Repository navigation
fix: don't treat an escaped ) or quote as an inline link or title closer - #4151
Merged
UziTech merged 1 commit intoNov 2, 2026
Merged
Conversation
An escaped parenthesis or quote was accepted as the end of an inline link or link title, so `[foo](/url\)` became a link. The closer now has to be unescaped, matching CommonMark. Co-authored-by: Rahul Kashyap <[email protected]>
|
@cursoragent is attempting to deploy a commit to the MarkedJS Team on Vercel. A member of the Team first needs to authorize it. |
Contributor
Author
|
Hi! Could a maintainer approve the CI workflows for this PR when you have a moment? Thanks. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions Bot
pushed a commit
that referenced
this pull request
Nov 2, 2026
## [18.1.3](v18.1.2...v18.1.3) (2026-11-02) ### Bug Fixes * allow trailing tabs after a setext heading underline ([#4152](#4152)) ([1f1b480](1f1b480)) * avoid quadratic scan for unmatched emphasis delimiters ([#4103](#4103)) ([eab1e48](eab1e48)), closes [#4099](#4099) * await promise arrays from walkTokens extensions ([#4153](#4153)) ([c38704c](c38704c)) * **cli:** honor defaults and config when outputting tokens ([#4146](#4146)) ([9470e8f](9470e8f)) * collapse internal whitespace when normalizing link labels ([#4157](#4157)) ([02c73e8](02c73e8)) * do not allow a blank line inside a link reference definition label ([#4165](#4165)) ([f3d21af](f3d21af)) * don't treat an escaped ) or quote as an inline link or title closer ([#4151](#4151)) ([9cb84e0](9cb84e0)) * end a list item before a lazy line after an html block ([#4159](#4159)) ([7ba42f4](7ba42f4)) * end blockquote before a lazy line after a table ([#4161](#4161)) ([e7dcf52](e7dcf52)) * isolate extension names from Object.prototype ([#4177](#4177)) ([5cb03bd](5cb03bd)) * keep a block quote open after a lazy line in a nested block quote ([#4175](#4175)) ([1d7272f](1d7272f)) * only close a code fence with the opening fence character ([#4164](#4164)) ([1d4d8fe](1d4d8fe)) * preserve zero-valued custom renderer results ([#4162](#4162)) ([e43ceef](e43ceef)) * recognize task list items when a tab follows the checkbox ([#4163](#4163)) ([64a299d](64a299d)) * start a GFM www autolink only at a word boundary ([#4166](#4166)) ([84beefb](84beefb)) ### Performance Improvements * fix backtracking in padantic html ([#4173](#4173)) ([2d4a23c](2d4a23c))
This was referenced Nov 6, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Marked version: master (2f90743)
Markdown flavor: CommonMark
Description
No existing issue that I could find.
Expectation
A backslash-escaped
)or quote is literal text, so it can't end an inline link destination or a link title. Per CommonMark,[foo](/url\)has no closing paren and should render as plain text, and[a](b "t\")has an unterminated title.Result
marked accepts the escaped character as the closer:
[foo](/url\)renders as a link to/url%5C[a](b "t\"),[a](b 't\'), and[a](b (title\))render as links with a title[foo]: /url "t\"is accepted as a definition with a titleWhat was attempted
)that ends the match is preceded by an odd number of backslashes.Cases that should keep working still do:
[a](b (ti\)tle)),[link](foo\)\:),[foo](/url\\)(escaped backslash, then a real closer), and[link](foo)\).Contributor
test/specs/new/link_escaped_closer.mdcovers the cases above, andnpm testpasses.Committer
In most cases, this should be a different person than the contributor.