Since numeric references are decoded into the text token, a decoded "&", or
a decoded character next to a literal "&", can spell a new reference that the
no-encode escaper leaves alone and the browser decodes again.
"&" rendered as "&" and displayed "&", and "©"
displayed "(c)". Escape "&" in text that contains a numeric reference, both
the decoded ones and the literal ones that do not already start a reference.

Co-authored-by: Your Name <[email protected]>

…ock (#4115)

* fix: respect tab stops in list continuation indentation

* test: move tab-stop regressions to spec fixtures

* fix: make walkTokens linear by appending values in place

Marked.walkTokens collected callback results with
`values = values.concat(...)` for every token, copying the whole array
each time, so parsing with any walkTokens extension took quadratic time
in document size. Append in place instead, flattening one level like
concat did, so the returned values are unchanged. The combined
walkTokens function built in use() gets the same change.

Fixes #4120

* fix: copy walkTokens callback arrays by index like concat

* fix: preserve enclosing link state after parsing images

* test: move image link regression cases to spec fixtures

* test: use standard HTML differ for image link regression

fix: avoid repeated raw string copies in nested lists

Tokenizer.list() built each item's raw by appending line by line, and the
list's raw by concatenating its items. src is only ever consumed from the
front, so both are contiguous spans of the input and can be sliced out of
it instead. V8 keeps a slice as a view on one backing string rather than a
fresh copy per list and per item.

Token values are unchanged. On cmark's pathological "deeply nested lists"
case (500 levels): 222 MB RSS and 135 ms before, 157 MB and 126 ms after.

No change on the CommonMark spec corpus -- the saving is proportional to
nesting depth, so ordinary documents are unaffected.

* fix: keep a backslash in a code span from hiding emphasis

The em/strong mask replaced every backslash escape before it masked
code spans, but a backslash inside a code span is literal. A code span
ending in `\` therefore lost its closing backtick in the mask, so the
next backtick paired with it and the emphasis between them was masked
out and rendered as literal `_` or `*`.

Mask escapes only outside code spans.

* fix: keep emphasis out of a code span that holds a backtick

---------

Co-authored-by: breken-ai <[email protected]>

Bumps [handlebars](https://github.com/handlebars-lang/handlebars.js) from 4.7.9 to 4.7.10.
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.9...v4.7.10)

---
updated-dependencies:
- dependency-name: handlebars
  dependency-version: 4.7.10
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* docs: add AGENTS.md

* add remove only note

* remove important redundant note

## [18.1.1](v18.1.0...v18.1.1) (2026-10-12)

### Bug Fixes

* **cli:** honor an explicitly empty string input ([#4113](#4113)) ([ec3a4e5](ec3a4e5))
* end blockquote before a lazy line after a heading, hr or html block ([#4115](#4115)) ([9e64a6a](9e64a6a))
* keep a backslash in a code span from hiding emphasis ([#4117](#4117)) ([6a57018](6a57018))
* keep a decoded character reference from forming a new one ([#4111](#4111)) ([6bbac0c](6bbac0c)), closes [#38](#38) [#112](#112)
* let indented and type 3-5 html blocks interrupt a paragraph ([#4124](#4124)) ([eaa1fff](eaa1fff))
* make walkTokens linear by appending values in place ([#4121](#4121)) ([627d9ae](627d9ae)), closes [#4120](#4120)
* match pre, script, style and textarea as whole tag names ([#4114](#4114)) ([0db74cb](0db74cb))
* preserve enclosing link state after parsing images ([#4123](#4123)) ([cc07bb9](cc07bb9))
* respect tab stops in list continuation indentation ([#4119](#4119)) ([4bd2528](4bd2528))

### Performance Improvements

* avoid repeated raw string copies in nested lists ([#4082](#4082)) ([7e8754d](7e8754d))