[Snyk] Security upgrade markdownlint-cli from 0.31.1 to 0.39.0

[rramo012]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• package.json
• yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LINKIFYIT-17817062	721

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

[rramo012]

This upgrade of markdownlint-cli contains updates that drop support for an end-of-life Node.js version and introduce minor behavioral changes.

Key Changes:

• Node.js Version: Starting with v0.38.0, this package relies on an updated version of the markdownlint library which removes support for the end-of-life Node.js version 18. [3]
• CLI Behavior: Version 0.34.0 improved how directories are handled by the --ignore flag, causing it to ignore all files within the specified directory. [3]
• New Features: Support for TOML configuration files was added in v0.34.0. [3]

Recommendation:
Ensure your production environment and CI/CD pipelines are running a supported version of Node.js (v20 or newer). Review any usage of the --ignore flag with directories to confirm it aligns with the updated behavior.

Source: Release notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[claude]

Automated Review — Snyk dependency PR

Reviewed via gh pr diff. This PR only touches package.json and yarn.lock (bumping markdownlint-cli ^0.31.1 → ^0.39.0) — no markdown/docs content, sidebar configs, or OpenAPI specs are changed, so most of the standard docs checklist doesn't apply here:

• No files moved/renamed — no redirect or broken-internal-link concerns.
• No sidebar or versioned-docs changes needed — no new content added.
• Vulnerability fix confirmed — the lockfile diff shows the vulnerable linkify-it@^3.0.1 (pulled in transitively via markdown-it@12.3.2) is replaced by linkify-it@^5.0.0 via markdown-it@14.0.0, which is the actual fix for SNYK-JS-LINKIFYIT-17817062. The markdownlint-cli version bump itself is just the mechanism to pull in the patched transitive dependency.
• CI risk is low: the repo's markdown lint CI job (.github/workflows/check.yaml) uses the separate nosborn/github-action-markdown-cli action (with its own bundled markdownlint version, configured via .markdownlint.json), not the npm markdownlint-cli package being bumped here. So this change mainly affects local npm run lint / npm run lint-fix, not the CI gate.
• One thing worth a manual check before merging: markdownlint-cli 0.39.0 is a fairly large major-version jump (0.31 → 0.39) and could include new/changed lint rules. Worth running npm install && npm run lint locally once to confirm no new lint failures surface against the existing docs/ tree and .markdownlint.json config.

No inline comments needed since there's no content/markdown/config-file logic change to annotate — this is a clean, low-risk dependency security fix. Recommend running npm run lint locally to confirm no new violations, then merge.