Bump @eslint/markdown from 7.2.0 to 7.4.1

[dependabot]

Bumps @eslint/markdown from 7.2.0 to 7.4.1.

Release notes

Sourced from @​eslint/markdown's releases.

v7.4.1

7.4.1 (2025-10-20)

Bug Fixes

• handle CR in MarkdownSourceCode and Front Matter util (#554) (d1ad828)
• handle CR in rules to follow CommonMark spec (#493) (20e88fe)

v7.4.0

7.4.0 (2025-10-06)

Features

• add support for getLocFromIndex and getIndexFromLoc (#376) (d634f82)
• export MarkdownLanguage from index.js (#538) (a5d78d5)

Bug Fixes

• add null check and use getLocFromIndex in require-alt-text (#543) (41ae6c8)
• correct the return type of applyInlineConfig (#548) (d6621a7)
• report locations in no-multiple-h1 and require-alt-text (#551) (ec30c7d)
• wrong location reporting in no-invalid-label-refs (#545) (e0f7d23)

v7.3.0

7.3.0 (2025-09-22)

Features

• add allowLabels option to no-missing-label-refs (#513) (f6d6b76)
• add no-reference-like-urls rule (#433) (65251ec)
• export types from main entry point (#520) (915837c)
• fix false positives and negatives for consecutive backslashes (#490) (3067607)

Bug Fixes

• exactOptionalPropertyTypes causes type errors when using plugins (#524) (15014a4)
• handle consecutive backslashes in no-reference-like-urls (#523) (762712d)
• no-*-definitions rules show original label and identifier (#515) (f80a9e1)
• report locations with <CR> linebreaks in no-reference-like-urls (#525) (28723c2)
• wrong location reporting in fenced-code-language (#518) (c532194)

Changelog

Sourced from @​eslint/markdown's changelog.

7.4.1 (2025-10-20)

Bug Fixes

• handle CR in MarkdownSourceCode and Front Matter util (#554) (d1ad828)
• handle CR in rules to follow CommonMark spec (#493) (20e88fe)

7.4.0 (2025-10-06)

Features

• add support for getLocFromIndex and getIndexFromLoc (#376) (d634f82)
• export MarkdownLanguage from index.js (#538) (a5d78d5)

Bug Fixes

• add null check and use getLocFromIndex in require-alt-text (#543) (41ae6c8)
• correct the return type of applyInlineConfig (#548) (d6621a7)
• report locations in no-multiple-h1 and require-alt-text (#551) (ec30c7d)
• wrong location reporting in no-invalid-label-refs (#545) (e0f7d23)

7.3.0 (2025-09-22)

Features

• add allowLabels option to no-missing-label-refs (#513) (f6d6b76)
• add no-reference-like-urls rule (#433) (65251ec)
• export types from main entry point (#520) (915837c)
• fix false positives and negatives for consecutive backslashes (#490) (3067607)

Bug Fixes

• exactOptionalPropertyTypes causes type errors when using plugins (#524) (15014a4)
• handle consecutive backslashes in no-reference-like-urls (#523) (762712d)
• no-*-definitions rules show original label and identifier (#515) (f80a9e1)
• report locations with <CR> linebreaks in no-reference-like-urls (#525) (28723c2)
• wrong location reporting in fenced-code-language (#518) (c532194)

Commits

• e354f98 chore: release 7.4.1 🚀 (#556)
• 20e88fe fix: handle CR in rules to follow CommonMark spec (#493)
• 0d01b19 docs: add migration docs (#559)
• 6d1bd73 ci: centralize ci-bun.yml (#563)
• e7c5868 ci: add Node.js 25 to ci.yml and fix Bun CI (#562)
• 868153b ci: resolve failure in the release-please.yml workflow (#558)
• c95c017 docs: Update README sponsors
• 6c88ae1 ci: Switch to trusted publishing (#557)
• d1ad828 fix: handle CR in MarkdownSourceCode and Front Matter util (#554)
• 8992a4d refactor: replace findOffsets helper with native methods (#536)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[fossabot]

[fossabot]

Needs Review

I recommend reviewing this upgrade before merging because the new package requires Node.js 18.18.0 or higher, which conflicts with the project's stated Node.js engine requirements that include versions 14.18.0, 16.13.0, and 19.x. While this is a devDependency affecting only the development toolchain, the project's CI pipeline still tests against these older Node versions and developers using Node 14, 16, or 19 will be unable to run npm install. The upgrade includes 5 new features and 2 bug fixes as part of ESLint's official markdown support initiative.

