Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Removes [tar](https://github.com/isaacs/node-tar). It's no longer used after updating ancestor dependency [npm](https://github.com/npm/cli). These dependencies need to be updated together.


Removes `tar`

Updates `npm` from 11.9.0 to 11.11.1
- [Release notes](https://github.com/npm/cli/releases)
- [Changelog](https://github.com/npm/cli/blob/latest/CHANGELOG.md)
- [Commits](npm/cli@v11.9.0...v11.11.1)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 
  dependency-type: indirect
- dependency-name: npm
  dependency-version: 11.11.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [minimatch](https://github.com/isaacs/minimatch) from 9.0.5 to 9.0.9.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v9.0.5...v9.0.9)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 9.0.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [undici](https://github.com/nodejs/undici) from 6.23.0 to 6.24.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.23.0...v6.24.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.24.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [esbuild](https://github.com/evanw/esbuild) from 0.27.3 to 0.27.4.
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.3...v0.27.4)

---
updated-dependencies:
- dependency-name: esbuild
  dependency-version: 0.27.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: Nikita Barinov <[email protected]>
Co-authored-by: Tony Brix <[email protected]>

#3918)

Co-authored-by: UziTech <[email protected]>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>

…arse call (#3907)

## [17.0.5](v17.0.4...v17.0.5) (2026-03-20)

### Bug Fixes

* Fix catastrophic backtracking (ReDoS) in link/reflink label regex ([#3918](#3918)) ([4625980](4625980))
* prevent quadratic complexity in emStrongLDelim regex ([#3906](#3906)) ([c732dd2](c732dd2))
* prevent single-tilde strikethrough false positives ([#3910](#3910)) ([5e03369](5e03369))
* re-assign tokenizer.lexer and renderer.parser at start of each parse call ([#3907](#3907)) ([f3a3ec0](f3a3ec0))
* trim trailing whitespace from lheading text ([#3920](#3920)) ([3ea7e88](3ea7e88))