fix(deps): update dependency mdast-util-to-hast to v13 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mdast-util-to-hast	12.3.0 -> 13.2.1

GitHub Vulnerability Alerts

CVE-2025-66400

Impact

Multiple (unprefixed) classnames could be added in markdown source by using character references.
This could make rendered user supplied markdown code elements appear like the rest of the page.
The following markdown:

```js xss
```

Would create <pre><code class="language-js xss"></code></pre>
If your page then applied .xss classes (or listeners in JS), those apply to this element.
For more info see https://github.com/ChALkeR/notes/blob/master/Improper-markup-sanitization.md#unsanitized-class-attribute

Patches

The bug was patched. When using regular semver, run npm install. For exact ranges, make sure to use 13.2.1.

Workarounds

Update.

References

• bug introduced in syntax-tree/mdast-util-to-hast@6fc783a
• bug fixed in syntax-tree/mdast-util-to-hast@ab3a795

---

Release Notes

syntax-tree/mdast-util-to-hast (mdast-util-to-hast)

v13.2.1

Compare Source

Fix

• ab3a795 Fix support for spaces in class names

Types

• efb5312 Refactor to use @imports
• a5bc210 Add declaration maps

Full Changelog: syntax-tree/mdast-util-to-hast@13.2.0...13.2.1

v13.2.0

Compare Source

Types

• 24f4576 Add type for data.meta on elements to hast

Full Changelog: syntax-tree/mdast-util-to-hast@13.1.0...13.2.0

v13.1.0

Compare Source

Add

• 59ecd14 Add support for file in options

Full Changelog: syntax-tree/mdast-util-to-hast@13.0.2...13.1.0

v13.0.2

Compare Source

• b186995 Fix hProperties on tableCell
  by @​kanemu in #​71

Full Changelog: syntax-tree/mdast-util-to-hast@13.0.1...13.0.2

v13.0.1

Compare Source

Fix

• 7ff28fb Fix trimming of whitespace around breaks

Full Changelog: syntax-tree/mdast-util-to-hast@13.0.0...13.0.1

v13.0.0

Compare Source

Change

• 67ef76c Update @types/hast, @types/mdast, utilities
  migrate: update too
• b815f5e Change to require Node.js 16
  migrate: update too
• 33442cc Change to use exports
  migrate: don’t use private APIs
• 56c88e4 Fix to match GH for HTML generated for backreferences
  migrate: use the function form of footnoteBackLabel for i18n, see defaultFootnoteBackLabel for inspiration
• ffe7e47 Change to always return a node
  migrate: expect an empty root instead of nothing
• ffbb8a8 Change to expect, yield undefined
  migrate: expect undefined everywhere, not null
• c13fe7f Change to remove support for Footnote nodes
  migrate: use GFM, which does not have “inline” notes
• 6fc783a Change to remove support for ancient lang on code with spaces
  migrate: you’re fine, this hasn’t been a thing for years
• 72b8a68 Change to use maps for definitions on state
  migrate: if you make your own handles, expect maps
• b328aa9 Change to remove function form of State, use plain object
  migrate: if you make your own handles, create nodes yourself, use state.applyData if needed
• 40e1d29 Change to remove all, one helpers
  migrate: if you make your own handles, use state.all, state.one
• 1894044 Change to remove H type
  migrate: use State
• e804231 Change to remove complex-types.d.ts
  migrate: use main module
• 4df5d41 Change to deep clone passed through nodes
  migrate: should be fine

Types

• 52905eb Add smarter types for passThrough
  migrate: type your mdast/hast nodes by extending the content interfaces
• 6f555a0 Add supported data fields to Data of mdast
  migrate: pass correct values in node.data

Fix

• 3e300ea Fix to keep content around for hName on text

Full Changelog: syntax-tree/mdast-util-to-hast@12.3.0...13.0.0

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Zurich, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

This PR will trigger a patch release when merged.