What we checked

• Project declares support for Node.js ^14.18.0 || ^16.13.0 || ^18 || ^19 || ^20 || ^22 || ^24, which includes versions incompatible with the new dependency ^[1]
• New @​eslint/markdown@​7.4.1 requires Node.js ^18.18.0 || ^20.9.0 || >=21.1.0, dropping support for Node 14.x, 16.x, and 19.x ^[2]
• CI test matrix includes Node 14.18.0 and 16.13.0, which will fail npm clean-install with the new dependency requirements ^[3]
• @​eslint/markdown is a devDependency used in the linting toolchain, not affecting runtime compatibility of the published package ^[4]
• Package is imported and used for linting markdown files in the project's ESLint configuration ^[5]
• ESLint officially supports @​eslint/markdown as the next generation of eslint-plugin-markdown with improved parsing and rules ^[6]

Dependency Usage

Based on my search, the package is used in the project's build toolchain to enable code quality enforcement across documentation files. The ESLint configuration imports the markdown plugin and applies it through the processor configuration at line 1293, extending linting coverage to JavaScript code snippets embedded within Markdown documentation throughout the repository. This ensures consistent code quality standards between production code and documentation examples, supporting the library's developer experience and documentation accuracy as a shell escaping utility.

• @​eslint/markdown: config/eslint.js:5 - This code imports the @​eslint/markdown ESLint plugin to enable linting of Markdown files in the ESLint configuration.

Other Usages (1)

These usages were analyzed but no breaking changes were detected:

@​eslint/markdown

• shescape/config/eslint.js

  Line 5 in 143ad37

  import markdown from "@eslint/markdown";

Changes

This update to @​eslint/markdown fixes two bugs (type errors and backslash handling) and adds five new features including a new no-reference-like-urls rule, an allowLabels option for no-missing-label-refs, and improved location mapping with getLocFromIndex/getIndexFromLoc support. The package also resolves multiple location reporting issues across several rules and adds better handling for carriage return line endings to follow the CommonMark specification.

• handle CR and CRLF in no-missing-atx-heading-space (#555) (a869d98) (v7.4.1, changelog)
• handle CR in MarkdownSourceCode and Front Matter util (#554) (d1ad828) (v7.4.0, changelog)
• handle CR in rules to follow CommonMark spec (#493) (20e88fe) (v7.4.0, changelog)

View 15 more changes

• add support for getLocFromIndex and getIndexFromLoc (#376) (d634f82) (v7.3.0, changelog)
• export MarkdownLanguage from index.js (#538) (a5d78d5) (v7.3.0, changelog)
• add null check and use getLocFromIndex in require-alt-text (#543) (41ae6c8) (v7.3.0, changelog)
• correct the return type of applyInlineConfig (#548) (d6621a7) (v7.3.0, changelog)
• report locations in no-multiple-h1 and require-alt-text (#551) (ec30c7d) (v7.3.0, changelog)
• wrong location reporting in no-invalid-label-refs (#545) (e0f7d23) (v7.3.0, changelog)
• add allowLabels option to no-missing-label-refs (#513) (f6d6b76) (vv7.3.0, release notes)
• add no-reference-like-urls rule (#433) (65251ec) (vv7.3.0, release notes)
• export types from main entry point (#520) (915837c) (vv7.3.0, release notes)
• fix false positives and negatives for consecutive backslashes (#490) (3067607) (vv7.3.0, release notes)
• exactOptionalPropertyTypes causes type errors when using plugins (#524) (15014a4) (vv7.3.0, release notes)
• handle consecutive backslashes in no-reference-like-urls (#523) (762712d) (vv7.3.0, release notes)
• no-*-definitions rules show original label and identifier (#515) (f80a9e1) (vv7.3.0, release notes)
• report locations with <CR> linebreaks in no-reference-like-urls (#525) (28723c2) (vv7.3.0, release notes)
• wrong location reporting in fenced-code-language (#518) (c532194) (vv7.3.0, release notes)

References (6)

[1]: Project declares support for Node.js ^14.18.0 || ^16.13.0 || ^18 || ^19 || ^20 || ^22 || ^24, which includes versions incompatible with the new dependency

shescape/package.json

Line 42 in 143ad37

"node": "^14.18.0 || ^16.13.0 || ^18 || ^19 || ^20 || ^22 || ^24"

[2]: New @​eslint/markdown@​7.4.1 requires Node.js ^18.18.0 || ^20.9.0 || >=21.1.0, dropping support for Node 14.x, 16.x, and 19.x

shescape/package-lock.json

Line 937 in 143ad37

"node": "^18.18.0 || ^20.9.0 || >=21.1.0"

[3]: CI test matrix includes Node 14.18.0 and 16.13.0, which will fail npm clean-install with the new dependency requirements

shescape/.github/workflows/checks.yml

Line 173 in 143ad37

- 14.18.0

[4]: @​eslint/markdown is a devDependency used in the linting toolchain, not affecting runtime compatibility of the published package

shescape/package.json

Line 68 in 143ad37

"@eslint/markdown": "7.4.1",

[5]: Package is imported and used for linting markdown files in the project's ESLint configuration

shescape/config/eslint.js

Line 5 in 143ad37

import markdown from "@eslint/markdown";

[6]: ESLint officially supports @​eslint/markdown as the next generation of eslint-plugin-markdown with improved parsing and rules (source link)

---

fossabot analyzed this PR using static analysis and dependency research.

[deepsource-io]

Here's the code health analysis summary for commits 65bc4f5..143ad37. View details on DeepSource ↗.

Analysis Summary

Analyzer	Status	Summary	Link
JavaScript	✅ Success		View Check ↗

---

💡 If you’re a repository administrator, you can configure the quality gates from the settings.