[dependabot]

Bumps markdown from 3.11.2 to 3.11.3.

Release notes

Sourced from markdown's releases.

Release 3.11.3

Fixed

• Fix cases in new emphasis handling that did not handle long chains of tokens like they should (#1690).
• Fix quadratic-time parsing of many consecutive reference definitions, and of many consecutive footnote definitions in the footnotes extension.
• Support automatic links with URL schemes other than HTTP and FTP, such as <ssh://example.org> (#1244).
• Fix quadratic-time id generation in the toc extension when many headers share the same text.
• Ignore glossary abbreviations with empty definitions after inline elements, consistently with abbreviations before inline elements.
• Strip complete HTML tags with quoted > characters from toc labels and generated heading IDs.
• Fix quadratic-time regex backtracking in attr_list when a block ends with an unclosed attribute list followed by a long run of spaces, e.g. a line consisting only of { and some text with many trailing spaces (#1656).
• Fix quadratic-time regex backtracking in hash headers when a long run of # characters is followed by more text on the same line.
• Fix quadratic time when a document contains many unclosed HTML comments (<!-- with no matching -->).
• Fix regression in BacktickInlineProcessor where text could be lost when opening and closing backticks did not match (#1668).
• Escape the language name in the codehilite extension's non-Pygments output to maintain consistency with Pygments output.
• Preserve attributes without a value in the attr_list extension exactly as provided, rather than rendering them as key="key", so the same source renders consistently under both the html and xhtml output formats (#1501).

Changelog

Sourced from markdown's changelog.

[3.11.3] - 2026-11-05

Fixed

• Fix cases in new emphasis handling that did not handle long chains of tokens like they should (#1690).
• Fix quadratic-time parsing of many consecutive reference definitions, and of many consecutive footnote definitions in the footnotes extension.
• Support automatic links with URL schemes other than HTTP and FTP, such as <ssh://example.org> (#1244).
• Fix quadratic-time id generation in the toc extension when many headers share the same text.
• Ignore glossary abbreviations with empty definitions after inline elements, consistently with abbreviations before inline elements.
• Strip complete HTML tags with quoted > characters from toc labels and generated heading IDs.
• Fix quadratic-time regex backtracking in attr_list when a block ends with an unclosed attribute list followed by a long run of spaces, e.g. a line consisting only of { and some text with many trailing spaces (#1656).
• Fix quadratic-time regex backtracking in hash headers when a long run of # characters is followed by more text on the same line.
• Fix quadratic time when a document contains many unclosed HTML comments (<!-- with no matching -->).
• Fix regression in BacktickInlineProcessor where text could be lost when opening and closing backticks did not match (#1668).
• Escape the language name in the codehilite extension's non-Pygments output to maintain consistency with Pygments output.
• Preserve attributes without a value in the attr_list extension exactly as provided, rather than rendering them as key="key", so the same source renders consistently under both the html and xhtml output formats (#1501).

Commits

• 40eca04 Bump version to 3.11.3
• a198bb3 Apply the CommonMark rule of 3 which we missed.
• 0bfd8c3 Fix quadratic-time parsing of consecutive reference definitions
• 3f2c551 Avoid rescanning for a comment close after unclosed comments
• 8bfb9aa Ignore empty abbreviation definitions in element tails
• 527b81e Recognize additional URL schemes in automatic links
• b97b56c attr_list: preserve valueless attributes as provided
• e76f0b7 Fix quadratic-time id generation in toc extension
• 0f0a860 Fix quadratic-time backtracking in hash header regex
• 5e335ef Fix TOC labels for quoted HTML angle brackets
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)