Bump linkify-it from 5.0.1 to 5.0.2

[dependabot]

Bumps linkify-it from 5.0.1 to 5.0.2.

Changelog

Sourced from linkify-it's changelog.

5.0.2 / 2026-07-02

• Fixed DoS in mailto: links (restrict user name to 64 chars).
• Restricted user/pass part length in links.

Commits

• 50a0c91 5.0.2 released
• de3b885 Update package hooks
• 13effaa Add package lock
• 39d748d Bump c8
• 00ce877 Drop tlds deps
• ecde823 Update benchmark to mitata
• 23c62cd Refactor demo / doc build and publish
• fd63f3b CI config update
• f4ea5af demo: update bootstrap & layout
• 1454fb6 lint: dim warnings
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[fossabot]

Needs Review

Unable to complete automated impact analysis for linkify-it. Manual review is recommended.

Tip: Comment @​fossabot fix to attempt automatic fixes.

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

Changes

This update affects 1 dependency. ⚠️ Contains 3 breaking changes and 1 security fix that require attention.

• --- no longer terminates link. Use option { '---': true } to return old behaviour. (v5.0.1-5.0.2, changelog)
• Removed Cf class from whitespace & punctuation sets (Send ACK when needed #10). (v5.0.1-5.0.2, changelog)
• API change. Exported regex names renamed to reflect changes. Update your custom rules if needed: (v5.0.1-5.0.2, changelog)

