Merge branch 'develop' into master

Author: tivie

dist/showdown.esm.js

@@ -1,4 +1,4 @@
-/*! showdown v 3.0.0-rc2 - 04-07-2026 */
+/*! showdown v 3.0.0-rc2 - 05-07-2026 */
 const showdown = (function () {
 // noinspection HtmlRequiredLangAttribute
 
@@ -4227,6 +4227,10 @@ showdown.subParser('makehtml.cmInline', function (text, options, globals) {
   const reEntity = /&(?:#[0-9]{1,7}|#[xX][0-9a-fA-F]{1,6}|[a-zA-Z][a-zA-Z0-9]*);/y;
   // eslint-disable-next-line no-control-regex -- CommonMark autolinks exclude control chars (\x00-\x20) per spec
   const reAutoUri = /<[A-Za-z][A-Za-z0-9+.-]{1,31}:[^<>\x00-\x20]*>/y;
+  // Showdown extension: <www...> angle autolinks (cmark-gfm does not autolink these, but the
+  // explicit <> is unambiguous user intent). Single variable class → linear / ReDoS-safe.
+  // eslint-disable-next-line no-control-regex -- same control-char exclusion as reAutoUri
+  const reAutoWww = /<www\.[^<>\x00-\x20]+>/y;
   const reAutoEmail = /<[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*>/y;
   const reRawHtml = new RegExp('(?:' + showdown.helper.regexes.cmHTMLTagSource + ')', 'y');
 
@@ -4273,8 +4277,15 @@ showdown.subParser('makehtml.cmInline', function (text, options, globals) {
       // An explicit scheme (http/https/ftp) does not require the host to contain a dot;
       // a `www.` shortcut does (and is domain-validated below).
       let nakedUrlRegex = /([_*~]*?)((?:(?:https?|ftp):\/\/[^\s<>"'`´]+|www\.[^\s<>"'`´.-][^\s<>"'`´]*?\.[a-z\d.]+[^\s<>"']*))\1/gi;
-      text = text.replace(nakedUrlRegex, function (wholeMatch, leadingMDChars, url) {
+      text = text.replace(nakedUrlRegex, function (wholeMatch, leadingMDChars, url, offset, fullText) {
         let isWww = /^www\./i.test(url);
+        // GFM boundary rule: a "www." autolink (unlike a scheme URL) is not recognized when
+        // preceded by "<". By this pass "<" has been escaped to "&lt;", so a www match sitting
+        // right after it (e.g. the interior of a malformed <www.x.com foo> the angle recognizer
+        // could not consume) is left untouched — matching cmark-gfm, which links <https://x bim>
+        // but not <www.x bim>.
+        let urlStart = offset + leadingMDChars.length;
+        if (isWww && fullText.substring(urlStart - 4, urlStart) === '&lt;') { return wholeMatch; }
         // we now will start traversing the url from the front to back, looking for punctuation chars [_*~,;:.!?\)\]]
         const len = url.length;
         let suffix = '';
@@ -4957,6 +4968,24 @@ showdown.subParser('makehtml.cmInline', function (text, options, globals) {
       }
       return {html: showdown.helper._hashHTMLSpan('<a href="' + href + '">' + txt + '</a>', globals), end: i + email[0].length};
     }
+    // Showdown extension: <www...> angle autolink. Applies the GFM www rule (http(s)://
+    // prepend + domain validation) to the explicitly delimited form. Active whenever
+    // cmSpec is on (the early `!options.cmSpec` guard above already scopes this).
+    reAutoWww.lastIndex = i;
+    let www = reAutoWww.exec(str);
+    if (www) {
+      let raw = www[0].slice(1, -1),
+          host = raw.split(/[/?#]/)[0];
+      // GFM www rule: the domain after "www." must contain a period, plus the shared host
+      // validation (>= 2 labels, last two labels have no "_").
+      if (host.slice(4).indexOf('.') !== -1 && validAutolinkHost(raw, true)) {
+        let full = (options.httpsAutoLinks ? 'https://' : 'http://') + raw,
+            href = showdown.helper.cmEncodeURI(full).replace(/&/g, '&amp;');
+        // safeMode: neutralize dangerous schemes but keep the visible text
+        if (options.safeMode && !showdown.helper.isSafeUrl(full)) { href = ''; }
+        return {html: showdown.helper._hashHTMLSpan('<a href="' + href + '">' + escapeAngles(raw) + '</a>', globals), end: i + www[0].length};
+      }
+    }
     return null;
   }
 
@@ -12704,9 +12733,7 @@ showdown.subParser('makehtml.table', function (text, options, globals) {
     headerText = headerText.trim();
     headerText = showdown.subParser('makehtml.spanGamut')(headerText, options, globals);
 
