chore(deps-dev): bump the development group across 1 directory with 2 updates

[dependabot]

Bumps the development group with 2 updates in the / directory: markdown-it and markdown-it-anchor.

Updates markdown-it from 14.2.0 to 14.3.0

Changelog

Sourced from markdown-it's changelog.

[14.3.0] - 2026-07-02

Changed

• Reworked build pipeline & tools.
• Added source maps.
• Bumped linkify-it to 5.0.2.

Fixed

• Preserve backslash-space hard line breaks, matching CommonMark 6.7, #1185.

Commits

• ff0ee08 14.3.0 released
• 52e2749 Bump linkify-it / vite deps
• 56c2404 fix: keep backslash-space hard line break (CommonMark 6.7) (#1185)
• 0fbb18b Bump vite from 8.0.14 to 8.0.16 (#1181)
• 83450e2 Rework benchmark deps and bump versions
• 57a6863 benchmark => tinybench
• 7608db1 Update CI config
• 9d8eb42 Added package-lock and updated versions to latest possible
• 0aee70d lint: enable @​stylistic/no-multi-spaces rule
• 8878985 lint => neostandard
• Additional commits viewable in compare view

Updates markdown-it-anchor from 9.2.0 to 9.2.1

Changelog

Sourced from markdown-it-anchor's changelog.

[9.2.1] - 2026-07-06

• Preserve level of inline token in headerLink. (#138)

Commits

• 174c136 9.2.1
• 0e534e2 Preserve level of inline token in headerLink (fixes #138)
• See full diff in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	markdown-it@​14.2.0 ⏵ 14.3.0				-1
	markdown-it-anchor@​9.2.0 ⏵ 9.2.1				+7

View full report

[steipete]

Validated exact head af9483c against current main after #99.

• Freshness: markdown-it 14.3.0 and markdown-it-anchor 9.2.1 remain current; registry integrity matches the lockfile; npm outdated is empty.
• Local proof: npm ci resolved the lockfile; npm audit reports 0 vulnerabilities; syntax checks, unit tests, Wrangler dry-run, full docs build, smoke, visual smoke, R2 preparation, and llms-full generation all pass.
• Build evidence: 27,970 pages rendered; 14,331 pages indexed across 21 languages; R2 manifest prepared 60,606 objects; llms-full generated 714 pages.
• Black-box proof: English/localized pages, heading anchors, Pagefind, emitted Markdown, 404 handling, and CommonMark hard-break behavior passed; the public hosted getting-started route returned 200.
• Review/CI: final autoreview reported no accepted/actionable findings; exact-head Docs Code CI, CodeQL, and Socket checks pass; Mintlify correctly skipped.
• Risk: medium surface area because the parser affects every rendered page, reduced by full build, visual, hosted, and source-blind validation.

[steipete]

Post-merge verification:

• Landed on main as 75ab342 with Dependabot preserved as author.
• Main CodeQL passed: https://github.com/openclaw/docs/actions/runs/29167918326
• Automatic R2 Pages stopped before credentials, upload, Worker deploy, or live-smoke dispatch: https://github.com/openclaw/docs/actions/runs/29167918343
• The failure is the pre-existing internal-route audit for 20 localized plugin-inventory links targeting the retired codex-supervisor route. Identical failures occurred before this dependency merge on https://github.com/openclaw/docs/actions/runs/29167720277 and https://github.com/openclaw/docs/actions/runs/29167579019.

The dependency change is not implicated; no deployment occurred from the failed run.