marked 15.0.7 → 15.0.9

package/lib/marked.cjs

@@ -1,5 +1,5 @@
 /**
- * marked v15.0.7 - a markdown parser
+ * marked v15.0.9 - a markdown parser
  * Copyright (c) 2011-2025, Christopher Jeffrey. (MIT Licensed)
  * https://github.com/markedjs/marked
  */
@@ -545,6 +545,9 @@ function findClosingBracket(str, b) {
             }
         }
     }
+    if (level > 0) {
+        return -2;
+    }
     return -1;
 }
 
@@ -1111,6 +1114,10 @@ class _Tokenizer {
             else {
                 // find closing parenthesis
                 const lastParenIndex = findClosingBracket(cap[2], '()');
+                if (lastParenIndex === -2) {
+                    // more open parens than closed
+                    return;
+                }
                 if (lastParenIndex > -1) {
                     const start = cap[0].indexOf('!') === 0 ? 5 : 4;
                     const linkLen = start + cap[1].length + lastParenIndex;
@@ -1615,14 +1622,14 @@ class _Lexer {
                 }
             }
         }
-        // Mask out other blocks
-        while ((match = this.tokenizer.rules.inline.blockSkip.exec(maskedSrc)) != null) {
-            maskedSrc = maskedSrc.slice(0, match.index) + '[' + 'a'.repeat(match[0].length - 2) + ']' + maskedSrc.slice(this.tokenizer.rules.inline.blockSkip.lastIndex);
-        }
         // Mask out escaped characters
         while ((match = this.tokenizer.rules.inline.anyPunctuation.exec(maskedSrc)) != null) {
             maskedSrc = maskedSrc.slice(0, match.index) + '++' + maskedSrc.slice(this.tokenizer.rules.inline.anyPunctuation.lastIndex);
         }
+        // Mask out other blocks
+        while ((match = this.tokenizer.rules.inline.blockSkip.exec(maskedSrc)) != null) {
+            maskedSrc = maskedSrc.slice(0, match.index) + '[' + 'a'.repeat(match[0].length - 2) + ']' + maskedSrc.slice(this.tokenizer.rules.inline.blockSkip.lastIndex);
+        }
         let keepPrevChar = false;
         let prevChar = '';
         while (src) {