-    // support both tablesHeaderId and tableHeaderId due to error in documentation so we don't break backwards compatibility
-    // TODO think about this option!!! and remove backwards compatibility
-    if (options.tablesHeaderId || options.tableHeaderId) {
+    if (options.tablesHeaderId) {
       attributes.id = headerText.replace(/ /g, '_').toLowerCase();
     }
     return '<th' + showdown.helper._populateAttributes(attributes) + '>' + headerText + '</th>\n';

dist/showdown.esm.min.js

@@ -1,4 +1,4 @@
-;/*! showdown v 3.0.0-rc2 - 04-07-2026 */
+;/*! showdown v 3.0.0-rc2 - 05-07-2026 */
 (function(){
 // noinspection HtmlRequiredLangAttribute
 
@@ -4227,6 +4227,10 @@ showdown.subParser('makehtml.cmInline', function (text, options, globals) {
   const reEntity = /&(?:#[0-9]{1,7}|#[xX][0-9a-fA-F]{1,6}|[a-zA-Z][a-zA-Z0-9]*);/y;
   // eslint-disable-next-line no-control-regex -- CommonMark autolinks exclude control chars (\x00-\x20) per spec
   const reAutoUri = /<[A-Za-z][A-Za-z0-9+.-]{1,31}:[^<>\x00-\x20]*>/y;
+  // Showdown extension: <www...> angle autolinks (cmark-gfm does not autolink these, but the
+  // explicit <> is unambiguous user intent). Single variable class → linear / ReDoS-safe.
+  // eslint-disable-next-line no-control-regex -- same control-char exclusion as reAutoUri
+  const reAutoWww = /<www\.[^<>\x00-\x20]+>/y;
   const reAutoEmail = /<[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*>/y;
   const reRawHtml = new RegExp('(?:' + showdown.helper.regexes.cmHTMLTagSource + ')', 'y');
 
@@ -4273,8 +4277,15 @@ showdown.subParser('makehtml.cmInline', function (text, options, globals) {
       // An explicit scheme (http/https/ftp) does not require the host to contain a dot;
       // a `www.` shortcut does (and is domain-validated below).
       let nakedUrlRegex = /([_*~]*?)((?:(?:https?|ftp):\/\/[^\s<>"'`´]+|www\.[^\s<>"'`´.-][^\s<>"'`´]*?\.[a-z\d.]+[^\s<>"']*))\1/gi;
-      text = text.replace(nakedUrlRegex, function (wholeMatch, leadingMDChars, url) {
+      text = text.replace(nakedUrlRegex, function (wholeMatch, leadingMDChars, url, offset, fullText) {
         let isWww = /^www\./i.test(url);
+        // GFM boundary rule: a "www." autolink (unlike a scheme URL) is not recognized when
+        // preceded by "<". By this pass "<" has been escaped to "&lt;", so a www match sitting
+        // right after it (e.g. the interior of a malformed <www.x.com foo> the angle recognizer
+        // could not consume) is left untouched — matching cmark-gfm, which links <https://x bim>
+        // but not <www.x bim>.
+        let urlStart = offset + leadingMDChars.length;
+        if (isWww && fullText.substring(urlStart - 4, urlStart) === '&lt;') { return wholeMatch; }
         // we now will start traversing the url from the front to back, looking for punctuation chars [_*~,;:.!?\)\]]
         const len = url.length;
         let suffix = '';
@@ -4957,6 +4968,24 @@ showdown.subParser('makehtml.cmInline', function (text, options, globals) {
       }
       return {html: showdown.helper._hashHTMLSpan('<a href="' + href + '">' + txt + '</a>', globals), end: i + email[0].length};
     }
+    // Showdown extension: <www...> angle autolink. Applies the GFM www rule (http(s)://
+    // prepend + domain validation) to the explicitly delimited form. Active whenever
+    // cmSpec is on (the early `!options.cmSpec` guard above already scopes this).
+    reAutoWww.lastIndex = i;
+    let www = reAutoWww.exec(str);
+    if (www) {
+      let raw = www[0].slice(1, -1),
+          host = raw.split(/[/?#]/)[0];
+      // GFM www rule: the domain after "www." must contain a period, plus the shared host
+      // validation (>= 2 labels, last two labels have no "_").
+      if (host.slice(4).indexOf('.') !== -1 && validAutolinkHost(raw, true)) {
+        let full = (options.httpsAutoLinks ? 'https://' : 'http://') + raw,
+            href = showdown.helper.cmEncodeURI(full).replace(/&/g, '&amp;');
+        // safeMode: neutralize dangerous schemes but keep the visible text
+        if (options.safeMode && !showdown.helper.isSafeUrl(full)) { href = ''; }
+        return {html: showdown.helper._hashHTMLSpan('<a href="' + href + '">' + escapeAngles(raw) + '</a>', globals), end: i + www[0].length};
+      }
+    }
     return null;
   }
 
