npm / markdown-it
markdown-it
What changed in markdown-it 14 to 15, from its official release notes, upgrade guides and advisories. Also covers @types/markdown-it. Sources checked 2026-10-18.
11 breaking7 security5 new APIs and options1 performance2 behavior and defaults2 tooling16 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initmarkdown-it 1532 changes
Breaking changes 10
Enforces the 999 Unicode code point limit for reference definition labels, partially addressing #1213.
The obsolete StateBlock#ddIndent was removed; update
markdown-it-deflistto keep it working.Lowercase declarations are recognized as HTML blocks, matching CommonMark 4.6.
After upgrading to v6, fuzzy links are disabled by default.
After upgrading to v6, the auth part check is disabled by default.
After upgrading to v6, Unicode punctuation terminates links by default, which should help with CJK.
Package-internal subpath exports such as
markdown-it/lib/*were removed; use the static classes exposed on markdownit instead.normalizeLink moved from a property to a prototype method.
The package root now resolves to prebuilt ESM and CJS files instead of raw sources; distribution files are under
dist/anddist/browser/.The text_join rule now processes image alt text.
Security 5
Fixes quadratic complexity when parsing multiline reference definitions.
Fixed quadratic complexity when quote types don't match, reducing the risk of excessive processing.
The smartquotes stack is limited to 1000 unmatched openers.
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
The inline linkify rule's scheme backscan no longer has quadratic complexity.
New APIs and options 4
A browser export is available with bundled ESM and UMD builds.
Parser internals classes are exposed as static properties on markdownit.
Reference definition tokens are available, but remain stripped by default for backwards compatibility.
Link and image tokens now include reference labels.
Performance 1
Replacing fuzzy links no longer has quadratic complexity.
Behavior and default changes 2
normalizeLinkText moved from a property to a prototype method.
validateLink moved from a property to a prototype method.
Tooling 2
CLI help is colored on supported terminals.
TypeScript declarations are bundled; remove
@types/markdown-itif you used it.
Fixes and other changes 8
Requires whitespace before multiline reference titles.
Fixes quadratic complexity when parsing unclosed inline HTML comments, processing instructions, declarations and CDATA sections.
Code span parsing after lookaheads for unclosed link and image labels is fixed.
Spaces are preserved in code spans whose content consists only of spaces.
Link normalization now preserves brackets around IPv6 address literals.
Inline code content is included in image alt text.
A literal backslash before a terminating space in link destinations is preserved, matching CommonMark 6.3.
Named entities now require semicolons in all decoding paths.
markdown-it 1412 changes
Breaking changes 1
Entity decoding is stricter to avoid false positives involving semicolons.
Security 2
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
markdown-it is has a Regular Expression Denial of Service (ReDoS)
New APIs and options 1
Adds isPunctCharCode to the utilities.
Fixes and other changes 8
Preserves backslash-space hard line breaks, matching CommonMark 6.7.
Added source maps.
Delimiter scans for emphasis-like markers now properly recognize astral characters (surrogates).
HTML comment blocks no longer end on a blank line.
Restores block parser state when the lheading rule fails.
Fixes poor smartquotes performance on blocks with more than 70,000 quotes.
Preserves Unicode whitespaces when trimming headings and paragraphs.
Fixed a regression in the linkify inline rule that could cause high CPU use for specific patterns.