[dependabot]

Bumps the lockfile-minor-and-patch group with 1 update: mistune.

Updates mistune from 3.3.4 to 3.4.0

Release notes

Sourced from mistune's releases.

v3.4.0

   🐞 Bug Fixes

• Keep escaped backslashes in angle-bracket link destinations  -  by @​chuenchen309 and Claude Opus 4.8 (1M context) (e12f0)
• Apply escape flag to a user-supplied HTML renderer  -  by @​Sanjays2402 (1209f)
• Refactor link and empahsis parsing  -  by @​lepture (bde6a)
• Preserve leading blank lines in MarkdownRenderer  -  by @​BetterAndBetterII (27864)
• Preserve empty reference destinations in MarkdownRenderer  -  by @​ryanchou1994 (aa5f0)
• Do not treat a full reference label as a link  -  by @​CrossNox (f61d7)
• Avoid quadratic inline footnote membership checks  -  by @​susyimes in lepture/mistune#478 (4c4e5)
• Isolate cached markdown parsers  -  by @​lepture (8baf9)
• Share collision-safe toc identifiers  -  by @​lepture (4a382)
• Make inline rule start hints explicit  -  by @​lepture (1cc26)
• Restrict markdown cache to built-in selectors  -  by @​lepture (618eb)
• Preserve intersphinx in offline docs builds  -  by @​lepture (6de38)

   🏎 Performance

• Improve parsing speed for deep nested lists  -  by @​lepture (bc1f7)
• Avoid re-subscripting Callable on every renderer method lookup  -  by @​deadstrobe5 (75425)
• Streamline inline parsing and unify nesting limits  -  by @​lepture (56cd2)

    View changes on GitHub

Changelog

Sourced from mistune's changelog.

Version 3.4.0

Released on Oct 19, 2026

• Add Python 3.15 support and include it in the CI test matrix.
• Require Python 3.10 or later.
• Parse inline links with an opening-bracket stack and replace per-syntax failure caches with source-local delimiter scanning.
• Share one inline nesting budget across images, links, emphasis, and plugins. Expose InlineParser.max_nested_level; the older max_emphasis_depth and max_image_depth settings configure the same limit.
• Preserve later valid syntax when a candidate fails or reaches a nesting limit, rather than treating the remaining input as unparsed text.
• Enforce CommonMark's 999-character reference label limit, balanced and bounded destination parentheses, and link title constraints.
• Improve performance for unclosed inline HTML, unmatched code delimiters, deeply nested images, and repeated text fragments.
• Recognize inline HTML comments permitted by CommonMark 0.31.2.
• Parse links containing full reference images without treating the image's reference label as a nested link.
• Preserve reference definitions parsed inside multi-paragraph footnotes.
• Accept definition-list markers indented by up to three spaces.
• Prefer longer registered abbreviation matches over shorter prefixes.
• Require at least one digit in ordered list continuation markers.
• Add Markdown rendering for strikethrough, mark, and insert plugins.
• Preserve escaped pipes in table code spans, literal trailing heading hashes, meaningful code span edge spaces, and leading blank lines in Markdown output.
• Keep images whose alt text matches their URL from becoming autolinks.
• Preserve non-line-break separator characters in rendered lists and hard line breaks in tight ReST list items.
• Document per-document renderer context and correct the custom Markdown renderer example.
• Preserve literal backslashes, image introducers, HTML delimiters and entity prefixes when rendering Markdown for a round trip.
• Only recognize task list markers in a list item's leading paragraph, preserving literal markers in headings.
• Bound the global convenience-parser cache and avoid retaining caller-owned renderers and plugin objects.
• Add public HTML output helpers for raw HTML, attributes, and URL policy.
• Share collision-safe default heading IDs between both TOC APIs.
• Add explicit start-character hints for custom inline rules; unhinted custom rules now use the correctness-first regular-expression scanner.
• Consolidate adversarial parser growth tests and document the security model.

Commits

• f19057f chore: release 3.4.0
• 56cd21e perf: streamline inline parsing and unify nesting limits
• bc7bb78 Merge pull request #484 from jackwalkerlabs/fix/codespan-edge-spaces
• 5569f20 Merge pull request #481 from BetterAndBetterII/fix/leading-blank-lines
• 0b4e15d Merge remote-tracking branch 'origin/main' into HEAD
• e9975d4 Merge pull request #485 from jackwalkerlabs/fix/image-autolink-roundtrip
• cada77f Merge remote-tracking branch 'origin/main' into HEAD
• e9e7b4e Merge pull request #499 from xingzhao-ji/fix/task-list-leading-paragraph
• 40c76b9 Merge pull request #486 from oyeong011/fix/preserve-heading-trailing-hashes
• 029cd5f Merge pull request #490 from CrossNox/fix/reference-image-inside-link
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
fair-code	Ready	Preview	Oct 23, 2026 9:46am UTC

[github-actions]

@yakew7 - new PR touching a path you own, please review.