@@ -12704,9 +12733,7 @@ showdown.subParser('makehtml.table', function (text, options, globals) {
     headerText = headerText.trim();
     headerText = showdown.subParser('makehtml.spanGamut')(headerText, options, globals);
 
-    // support both tablesHeaderId and tableHeaderId due to error in documentation so we don't break backwards compatibility
-    // TODO think about this option!!! and remove backwards compatibility
-    if (options.tablesHeaderId || options.tableHeaderId) {
+    if (options.tablesHeaderId) {
       attributes.id = headerText.replace(/ /g, '_').toLowerCase();
     }
     return '<th' + showdown.helper._populateAttributes(attributes) + '>' + headerText + '</th>\n';

dist/showdown.esm.min.js.map

@@ -43,7 +43,7 @@ CommonMark spec:
 | Area            | What it does                                                                                                                                                               |
 |-----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | Emphasis        | Parse emphasis / strong emphasis with the CommonMark delimiter-run (flanking) algorithm.                                                                                   |
-| Autolinks       | Recognize CommonMark autolinks `<scheme:uri>` and `<email>` without entity-encoding.                                                                                       |
+| Autolinks       | Recognize CommonMark autolinks `<scheme:uri>` and `<email>` without entity-encoding, plus `<www.…>` (a Showdown extension — see [Known differences](#known-differences)).   |
 | Links & images  | Parse links, images and link reference definitions per the spec (balanced-paren and `<...>` destinations, backslash escapes, in-URL entity decoding, alt-text flattening). |
 | Inline raw HTML | Recognize inline raw HTML with the strict CommonMark grammar; malformed tags are escaped instead of passed through.                                                        |
 | HTML blocks     | Recognize HTML blocks using the 7 CommonMark block types instead of Showdown's balanced-tag matching.                                                                      |
@@ -141,6 +141,34 @@ Showdown emits both the bare language name and the `language-`-prefixed class.
     </code></pre>
     ```
 
+### Angle-bracket `www.` autolinks
+
+CommonMark only autolinks `<…>` content that is a full URI with a scheme (e.g.
+`<https://example.com>`) or an email address. `<www.example.com>` has no scheme, so the spec leaves
+it as literal text. Showdown instead treats the explicit angle brackets as unambiguous user intent
+and links it, applying the GFM `www.` autolink rule (`http://` prefix, `https://` with
+[`httpsAutoLinks`](options.md#httpsautolinks), plus domain validation). This also matches Showdown's
+default (legacy) flavor, which has always linked `<www.…>`. Note this is a deliberate divergence from
+**cmark-gfm** too, which likewise leaves `<www.…>` as text.
+
+=== "input"
+
+    ```md
+    <www.example.com>
+    ```
+
+=== "Showdown output"
+
+    ```html
+    <p><a href="http://www.example.com">www.example.com</a></p>
+    ```
+
+=== "CommonMark output"
+
+    ```html
+    <p>&lt;www.example.com&gt;</p>
+    ```
+
 ### Other intentional deviations
 
 A few spec examples are intentionally not followed because they are self-contradictory, malformed,

dist/showdown.js

@@ -36,7 +36,9 @@ task lists, strikethrough, autolink literals, `@`-mentions, emoji, [footnotes](o
 * **Tables** — pipe tables with per-column alignment.
 * **Task lists** — `- [ ]` / `- [x]` checkboxes.
 * **Strikethrough** — `~~text~~`.
-* **Autolink literals** — bare URLs become links without `<>`.
+* **Autolink literals** — bare URLs become links without `<>`. Showdown additionally links
+  `<www.…>` inside angle brackets (a deviation from the spec and cmark-gfm — see
+  [Known differences](commonmark.md#known-differences)).
 * **`@`-mentions** and **emoji** (`:smile:`).
 * **[Footnotes](options.md#footnotes)** — `[^id]` references and definitions (also reversible via
   [`makeMarkdown`](html-to-markdown.md#feature-options-matching-makehtml)).
@@ -45,7 +47,8 @@ task lists, strikethrough, autolink literals, `@`-mentions, emoji, [footnotes](o
 
 Because the flavor uses the CommonMark base, **every
 [CommonMark known difference](commonmark.md#known-differences) also applies to `gfm`** — empty ATX
-headings, the dual fenced-code language classes, and the malformed thematic-break examples included.
+headings, the dual fenced-code language classes, angle-bracket `<www.…>` autolinks, and the malformed
+thematic-break examples included.
 The items below are the additional, intentional deviations specific to the GFM table extension.
 
