upstream: chore(deps): bump the patch-updates group across 1 directory with 2 updates (goharbor/harbor#23766)

[github-actions]

This cherry-pick had conflicts and was opened as a draft. Conflict markers may be present in the diff and must be resolved before marking ready for review.

Summary

Cherry-picks upstream Harbor commit 482bb0ef7 from goharbor/harbor#23766.

Upstream Context

• Upstream PR: chore(deps): bump the patch-updates group across 1 directory with 2 updates goharbor/harbor#23766
• Upstream commit: 482bb0ef798a1800c80176af4ab28f993b49883a
• Upstream title: chore(deps): bump the patch-updates group across 1 directory with 2 updates
• Upstream author: @app/dependabot
• Upstream merged by: @Vad1mo
• Upstream approved by: @Vad1mo, @bupd
• Upstream PR URL: chore(deps): bump the patch-updates group across 1 directory with 2 updates goharbor/harbor#23766
• Upstream commit URL: goharbor/harbor@482bb0e

Cherry-Pick Status

• Status: conflicted
• Base branch: main
• Workflow run: https://github.com/container-registry/harbor-next/actions/runs/35074845622

Upstream Description

Bumps the patch-updates group with 2 updates in the /src/portal directory: marked and karma.

Updates marked from 18.0.4 to 18.0.12

Release notes

Sourced from marked's releases.

v18.0.12

18.0.12 (2026-09-07)

Bug Fixes

• allow a tab before the closing sequence of an ATX heading (#4084) (4417582)
• allow one more level of nested brackets in a link label (#4064) (37b28d8)
• do not add a newline to an empty code block (#4073) (23b1706)
• escape character references in autolink destinations (#4053) (8f432f0)
• reject GFM email autolink when the domain ends in _ or - (#4063) (df57534)
• reject invalid characters in HTML tag names (#4083) (300bb1d)
• remove up to the fence indentation from each content line (#4074) (0244f08)

v18.0.11

18.0.11 (2026-08-24)

Bug Fixes

• do not nest a link inside a link (#4051) (e250e31)
• inlineTokens rebuilds the reflink-mask preamble per call (#4040) (0653c24)
• keep emphasis in the text of a rejected reference link (#4059) (b699db3)

v18.0.10

18.0.10 (2026-08-18)

Bug Fixes

• keep the em/strong mask the same length as the source (#4044) (681373c)
• parse EOF backtick fences after paragraphs (#4039) (81bd750)
• place task checkboxes after list loose is finalized (#4046) ([Upstream PR body truncated.]

  Review Notes

  • Generated by the upstream cherry-pick workflow.
  • One upstream commit maps to one Harbor Next PR.
  • If this PR is closed without merge, the workflow will not recreate it.

  Upstream-Commit: 482bb0ef798a1800c80176af4ab28f993b49883a
  Upstream-PR: goharbor/harbor#23766
  Cherry-Pick-Status: conflicted

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 90bfda8a-5b5e-454d-a7a9-88ee3635a5b1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}