ci(deps): bump the production-dependencies group with 3 updates

[dependabot]

Bumps the production-dependencies group with 3 updates: marked, @noble/hashes and highlight.js.

Updates marked from 18.0.7 to 18.0.11

Release notes

Sourced from marked's releases.

v18.0.11

18.0.11 (2026-08-24)

Bug Fixes

• do not nest a link inside a link (#4051) (e250e31)
• inlineTokens rebuilds the reflink-mask preamble per call (#4040) (0653c24)
• keep emphasis in the text of a rejected reference link (#4059) (b699db3)

v18.0.10

18.0.10 (2026-08-18)

Bug Fixes

• keep the em/strong mask the same length as the source (#4044) (681373c)
• parse EOF backtick fences after paragraphs (#4039) (81bd750)
• place task checkboxes after list loose is finalized (#4046) (b8cf7dc), closes #4045

v18.0.9

18.0.9 (2026-08-04)

Bug Fixes

• an unmatched strong run before emphasis stays literal (#4008) (e8544e6)
• Fix spurious deeper nesting in a blockquote continuation (#4030) (452f1ed)
• pedantic foo: and "word" emphasis parsing (#3999) (823093f)

v18.0.8

18.0.8 (2026-08-04)

Bug Fixes

• fall back to default checkbox renderer when extension returns false (#4023) (e1b6139)

Commits

• 53cb13f chore(release): 18.0.11 [skip ci]
• 0c6b2a6 docs: add adaptable bullet point (#4058)
• c430a64 chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#4069)
• b699db3 fix: keep emphasis in the text of a rejected reference link (#4059)
• 0653c24 fix: inlineTokens rebuilds the reflink-mask preamble per call (#4040)
• e250e31 fix: do not nest a link inside a link (#4051)
• 8698d35 chore(release): 18.0.10 [skip ci]
• 58367a5 chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 (#4055)
• a426c4d chore(deps-dev): bump esbuild from 0.28.1 to 0.28.2 (#4056)
• a5cf277 chore(deps-dev): bump highlight.js from 11.11.1 to 11.12.0 (#4057)
• Additional commits viewable in compare view

Updates @noble/hashes from 2.2.0 to 2.4.0

Release notes

Sourced from @​noble/hashes's releases.

2.4.0

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0

2.3.0

Improve speed:

• +10-45% 32b inputs across all hashes
• +40% SHA-3 / SHAKE, +50% 1mb KT128 / KT256 / TurboSHAKE, +20% kmac
• 2.2x argon
• +20% pbkdf2 and hkdf

Other changes:

• Better error messages and stricter type checks everywhere
• Bugfix: HMAC _cloneInto now preserves canXOF (#134, ChALkeR); Argon2d typo rename (#135).
• blake2.compress renamed to _compress (marked internal).
• Reduce on-disk unpacked size 869kb → 665kb (-204kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-hashes@2.2.0...2.3.0

Changelog

Sourced from @​noble/hashes's changelog.

2.4.0 (2026-08-27)

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

2.3.0 (2026-08-06)

Performance

• Improved 32-byte input performance across all hashes by 10–45%.
• Improved SHA-3 and SHAKE by 40%, one-megabyte KangarooTwelve, MarsupilamiFourteen, and TurboSHAKE by 50%, and KMAC by 20%.
• Improved Argon2 performance by 2.2×.
• Improved PBKDF2 and HKDF performance by 20%.

Other changes

• Added better error messages and stricter type checks throughout the package.
• Fixed HMAC._cloneInto so it preserves canXOF in issue #134, reported by @​ChALkeR, and corrected an Argon2d typo in issue #135.
• Renamed blake2.compress to the internal _compress method.
• Reduced unpacked on-disk size from 869 KB to 665 KB by disabling less-relevant source maps.