View 78 more changes

• Security fix: due problem in Any class regexp from old unicode-7.0.0 package (used in uc-micro), hang happend with astral char patterns like 😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡😡 .com if fuzzy options used. New installs will use fixed uc-micro automatically. Old installs need to be updated. Update dependency eslint to v5.13.0 #36. (v5.0.1-5.0.2, changelog)
• Fixed DoS in mailto: links (restrict user name to 64 chars). (v5.0.1-5.0.2, changelog)
• Fixed DoS in fuzzy links/emails search. (v5.0.1-5.0.2, changelog)
• Fix http:// incorrectly returned as a link by matchStart. (v5.0.1-5.0.2, changelog)
• Fixed paired symbols ((), {}, "", etc.) after punctuation. (v5.0.1-5.0.2, changelog)
• Fixed Update dependency glob-parent to 5.1.2 [SECURITY] #98. Don't count ; at the end of link (when followed with space). (v5.0.1-5.0.2, changelog)
• Proper fix for Update dependency eslint to v6.0.1 #54. Allow multiple ! in links (but not at the end). (v5.0.1-5.0.2, changelog)
• Reverted Update dependency eslint to v6.0.1 #54 fix (allowed multiple ! in links), and added collision sample. (v5.0.1-5.0.2, changelog)
• Fix some google links (allow more consecutive .), Update dependency node-gyp to v6 #66. (v5.0.1-5.0.2, changelog)
• Fix detect email after opening parenthesis: (my@​email.com), Update dependency eslint to v5.12.0 #32. (v5.0.1-5.0.2, changelog)
• Disabled IP-links without schema prefix by default. (v5.0.1-5.0.2, changelog)
• Fixed special chars handling (line breaks). (v5.0.1-5.0.2, changelog)
• Fixed demo permalink encode/decode. (v5.0.1-5.0.2, changelog)
• Autogenerate demo sample from fixtures. (v5.0.1-5.0.2, changelog)
• Fixed blockquoted links (some symbols exclusions), thanks to @​MayhemYDG. (v5.0.1-5.0.2, changelog)
• Fixed demo permalinks, thanks to @​MayhemYDG. (v5.0.1-5.0.2, changelog)
• Add matchAtStart method to match full URLs at the start of the string. (v5.0.1-5.0.2, changelog)
• Allow unlimited . inside link params, Update dependency jsdoc to v3.6.6 #81. This should not be breaking, but bumped version for sure. (v5.0.1-5.0.2, changelog)
• Added options to control fuzzy links recognition (fuzzyLink: true, fuzzyEmail: true, fuzzyIP: false). (v5.0.1-5.0.2, changelog)
• Added .pretest() method for speed optimizations. (v5.0.1-5.0.2, changelog)
• Restricted user/pass part length in links. (v5.0.1-5.0.2, changelog)
• Reworked search logic - check each pattern separate, use g regexes instead of slice. (v5.0.1-5.0.2, changelog)
• Removed internal cache - useless overcomplication. (v5.0.1-5.0.2, changelog)
• Rewrite to ESM. (v5.0.1-5.0.2, changelog)
• --- option now affects parsing of emails (e.g. user@​example.com---) (v5.0.1-5.0.2, changelog)
• Allow ..& in params, Update dependency minimist to 1.2.3 [SECURITY] #87. (v5.0.1-5.0.2, changelog)
• Allow multiple ! in links, Update dependency eslint to v6.0.1 #54. (v5.0.1-5.0.2, changelog)
• Deps bump. (v5.0.1-5.0.2, changelog)
• Rewrite build scripts. (v5.0.1-5.0.2, changelog)
• Improved quoted email detect (disable " at email start), Update dependency jsdoc to v3.6.4 #72. (v5.0.1-5.0.2, changelog)
• Allow -- (and more dashes) in domain names, Error: make failed with exit code: 2 #63. (v5.0.1-5.0.2, changelog)
• Process ｜ (asian vertical pipe 0xFF5C) as valid text separator. (v5.0.1-5.0.2, changelog)
• Allow dashes in local domains, Update dependency jsdoc to v3.6.1 #43. (v5.0.1-5.0.2, changelog)
• Restrict user:pass@... content - prohibit "()[]" chars in auth, Update dependency ava to v1.4.1 #41. (v5.0.1-5.0.2, changelog)
• .onCompile() hook to modify base regexp constants. (v5.0.1-5.0.2, changelog)
• Allow foo'-bar in path (v5.0.1-5.0.2, changelog)
• Consider < & > as invalid in links. (v5.0.1-5.0.2, changelog)
• Support links in lt/gt braces: <user@​domain.com>, <http://example.com>. (v5.0.1-5.0.2, changelog)
• Allow digits in local domains, Update dependency eslint to v5.13.0 #36. (v5.0.1-5.0.2, changelog)
• Restrict user/pass (prohibit [@/] chars) to avoid wrong domain fetch. (v5.0.1-5.0.2, changelog)
• More restrictions for protocol-transparent links. Don't allow single-level (local) domains, except '//localhost', Pin dependencies #19. (v5.0.1-5.0.2, changelog)
• Unicode rules updated to 8.+ version. (v5.0.1-5.0.2, changelog)
• Allow dash at the end of url, thanks to @​Mumakil. (v5.0.1-5.0.2, changelog)
• Allow ".." in link paths. (v5.0.1-5.0.2, changelog)
• More strict default 2-characters tlds handle in fuzzy links, to avoid false positives for node.js, io.js and so on. (v5.0.1-5.0.2, changelog)
• Version bump to 1.0.0 for semver. (v5.0.1-5.0.2, changelog)
• src_ZPCcCf -> src_ZPCc (v5.0.1-5.0.2, changelog)
• src_ZCcCf -> src_ZCc (v5.0.1-5.0.2, changelog)
• Allow .. and ... inside of link paths ( Non-registry package missing package.json: arsdk-xml@git://github.com/Parrot-Developers/arsdk-xml.git#f241e26. #9). Useful for github links with commit ranges. (v5.0.1-5.0.2, changelog)
• Maintenance release. Deps update. (v5.0.1-5.0.2, changelog)
• Moved unicode data to external package. (v5.0.1-5.0.2, changelog)
• Demo permalink improvements. (v5.0.1-5.0.2, changelog)
• Docs update. (v5.0.1-5.0.2, changelog)
• First release. (v5.0.1-5.0.2, changelog)
• Add package lock (v5.0.1-5.0.2, commit)
• Update package hooks (v5.0.1-5.0.2, commit)
• Bump c8 (v5.0.1-5.0.2, commit)
• Drop tlds dependencies (v5.0.1-5.0.2, commit)
• Update benchmark to mitata (v5.0.1-5.0.2, commit)
• Refactor demo and doc build and publish (v5.0.1-5.0.2, commit)
• Update CI config (v5.0.1-5.0.2, commit)
• Update bootstrap and layout in demo (v5.0.1-5.0.2, commit)
• Dim lint warnings (v5.0.1-5.0.2, commit)
• Remove mdurl dependencies from demo (v5.0.1-5.0.2, commit)
• Remove jQuery and Lodash dependencies from demo (v5.0.1-5.0.2, commit)
• Switch linter from lint to neostandard (v5.0.1-5.0.2, commit)
• Replace single line string concatenation with template literals (v5.0.1-5.0.2, commit)
• Replace mocha with native Node.js tests (v5.0.1-5.0.2, commit)
• Rename tests (v5.0.1-5.0.2, commit)
• Restrict scan length in email name and HTTP authentication (v5.0.1-5.0.2, commit)
• Update badges (v5.0.1-5.0.2, commit)
• Internal code refactoring: Converted string concatenation to template literals in regex pattern construction (v5.0.2, package source)
• Removed eslint-disable-next-line comment from tlds_2ch_src_re definition (v5.0.2, package source)
• Migrated test framework from mocha to Node.js native --test runner (v5.0.2, package source)
• Updated build and publishing workflow: changed from prepublishOnly to prepack and added postpublish script (v5.0.2, package source)
• Updated development dependencies: c8 (8.0.1 → 11.0.0), eslint (8.54.0 → 9.39.3), replaced eslint-config-standard with neostandard, replaced benchmark with mitata (v5.0.2, package source)
• Removed unused development dependencies: ansi, mdurl, shelljs, shx, tlds (v5.0.2, package source)
• Updated coverage badge format and removed Gitter chat badge in README (v5.0.2, package source)

---

fossabot analyzed this PR using dependency research. View this analysis on the web

[fossabot]