From 7e5dde1ff314e1777594a0b68dce6ead5519fa7f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 31 Dec 2024 01:21:00 +0800
Subject: [PATCH] chore(deps): bump marked from 12.0.2 to 15.0.4 (#305)

---
 lib/renderer.js | 21 ++++++++++++---------
 package.json    |  2 +-
 test/index.js   |  8 +++++---
 3 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/lib/renderer.js b/lib/renderer.js
index e16894b..0ab79c8 100644
--- a/lib/renderer.js
+++ b/lib/renderer.js
@@ -33,7 +33,8 @@ function mangleEmail(text) {
 
 const renderer = {
   // Add id attribute to headings
-  heading(text, level) {
+  heading({ tokens, depth: level }) {
+    let text = this.parser.parseInline(tokens);
     const { anchorAlias, headerIds, modifyAnchors, _headingId } = this.options;
 
     if (!headerIds) {
@@ -67,7 +68,8 @@ const renderer = {
     return `<h${level} id="${id}"><a href="#${id}" class="headerlink" title="${stripHTML(text)}"></a>${text}</h${level}>`;
   },
 
-  link(href, title, text) {
+  link({ tokens, href, title }) {
+    const text = this.parser.parseInline(tokens);
     const { external_link, sanitizeUrl, hexo, mangle } = this.options;
     const { url: urlCfg } = hexo.config;
 
@@ -96,7 +98,7 @@ const renderer = {
     out += '"';
 
     if (title) {
-      out += ` title="${title}"`;
+      out += ` title="${escape(title)}"`;
     }
     if (external_link) {
       const target = ' target="_blank"';
@@ -118,7 +120,8 @@ const renderer = {
   },
 
   // Support Basic Description Lists
-  paragraph(text) {
+  paragraph({ tokens }) {
+    const text = this.parser.parseInline(tokens);
     const { descriptionLists = true } = this.options;
 
     if (descriptionLists) {
@@ -131,7 +134,7 @@ const renderer = {
   },
 
   // Prepend root to image path
-  image(href, title, text) {
+  image({ href, title, text }) {
     const { options } = this;
     const { hexo } = options;
     const { relative_link } = hexo.config;
@@ -149,8 +152,8 @@ const renderer = {
     }
 
     let out = `<img src="${encodeURL(href)}"`;
-    if (text) out += ` alt="${text}"`;
-    if (title) out += ` title="${title}"`;
+    if (text) out += ` alt="${escape(text)}"`;
+    if (title) out += ` title="${escape(title)}"`;
     if (lazyload) out += ' loading="lazy"';
 
     out += '>';
@@ -185,7 +188,7 @@ const smartypants = (str, quotes) => {
 };
 
 const tokenizer = {
-  // Support AutoLink option
+  // Support autolink option
   url(src) {
     const { autolink } = this.options;
 
@@ -225,7 +228,7 @@ module.exports = function(data, options) {
   // exec filter to extend marked
   this.execFilterSync('marked:use', marked.use, { context: this });
 
-  // exec filter to extend renderer.
+  // exec filter to extend renderer
   this.execFilterSync('marked:renderer', renderer, { context: this });
 
   // exec filter to extend tokenizer
diff --git a/package.json b/package.json
index 4a17978..b0fe4a3 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "dompurify": "^3.0.3",
     "hexo-util": "^3.1.0",
     "jsdom": "^25.0.1",
-    "marked": "^12.0.1"
+    "marked": "^15.0.4"
   },
   "devDependencies": {
     "c8": "^10.1.2",
diff --git a/test/index.js b/test/index.js
index 2d13282..f51cd06 100644
--- a/test/index.js
+++ b/test/index.js
@@ -901,12 +901,15 @@ describe('Marked renderer', () => {
   });
 
   describe('exec filter to extend', () => {
+    // Clear the cache, as the filter might permanently modify the tokenizer
+    // thereby affecting other test cases
+    delete require.cache[require.resolve('../lib/renderer')];
     const hexo = new Hexo(__dirname, {silent: true});
     hexo.config.marked = {};
 
     it('should execute filter registered to marked:renderer', () => {
       hexo.extend.filter.register('marked:renderer', renderer => {
-        renderer.image = function(href, title, text) {
+        renderer.image = function({ href }) {
           return `<img data-src="${encodeURL(href)}">`;
         };
       });
@@ -949,7 +952,7 @@ describe('Marked renderer', () => {
       const r = require('../lib/renderer').bind(hexo);
 
       const result = r({text: body});
-      result.should.eql(`<p>${smartypants(body)}</p>\n`);
+      result.should.eql(`<p>${escapeHTML(smartypants(body))}</p>\n`);
     });
 
     it('should execute filter registered to marked:extensions', () => {
@@ -1042,6 +1045,5 @@ describe('Marked renderer', () => {
         '<p><a href="http://hexo.io/">Hexo</a></p>\n'
       ].join(''));
     });
-
   });
 });