[casper-phantom]

Summary

Upgrades the transitive dev dependency markdown-it from 14.1.0 to 14.3.3 to fix GHSA-gfr2-rv44-r23c (HIGH: quadratic-time rendering of a multi-line link reference definition).

markdown-it comes in only through typedoc (^14.1.0), which already allows 14.3.3, so no direct dependency or resolutions change is needed. 14.3.3 needs linkify-it ^5.0.2 and entities ^4.5.0, so linkify-it moves from 5.0.0 to 5.0.2. entities was already at 4.5.0.

Both yarn.lock and package-lock.json are updated with only these entries changed.

Risk

Low. This is a dev-only dependency used for TypeDoc doc generation. It has no effect on the shipped SDK.

Validation

• yarn install --frozen-lockfile passes, and the installed version is markdown-it@14.3.3 (hoisted from typedoc)
• yarn docs (TypeDoc) passes with 0 errors

Closes SEC-18959

casper-run-id: 01a15b03-cf86-76ac-aa4c-b8745743419f

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 2

• package-lock.json is excluded by !**/package-lock.json
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 4178a812-17e8-4cb5-9fc5-bbc6966588c9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}