[ixuz]

What and why

Markdown shows bidi controls, zero-width characters and other hidden characters in code and link text as markers. Markup nested past MAX_DEPTH is shown as its source instead, and that source kept them as written. So code nested that deep, and the text of a link one level above it, could read other than it is written, with no marker. The Studio check named such code only as tooDeep. Text past MAX_CHARS or MAX_WORK, which the app shows as plain text, also kept them as written, code included.

What changes:

• What nests past MAX_DEPTH, raw HTML (in a link's text too) and a table past its caps all show as their source, and that source now shows its hidden characters as markers.
• Markdown past the parser's limits, shown as plain text, shows them as markers too. Text in the plain format, which is not Markdown, keeps them as written.
• A link whose own text would nest past MAX_DEPTH shows as its source rather than as a followed link, so a followed link's own text is never source.
• inspectMarkdown notes code or a link shown as source that holds hidden characters, and markdownProblems names them as hiddenControl, so the check matches what the app shows.

Behavior changes worth knowing:

• Markdown past the limits now shows every format character as a marker, legitimate ones such as a Persian ZWNJ or an emoji ZWJ sequence included.
• A link nested six quotes deep is no longer followed.

docs/markdown.md describes the rule. The tests write the characters as \u escapes.

Refs: GHSA-9wqg-2c2v-j9v8