build(deps): bump marked from 18.0.7 to 18.0.11 in /components/chat_widget

[dependabot]

Bumps marked from 18.0.7 to 18.0.11.

Release notes

Sourced from marked's releases.

v18.0.11

18.0.11 (2026-08-24)

Bug Fixes

• do not nest a link inside a link (#4051) (e250e31)
• inlineTokens rebuilds the reflink-mask preamble per call (#4040) (0653c24)
• keep emphasis in the text of a rejected reference link (#4059) (b699db3)

v18.0.10

18.0.10 (2026-08-18)

Bug Fixes

• keep the em/strong mask the same length as the source (#4044) (681373c)
• parse EOF backtick fences after paragraphs (#4039) (81bd750)
• place task checkboxes after list loose is finalized (#4046) (b8cf7dc), closes #4045

v18.0.9

18.0.9 (2026-08-04)

Bug Fixes

• an unmatched strong run before emphasis stays literal (#4008) (e8544e6)
• Fix spurious deeper nesting in a blockquote continuation (#4030) (452f1ed)
• pedantic foo: and "word" emphasis parsing (#3999) (823093f)

v18.0.8

18.0.8 (2026-08-04)

Bug Fixes

• fall back to default checkbox renderer when extension returns false (#4023) (e1b6139)

Commits

• 53cb13f chore(release): 18.0.11 [skip ci]
• 0c6b2a6 docs: add adaptable bullet point (#4058)
• c430a64 chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#4069)
• b699db3 fix: keep emphasis in the text of a rejected reference link (#4059)
• 0653c24 fix: inlineTokens rebuilds the reflink-mask preamble per call (#4040)
• e250e31 fix: do not nest a link inside a link (#4051)
• 8698d35 chore(release): 18.0.10 [skip ci]
• 58367a5 chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 (#4055)
• a426c4d chore(deps-dev): bump esbuild from 0.28.1 to 0.28.2 (#4056)
• a5cf277 chore(deps-dev): bump highlight.js from 11.11.1 to 11.12.0 (#4057)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

🔍 Dependency Analysis Summary

Package	Old	New	Type	Scope
marked	18.0.7	18.0.11	PATCH (4 patch releases)	components/chat_widget

Overall risk: LOW. Lockfile-only change, patch-level, all bug fixes. No API surface changes, no deprecations, no security advisories. Verified locally: full build + both test suites + typecheck pass.

---

📋 Detailed Changelog Review

Package: marked (18.0.7 → 18.0.11) — all four releases are fix: only, no feat: or BREAKING CHANGE: commits.

• 18.0.8 — fall back to default checkbox renderer when an extension returns false (Do Not Disturb refactor #4023)
• 18.0.9 — unmatched strong run before emphasis stays literal (Deprecate Gemini 2.5 models on Vertex AI (Enterprise Agent Platform) — Oct 2026 #4008); spurious deeper nesting in blockquote continuation (#4030); pedantic-mode emphasis parsing (Extract evaluator LLM provider references into FK fields #3999)
• 18.0.10 — em/strong mask kept same length as source (chore(deps-dev): bump ty from 0.0.63 to 0.0.65 #4044); EOF backtick fences after paragraphs (chore(deps): bump anthropic from 0.109.2 to 0.120.2 #4039); task checkboxes placed after list-loose is finalized (chore(deps-dev): bump puppeteer from 24.43.1 to 25.4.0 in /components/chat_widget #4046)
• 18.0.11 — do not nest a link inside a link (Auto: add new LLM models from llm-stats.com (2026-08-03) #4051); inlineTokens rebuilds the reflink-mask preamble per call (chore(deps-dev): bump webpack from 5.109.0 to 5.109.2 #4040); emphasis preserved in the text of a rejected reference link (use dependabot to manage pre-commit version bumps #4059)

Breaking changes: None.

Security fixes: None flagged as advisories. #4051 (no nested <a> inside <a>) is security-adjacent — it produces better-formed HTML, which reduces mXSS surface. Not an advisory, and DOMPurify already backstops this path.

