markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression

Description

A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.

Recommendation

Update the markdown-it package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 15.0.0, < 15.0.3

  >= 14.1.0, < 14.3.3**

• Patched version(s): **15.0.3

  14.3.3**

References

• GHSA-gfr2-rv44-r23c
• CVE-2026-111758
• CWE-400
• CWE-407
• CAPEC-310