[renovate]

This PR contains the following updates:

Package	Type	Update	Change
pulldown-cmark	workspace.dependencies	patch	0.13.4 → 0.13.5

---

Exponential event growth with ENABLE_WIKILINKS

RUSTSEC-2026-0414

More information

Details

When Options::ENABLE_WIKILINKS is enabled, a wikilink with a pipe separator
and empty display text, such as [[a|]], leaks its child node's sibling chain
into the content that follows it. Each such link roughly doubles the number of
events the parser yields for the rest of the document, so output grows
exponentially with input size: 16 repetitions of [[a|]] (112 bytes) yield
327,676 events, where the fixed parser yields 65. A document of a few kilobytes
is enough to exhaust memory in a process that collects the events or renders
them to HTML.

Applications that parse untrusted Markdown with ENABLE_WIKILINKS set,
including through Options::all(), are affected. The option is off by default.
Parsing without it is not affected.

The flaw was fixed in
#​1102 and
released in 0.13.5.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://crates.io/crates/pulldown-cmark
• https://rustsec.org/advisories/RUSTSEC-2026-0414.html
• https://github.com/pulldown-cmark/pulldown-cmark/issues/1179
• https://github.com/pulldown-cmark/pulldown-cmark/pull/1102

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

Release Notes

raphlinus/pulldown-cmark (pulldown-cmark)

v0.13.5: 0.13.5

Compare Source

This release fixes some security issues already fixed in main branch. More details in pulldown-cmark#1181.

Full Changelog: pulldown-cmark/pulldown-cmark@v0.13.4...v0.13.5

---

Follow-up implementation

• Require pulldown-cmark 0.13.5 or newer and replace RW's obsolete panic-catching adapter with the direct offset iterator.
• Retain all three reference-definition triggers and the 25,344-case whitespace sweep as positive regressions; update list and lone-image expectations to the corrected parsing.
• Add bounded empty-label wikilink coverage that checks links, text and event counts. Update the unreleased changelog.

Validation: 1,885 Rust tests and 59 doctests passed (one existing test ignored), along with 269 browser E2E tests without retries and 39 native-binding tests. Focused Clippy, rustdoc and formatting passed. Both the wikilink regression and a retained panic regression fail against 0.13.4 and pass against 0.13.5. Generated NAPI bindings are unchanged.

Release-age gate: 0.13.5 was published on October 21, 2026, at 19:45:37 UTC. Its 14-day cutoff is November 4, 2026, at 19:45:38 UTC (rounded up). These changes do not authorize an early-merge exception.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codspeed]

Merging this PR will not alter performance

✅ 2 untouched benchmarks
⏩ 11 skipped benchmarks¹

---

_{Comparing renovate/crate-pulldown-cmark-vulnerability (9c3dd8e) with main (7b7c250)²}

Footnotes

1. 11 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on main (e648dac) during the generation of this report, so 7b7c250 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.