fix: preserve enclosing link state after parsing images

[snooze26h]

Marked version: 18.0.14 (original reproduction at c61543ed0f16121ace9255626abcafe9514cb1b0)

Markdown flavor: GitHub Flavored Markdown

Description

An image inside a link resets the lexer's inLink state to false. A following bare URL or email address is then autolinked inside the enclosing link, producing nested <a> elements and changing the document's clickable destinations.

This continues #4116, which was approved before its source fork was deleted during repository cleanup. The fork and the identical reviewed commits have been restored, but GitHub would not reopen the original PR. The head remains 00073f9e91ebab73a67949cc9e9cf02de2dc8a84, including both requested test adjustments.

[![logo](logo.png) www.example.com](https://target.example)

Expected:

<p><a href="https://target.example"><img src="logo.png" alt="logo"> www.example.com</a></p>

Current output:

<p><a href="https://target.example"><img src="logo.png" alt="logo"> <a href="http://www.example.com">www.example.com</a></a></p>

Save and restore the enclosing inLink value around the recursive label tokenization. Add a regression fixture in test/specs/new covering six inputs: bare URLs, email addresses, reference links/images, nested images, and normal autolinking after the enclosing link ends. Five of the inputs produce nested anchors before the fix.

This covers the state restoration left outside the scope of #4051. The trailing-URL test also checks the behavior fixed in #2186.

Validation

The restored head was merged locally with current master (c18a64fa5e8c97cb92a8ea709a4542ea94b1c740) in an isolated worktree, with no conflicts.

On Node.js 24.20.0 (macOS arm64), npm ci --ignore-scripts --no-audit --no-fund and npm test passed: 1,865 specification tests and 193 unit tests, plus documentation/build generation, UMD/CJS checks, TypeScript checks, and lint. The regression fixture uses the standard HTML differ and was verified to fail against the pre-fix tokenizer.

Contributor

• Tests exist to ensure functionality and minimize regression.
• No new feature or public API change requiring documentation.

Committer

• CI is green.
• Squash and merge following conventional commit guidelines.

[vercel]

@snooze26h is attempting to deploy a commit to the MarkedJS Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
marked-website	Ready	Preview	Oct 2, 2026 5:44pm UTC

[UziTech]

Thanks! 💯

[snooze26h]

Thank you for your patience and for reviewing the fix again, @UziTech. I'm sorry for the confusion and extra work caused by deleting my fork before the original PR was merged. I really appreciate your helpful feedback.

[nrps9909]

Verified exact head 00073f9 against current base c18a64f and GitHub merge preview 038f750 (parents checked).

The new fixture reproduces the issue on unmodified base: five of its six paragraphs produce nested anchors; the trailing-autolink control passes. Applying just the fixture to base fails the repository's standard HTML differ. The head and merge preview pass all six paragraphs.

• Complete npm test passes on exact head: 1,863 specification tests / 193 unit tests. The current-base merge preview passes 1,865 / 193, including the latest main-branch regressions. Documentation/build generation, UMD/CJS, type/package checks and lint pass in both. Unmodified base also passes its full existing suite.
• An independent corpus covers 3,456 distinct Markdown inputs × GFM on/off = 6,912 observations per implementation: inline/full/collapsed/shortcut-reference and nested images, link references, emphasis/strong/strikethrough, URL/email positions, and autolinks after the enclosing link. Base has 2,304 nested-anchor/destination violations; head and merge preview have zero. Across head and preview, 9,216 control token streams and HTML outputs remain identical to base.
• Eight seeded image-tokenization state cases per implementation verify restoration of inLink and linkEmitted, including nested images. Serialized anchor depth/destinations are checked directly; this is not browser-DOM or exhaustive CommonMark/GFM conformance evidence.

Runtime: Node 24.15.0 / npm 12.0.2. The first clean install stopped at npm 12's default remote-tarball restriction. After inspecting the sole non-registry dependency (@markedjs/testutils' locked Marked v18.0.11 test corpus), installation succeeded with a per-command remote opt-in, lockfile integrity checks and lifecycle scripts disabled. No global npm configuration or source/lockfile changes were made; temporary base fixtures and merge-preview dependency links were removed.

Approving this tested state-restoration change at the recorded head. The PR remains open; this review is not merge evidence.

AI assistance disclosure: OpenAI Codex assisted with inspecting the state change, designing and running the independent corpus, executing the listed checks, and drafting this review. Results and scope were checked against the recorded commits.

[styfle]

Thanks!