A Python Markdown parser with renderers and plugins,
compatible with sane CommonMark rules.
Provides
Requires
License
BSD-3-Clause
Changelog
* Mon Oct 26 2026 Dirk Müller <dmueller@suse.com>
- update to 3.4.0:
* Solves CVE-2026-115350 (bsc#1287177), CVE-2026-115351 (bsc#1287175),
CVE-2026-115348 (bsc#1287190), CVE-2026-115347 (bsc#1287189),
CVE-2026-115353 (bsc#1287181), CVE-2026-115352 (bsc#1287178),
CVE-2026-115349 (bsc#1287174)
* Add Python 3.15 support and include it in the CI test matrix.
* Require Python 3.10 or later.
* Parse inline links with an opening-bracket stack and replace
per-syntax failure caches with source-local delimiter
scanning.
* Share one inline nesting budget across images, links,
emphasis, and plugins. Expose InlineParser.max_nested_level;
the older max_emphasis_depth and max_image_depth settings
configure the same limit.
* Preserve later valid syntax when a candidate fails or reaches
a nesting limit, rather than treating the remaining input as
unparsed text.
* Enforce CommonMark's 999-character reference label limit,
balanced and bounded destination parentheses, and link title
constraints.
* Improve performance for unclosed inline HTML, unmatched code
delimiters, deeply nested images, and repeated text
fragments.
* Recognize inline HTML comments permitted by CommonMark
0.31.2.
* Parse links containing full reference images without treating
the image's reference label as a nested link.
* Preserve reference definitions parsed inside multi-paragraph
footnotes.
* Accept definition-list markers indented by up to three
spaces.
* Prefer longer registered abbreviation matches over shorter
prefixes.
* Require at least one digit in ordered list continuation
markers.
* Add Markdown rendering for strikethrough, mark, and insert
plugins.
* Preserve escaped pipes in table code spans, literal trailing
heading hashes, meaningful code span edge spaces, and leading
blank lines in Markdown output.
* Keep images whose alt text matches their URL from becoming
autolinks.
* Preserve non-line-break separator characters in rendered
lists and hard line breaks in tight ReST list items.
* Document per-document renderer context and correct the custom
Markdown renderer example.
* Preserve literal backslashes, image introducers, HTML
delimiters and entity prefixes when rendering Markdown for a
round trip.
* Only recognize task list markers in a list item's leading
paragraph, preserving literal markers in headings.
* Bound the global convenience-parser cache and avoid retaining
caller-owned renderers and plugin objects.
* Add public HTML output helpers for raw HTML, attributes, and
URL policy.
* Share collision-safe default heading IDs between both TOC
APIs.
* Add explicit start-character hints for custom inline rules;
unhinted custom rules now use the correctness-first regular-
expression scanner.
* Consolidate adversarial parser growth tests and document the
security model.
* Sat Aug 22 2026 Dirk Müller <dmueller@suse.com>
- update to 3.3.4:
* Harden inline parsing against deeply nested and adversarial
link, image, emphasis, formatting, math, and reference
inputs.
* Improve performance for repeated link suffixes, dense
emphasis, unclosed formatting markers, inline spoilers, and
adjacent ruby tokens.
* Refactor the inline parser into dedicated emphasis and link
modules.
* Escape literal */_ emphasis markers in the Markdown renderer
so round-tripping escaped text does not re-introduce
emphasis.
* Limit deeply nested emphasis and image parsing to avoid
RecursionError.
* Fix repeated link suffix and unclosed formatting marker
performance issues.
* Fix unclosed inline spoiler performance issues.
* Avoid recursive parsing for adjacent ruby tokens.
* Speed up footnote reference indexing.
* Thu Jun 25 2026 Markéta Machová <mmachova@suse.com>
- update to 3.3.2 (CVE-2026-49851, bsc#1269091)
* Resolve O(n^2) DoS in parse_link_text (CWE-400)
* Avoid quadratic scans in general
* cli: Add entrypoint and utf-8 output
* image: Validate figure width option
* Reject currency patterns and cross-line matches in inline math
* math: Support display and backtick math
* renderer: Render plugin list and table nodes
* renderer: Block encoded unsafe URL schemes
* abbr: Update process_text method in abrr, adding parse_emphasis
parameter
* Mon May 11 2026 Nico Krapp <