f6a09a9d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,7 +12,7 @@ * ✨ Add `make_fence_rule()` factory for configurable fence markers in [#394](https://github.com/executablebooks/markdown-it-py/pull/394) -## 4.1.0 - 2025-05-06 +## 4.1.0 - 2026-05-06 * ✨ Add `gfm-like2` preset with task lists, alerts, and single-tilde strikethrough core plugins in [#388](https://github.com/executablebooks/markdown-it-py/pull/388) * ✨ Allow plugins to register inline terminator characters in [#391](https://github.com/executablebooks/markdown-it-py/pull/391) @@ -22,7 +22,7 @@ **Full Changelog**: -## 4.0.0 - 2024-08-10 +## 4.0.0 - 2025-08-11 This primarily drops support for Python 3.9, adds support for Python 3.13, and updates the parser to comply with Commonmark 0.31.2 and Markdown-It v14.1.0. From b5095c15e9542a21a6485ae18c7f2ce953a4f86f Mon Sep 17 00:00:00 2001 From: Chris Sewell Date: Tue, 10 Nov 2026 15:58:23 +0100 Subject: [PATCH 2/4] =?UTF-8?q?=F0=9F=9A=80=20RELEASE:=20v4.3.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump __version__ to 4.3.0 and write the 4.3.0 changelog entry, folding in the lines that were under Unreleased. Also add the missing compare link to the 4.2.0 entry. --- CHANGELOG.md | 91 +++++++++++++++++++++++++++++++++++++---- markdown_it/__init__.py | 2 +- 2 files changed, 85 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f6a09a9d..749756e8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,17 +1,94 @@ # Change Log -## Unreleased - -* ✨ Add `--enable-tables` to the CLI for file, standard input and interactive parsing in [#422](https://github.com/executablebooks/markdown-it-py/pull/422) -* šŸ› Fix CLI interactive mode joining input lines with an extra newline, which split every line into its own paragraph and broke hard line breaks, in [#172](https://github.com/executablebooks/markdown-it-py/issues/172) -* šŸ› Fix trimming and splitting with the Python whitespace set instead of the CommonMark one, which dropped U+001C–U+001F and U+0085 from paragraphs, headings, table cells and fence info strings and let distinct reference labels resolve each other, in [#418](https://github.com/executablebooks/markdown-it-py/pull/418), thanks to [@Nexory](https://github.com/Nexory) -* šŸ“š Document the Python renderer constructor contract. -* šŸ”§ Drop the optional dependency on the `commonmark` package and its benchmark, since the upstream package is unmaintained, in [#401](https://github.com/executablebooks/markdown-it-py/pull/401) +## 4.3.0 - 2026-11-10 + +This release fixes two quadratic-time parsing paths that let crafted input stall rendering for minutes (security), +aligns several parsing rules with CommonMark 0.31.2 and markdown-it 15.0.x, +turns parser rules that never advance into a `RuntimeError` instead of an infinite loop, +makes rendering linear on PyPy and free-threaded CPython, and adds support for Python 3.14. +Python 3.10 is still supported. +If you write plugins or render rules, or edit `SyntaxTreeNode` trees, please read the upgrade notes at the end. + +### šŸ”’ Security + +* šŸ‘Œ Fix quadratic-time inline parsing of long runs of characters that start an inline rule without completing one (such as `&`, `<`, `~` or incomplete entities), which let a few hundred kilobytes of input stall rendering for seconds to minutes, in [#423](https://github.com/executablebooks/markdown-it-py/pull/423), thanks to [@hdimer](https://github.com/hdimer) ([#411](https://github.com/executablebooks/markdown-it-py/pull/411)) +* šŸ‘Œ Reject unterminated inline HTML (`