chore(deps): bump the npm-production group with 2 updates

[dependabot]

Bumps the npm-production group with 2 updates: marked and n3.

Updates marked from 18.0.11 to 18.0.14

Release notes

Sourced from marked's releases.

v18.0.14

18.0.14 (2026-09-22)

Bug Fixes

• allow indented lines in setext heading text (#4095) (7d05530)
• decode numeric character references in text (#4076) (cead8de)
• keep text after empty nested blockquote (#4101) (1b89557), closes #4098
• preserve internal tabs in list item content (#4086) (e136da7)
• strip whitespace when normalizing link reference labels (#4091) (c7ee43a)
• support GFM protocol autolinks (#4067) (7f7a496)

v18.0.13

18.0.13 (2026-09-12)

Bug Fixes

• allow tabs in the thematic break that ends a list item (#4087) (afbb27c)
• avoid O(n^2) scanning in reflinkSearch (#4090) (c6a25bb)
• case fold reference link labels (#4077) (aed9336)
• drop the leading whitespace after a hard line break (#4075) (123ce04)
• match html block start conditions when ending a list item (#4072) (c2facac)
• respect raw tokens when closing link labels (#4066) (ef394f7)
• strip a tab that follows spaces in an indented code block (#4080) (dbb393d)

v18.0.12

18.0.12 (2026-09-07)

Bug Fixes

• allow a tab before the closing sequence of an ATX heading (#4084) (4417582)
• allow one more level of nested brackets in a link label (#4064) (37b28d8)
• do not add a newline to an empty code block (#4073) (23b1706)
• escape character references in autolink destinations (#4053) (8f432f0)
• reject GFM email autolink when the domain ends in _ or - (#4063) (df57534)
• reject invalid characters in HTML tag names (#4083) (300bb1d)
• remove up to the fence indentation from each content line (#4074) (0244f08)

Commits

• ef0704c chore(release): 18.0.14 [skip ci]
• 23c82ad chore: update deps (#4108)
• 1b89557 fix: keep text after empty nested blockquote (#4101)
• 7f7a496 fix: support GFM protocol autolinks (#4067)
• 5196d98 docs: add commonmark and gfm as versions in demo (#4094)
• de2320a docs: add marked-gitlab to known extensions (#4092)
• 7d05530 fix: allow indented lines in setext heading text (#4095)
• c7ee43a fix: strip whitespace when normalizing link reference labels (#4091)
• cead8de fix: decode numeric character references in text (#4076)
• e136da7 fix: preserve internal tabs in list item content (#4086)
• Additional commits viewable in compare view

Updates n3 from 2.6.4 to 2.7.12

Release notes

Sourced from n3's releases.

v2.7.12

2.7.12 (2026-09-06)

Bug Fixes

• lexer: report precise reusable source ranges (#721) (fa82a61)

v2.7.11

2.7.11 (2026-09-06)

Performance Improvements

• lexer: avoid match arrays for fixed tokens (#729) (0777d2e)

v2.7.10

2.7.10 (2026-09-06)

Performance Improvements

• lexer: dispatch separators by character (#727) (73b38b3)

v2.7.9

2.7.9 (2026-09-05)

Performance Improvements

• lexer: identify literal delimiters with direct checks (#728) (824bdaf)

v2.7.8

2.7.8 (2026-09-05)

Performance Improvements

• lexer: recognize direction markers without regex matching (#726) (e4e2148)

v2.7.7

2.7.7 (2026-09-05)

Bug Fixes

• stream-parser: initialize the readable object-mode buffer (#723) (4607e09), closes hi#water

v2.7.6

2.7.6 (2026-09-05)

... (truncated)

Commits

• fa82a61 fix(lexer): report precise reusable source ranges (#721)
• 0777d2e perf(lexer): avoid match arrays for fixed tokens (#729)
• 73b38b3 perf(lexer): dispatch separators by character (#727)
• 824bdaf perf(lexer): identify literal delimiters with direct checks (#728)
• e4e2148 perf(lexer): recognize direction markers without regex matching (#726)
• 4607e09 fix(stream-parser): initialize the readable object-mode buffer (#723)
• 10f78e4 perf(lexer): skip unescaping strings without backslashes (#725)
• 4788065 fix(stream-parser): respect backpressure when importing readable streams (#724)
• 10eafd3 fix(lexer): ignore stale callbacks after reuse (#722)
• 8585618 fix(store): handle deletions during iteration (#720)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[jfrench9]

Runtime minors/patches (marked 18.0.14, n3 2.7.12), lockfile only. CI green.