Migration notes: None required.

Relevance to the widget's usage — components/chat_widget/src/utils/markdown.ts uses exactly two API calls: marked.setOptions with breaks/gfm, and marked.parse in sync mode. None of the fixed code paths touch that API shape; they only change rendered output for the specific malformed/edge-case markdown listed above. The pedantic-mode fix (#3999) is inapplicable — pedantic is not enabled.

Several fixes are genuinely relevant to this widget in practice, since it renders streaming LLM output, which routinely produces exactly these shapes: half-open bold, unmatched emphasis runs (#4008, #4044), EOF-truncated code fences (#4039), and task lists (#4046). These are net improvements for mid-stream rendering.

---

⚠️ Impact Assessment

Breaking changes found: No.

Affected files (usage sites, none need edits):

• components/chat_widget/src/utils/markdown.ts — sole importer
• components/chat_widget/src/components/ocs-chat/ocs-chat.tsx:2149,2163 — renders the result via innerHTML
• components/chat_widget/src/utils/markdown-security.test.mjs — XSS suite that drives marked directly
• components/chat_widget/stencil.config.ts — Jest moduleNameMapper remapping marked to node_modules/marked/lib/marked.umd.js (marked v18 is ESM-only). Verified lib/marked.umd.js still ships in 18.0.11, so this workaround remains valid.

Verification run locally on this branch:

• pnpm install --frozen-lockfile — clean, resolves marked 18.0.11, lockfile consistent
• pnpm run test:security — 31/31 pass (XSS, dangerous URIs, forbidden tags, mXSS, safe-content preservation)
• pnpm run test — 197/197 pass, 8 suites
• pnpm run type-check (tsc --noEmit) — clean
• pnpm run build (stencil build --docs) — succeeds, and produces no diff in the generated src/components/ocs-chat/readme.md

Test impact: None. No test updates needed.

Configuration changes: None. package.json still declares ^18.0.7, which 18.0.11 satisfies — correctly left untouched.

---

🛠️ Recommendations

Action required: None to merge.

One thing worth knowing about how this reaches production (not a blocker, but it affects when the fixes actually ship):

marked is bundled inline into the widget's published output. Confirmed by inspecting the build — dist/esm/open-chat-studio-widget.entry.js (the target of the exports field, which is what import 'open-chat-studio-widget' in assets/javascript/site.js resolves to) contains marked's own source inlined; only dist/collection/ retains a bare marked import.

Two consequences:

1. The shipped marked version is frozen at widget publish time by this lockfile. So this PR does matter for production — but the fixes only reach users after the next w_v* tag fires .github/workflows/publish_widget.yml. Merging alone changes nothing user-facing.
2. The root pnpm-lock.yaml currently resolves marked: 18.0.10 as a declared transitive dep of open-chat-studio-widget@0.12.0 (line 6088). Since the consumed entry point is pre-bundled, that copy is installed but never bundled — it is not what ships, and it does not need to match this PR. Harmless; noting it only so nobody chases the version mismatch as a bug.

Testing focus: Nothing specific required. If you want spot coverage after the next widget release, the highest-value area is streaming markdown rendering — partial bold/emphasis and truncated code fences mid-stream — since that is where #4008/#4039/#4044 change output. The existing 31-case security suite already covers the sanitization contract and is green.

Follow-up tasks: None required. Optional: fold a couple of the newly-fixed edge cases (rejected reference link with emphasis, EOF-truncated fence) into markdown-security.test.mjs as rendering regression cases, so future marked bumps surface output drift.

Merge recommendation: ✅ APPROVE

---

📚 Useful Links

• marked v18.0.7...v18.0.11 compare
• marked releases
• Fix PRs: #4023, #4008, #4030, #4044, #4039, #4046, #4051, #4040, #4059
• npm: marked

---

🤖 Automated Dependabot review by Claude Code