Commits

• 663c2ae Release 2.4.0.
• a6f7519 Add changelog
• 1bbc433 webcrypto: snapshot opts
• 5bd2e15 Remove unused files
• a3bc7ff Bump vectors
• fcb6cb6 README
• 64f3033 readme
• 9ac6165 Bump ci workflows
• 6587b51 Fix test on bun
• 91ecf91 Fix tests
• Additional commits viewable in compare view

Updates highlight.js from 11.11.1 to 11.12.0

Release notes

Sourced from highlight.js's releases.

v11.12.0 - Summer, hot and rainy.

Parser Engine:

• fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

• add FreeDesktop config file (.desktop / systemd) grammar [gg582][]
• added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]
• added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]
• added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]
• added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]
• added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]
• added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]
• added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]
• added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]
• added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]
• added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]
• added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]
• added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]
• referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

• fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]
• fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]
• fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]
• fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]
• enh(cmake) add block and endblock keywords [Anonymous Maarten][]
• fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]
• fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]
• fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]
• enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]
• enh(css) add corner-shape properties [Hama Tanveer][]
• enh(css) support six-digit unicode-range values [Konstantin Baltsat][]
• enh(dart) add highlighting for class and function names [guuido][]
• enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]
• enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
• enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]
• enh(gherkin) update keyword list [Hirse][]
• enh(gherkin) variables can't contain whitespace [Hirse][]
• enh(gherkin) docstrings can use backticks [Hirse][]
• enh(go) recognize binary integer literals [spokodev][]
• enh(groovy) support underscores in numeric literals [greymoth][]
• fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]
• enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
• enh(javascript) add self to built-in variables [Dsaquel][]
• enh(kotlin) add ktm and ktx aliases [DarkMatter-999][]
• fix(leaf) fix bug in Leaf keyword highlighting [Francesco Paolo Severino][]
• fix(lisp) preserve highlighting after quoted multiplication expressions [arturict][]

... (truncated)

Changelog

Sourced from highlight.js's changelog.

Version 11.12.0

Parser Engine:

• fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

• add FreeDesktop config file (.desktop / systemd) grammar [gg582][]
• added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]
• added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]
• added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]
• added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]
• added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]
• added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]
• added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]
• added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]
• added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]
• added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]
• added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]
• added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]
• referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

• fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]
• fix(c) do not highlight C++ std types as built-ins, issue #4103 [Arron Zou][]
• fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]
• fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]
• fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]
• enh(cmake) add block and endblock keywords [Anonymous Maarten][]
• fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]
• fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]
• fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]
• enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]
• enh(css) add corner-shape properties [Hama Tanveer][]
• enh(css) support six-digit unicode-range values [Konstantin Baltsat][]
• enh(dart) add highlighting for class and function names [guuido][]
• enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]
• enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
• enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]
• enh(gherkin) update keyword list [Hirse][]
• enh(gherkin) variables can't contain whitespace [Hirse][]
• enh(gherkin) docstrings can use backticks [Hirse][]
• enh(go) recognize binary integer literals [spokodev][]
• enh(groovy) support underscores in numeric literals [greymoth][]
• fix(haml) recognize implicit div tag lines starting with .class or #id, issue #3783 [pikammmmm][]
• fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]
• enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
• enh(javascript) add self to built-in variables [Dsaquel][]

... (truncated)

Commits

• f7f7d38 (release) release v11.12.0
• c4c4728 (docs) FreeDesktop + Kotlin aliases; note extra language override
• 9142292 bump version to 11.12.0
• 03d1e7e (chore) rebuild CHANGES.md for 11.12.0
• ca6bb8e enh(sqf) update to A3 v2.22 (#4460)
• 1414c96 fix: use Trusted Publishers in publishing pipeline (#4427)
• 2a9ad7d fix(markdown) don't treat a thematic break as the start of bold text (#4485)
• 375f3f4 build(deps-dev): bump @​rollup/plugin-commonjs from 28.0.1 to 29.0.3 (#4481)
• 2ce1706 build(deps-dev): bump del from 8.0.0 to 8.0.1 (#4484)
• 72084b5 fix(ruby): don't treat scope resolution :: as symbols (#4463)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for highlight.js since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions