# What changed in markdown-it

> 44 changes in markdown-it 14 to 15 from its official release notes, upgrade guides and advisories: 11 breaking, 7 security, 5 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/markdown-it/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## markdown-it 15

### Breaking changes

- Enforces the 999 Unicode code point limit for reference definition labels, partially addressing #1213. (15.0.3) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1503---2026-10-16)
- The obsolete StateBlock#ddIndent was removed; update `markdown-it-deflist` to keep it working. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- Lowercase declarations are recognized as HTML blocks, matching CommonMark 4.6. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- After upgrading to v6, fuzzy links are disabled by default. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- After upgrading to v6, the auth part check is disabled by default. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- After upgrading to v6, Unicode punctuation terminates links by default, which should help with CJK. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- Package-internal subpath exports such as `markdown-it/lib/*` were removed; use the static classes exposed on markdownit instead. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- normalizeLink moved from a property to a prototype method. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- The package root now resolves to prebuilt ESM and CJS files instead of raw sources; distribution files are under `dist/` and `dist/browser/`. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- The text_join rule now processes image alt text. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)

### Security

- Fixes quadratic complexity when parsing multiline reference definitions. (15.0.3) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1503---2026-10-16)
- Fixed quadratic complexity when quote types don't match, reducing the risk of excessive processing. (15.0.2) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1502---2026-09-11)
- The smartquotes stack is limited to 1000 unmatched openers. (15.0.2) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1502---2026-09-11)
- markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds (15.0.1) — [security advisory](https://github.com/advisories/GHSA-253C-MCHW-3W2R)
- The inline linkify rule's scheme backscan no longer has quadratic complexity. (15.0.1) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1501---2026-08-27)

### New APIs and options

- A browser export is available with bundled ESM and UMD builds. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- Parser internals classes are exposed as static properties on markdownit. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- Reference definition tokens are available, but remain stripped by default for backwards compatibility. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- Link and image tokens now include reference labels. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)

### Performance

- Replacing fuzzy links no longer has quadratic complexity. (15.0.1) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1501---2026-08-27)

### Behavior and default changes

- normalizeLinkText moved from a property to a prototype method. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- validateLink moved from a property to a prototype method. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)

### Tooling

- CLI help is colored on supported terminals. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- TypeScript declarations are bundled; remove `@types/markdown-it` if you used it. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)

### Fixes and other changes

- Requires whitespace before multiline reference titles. (15.0.3) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1503---2026-10-16)
- Fixes quadratic complexity when parsing unclosed inline HTML comments, processing instructions, declarations and CDATA sections. (15.0.3) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1503---2026-10-16)
- Code span parsing after lookaheads for unclosed link and image labels is fixed. (15.0.1) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1501---2026-08-27)
- Spaces are preserved in code spans whose content consists only of spaces. (15.0.1) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1501---2026-08-27)
- Link normalization now preserves brackets around IPv6 address literals. (15.0.1) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1501---2026-08-27)
- Inline code content is included in image alt text. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- A literal backslash before a terminating space in link destinations is preserved, matching CommonMark 6.3. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)
- Named entities now require semicolons in all decoding paths. (15.0.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1500---2026-07-30)

## markdown-it 14

### Breaking changes

- Entity decoding is stricter to avoid false positives involving semicolons. (14.2.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1420---2026-05-24)

### Security

- markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations (14.2.0) — [security advisory](https://github.com/advisories/GHSA-6V5V-WF23-FMFQ)
- markdown-it is has a Regular Expression Denial of Service (ReDoS) (14.1.1) — [security advisory](https://github.com/advisories/GHSA-38C4-R59V-3VQW)

### New APIs and options

- Adds isPunctCharCode to the utilities. (14.2.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1420---2026-05-24)

### Fixes and other changes

- Preserves backslash-space hard line breaks, matching CommonMark 6.7. (14.3.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1430---2026-07-02)
- Added source maps. (14.3.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1430---2026-07-02)
- Delimiter scans for emphasis-like markers now properly recognize astral characters (surrogates). (14.2.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1420---2026-05-24)
- HTML comment blocks no longer end on a blank line. (14.2.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1420---2026-05-24)
- Restores block parser state when the lheading rule fails. (14.2.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1420---2026-05-24)
- Fixes poor smartquotes performance on blocks with more than 70,000 quotes. (14.2.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1420---2026-05-24)
- Preserves Unicode whitespaces when trimming headings and paragraphs. (14.2.0) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1420---2026-05-24)
- Fixed a regression in the linkify inline rule that could cause high CPU use for specific patterns. (14.1.1) — [release notes](https://github.com/markdown-it/markdown-it/blob/a8c00d474ec9b304fad9b71c16d6fa8b4909279e/CHANGELOG.md#1411---2026-01-11)