 ### Table column alignment

dist/showdown.min.js

@@ -34,6 +34,10 @@ showdown.subParser('makehtml.cmInline', function (text, options, globals) {
   const reEntity = /&(?:#[0-9]{1,7}|#[xX][0-9a-fA-F]{1,6}|[a-zA-Z][a-zA-Z0-9]*);/y;
   // eslint-disable-next-line no-control-regex -- CommonMark autolinks exclude control chars (\x00-\x20) per spec
   const reAutoUri = /<[A-Za-z][A-Za-z0-9+.-]{1,31}:[^<>\x00-\x20]*>/y;
+  // Showdown extension: <www...> angle autolinks (cmark-gfm does not autolink these, but the
+  // explicit <> is unambiguous user intent). Single variable class → linear / ReDoS-safe.
+  // eslint-disable-next-line no-control-regex -- same control-char exclusion as reAutoUri
+  const reAutoWww = /<www\.[^<>\x00-\x20]+>/y;
   const reAutoEmail = /<[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*>/y;
   const reRawHtml = new RegExp('(?:' + showdown.helper.regexes.cmHTMLTagSource + ')', 'y');
 
@@ -80,8 +84,15 @@ showdown.subParser('makehtml.cmInline', function (text, options, globals) {
       // An explicit scheme (http/https/ftp) does not require the host to contain a dot;
       // a `www.` shortcut does (and is domain-validated below).
       let nakedUrlRegex = /([_*~]*?)((?:(?:https?|ftp):\/\/[^\s<>"'`´]+|www\.[^\s<>"'`´.-][^\s<>"'`´]*?\.[a-z\d.]+[^\s<>"']*))\1/gi;
-      text = text.replace(nakedUrlRegex, function (wholeMatch, leadingMDChars, url) {
+      text = text.replace(nakedUrlRegex, function (wholeMatch, leadingMDChars, url, offset, fullText) {
         let isWww = /^www\./i.test(url);
+        // GFM boundary rule: a "www." autolink (unlike a scheme URL) is not recognized when
+        // preceded by "<". By this pass "<" has been escaped to "&lt;", so a www match sitting
+        // right after it (e.g. the interior of a malformed <www.x.com foo> the angle recognizer
+        // could not consume) is left untouched — matching cmark-gfm, which links <https://x bim>
+        // but not <www.x bim>.
+        let urlStart = offset + leadingMDChars.length;
+        if (isWww && fullText.substring(urlStart - 4, urlStart) === '&lt;') { return wholeMatch; }
         // we now will start traversing the url from the front to back, looking for punctuation chars [_*~,;:.!?\)\]]
         const len = url.length;
         let suffix = '';
@@ -764,6 +775,24 @@ showdown.subParser('makehtml.cmInline', function (text, options, globals) {
       }
       return {html: showdown.helper._hashHTMLSpan('<a href="' + href + '">' + txt + '</a>', globals), end: i + email[0].length};
     }
+    // Showdown extension: <www...> angle autolink. Applies the GFM www rule (http(s)://
+    // prepend + domain validation) to the explicitly delimited form. Active whenever
+    // cmSpec is on (the early `!options.cmSpec` guard above already scopes this).
+    reAutoWww.lastIndex = i;
+    let www = reAutoWww.exec(str);
+    if (www) {
+      let raw = www[0].slice(1, -1),
+          host = raw.split(/[/?#]/)[0];
+      // GFM www rule: the domain after "www." must contain a period, plus the shared host
+      // validation (>= 2 labels, last two labels have no "_").
+      if (host.slice(4).indexOf('.') !== -1 && validAutolinkHost(raw, true)) {
+        let full = (options.httpsAutoLinks ? 'https://' : 'http://') + raw,
+            href = showdown.helper.cmEncodeURI(full).replace(/&/g, '&amp;');
+        // safeMode: neutralize dangerous schemes but keep the visible text
+        if (options.safeMode && !showdown.helper.isSafeUrl(full)) { href = ''; }
+        return {html: showdown.helper._hashHTMLSpan('<a href="' + href + '">' + escapeAngles(raw) + '</a>', globals), end: i + www[0].length};
+      }
+    }
     return null;
   }
 

dist/showdown.min.js.map

@@ -340,9 +340,7 @@ showdown.subParser('makehtml.table', function (text, options, globals) {
     headerText = headerText.trim();
     headerText = showdown.subParser('makehtml.spanGamut')(headerText, options, globals);
 
-    // support both tablesHeaderId and tableHeaderId due to error in documentation so we don't break backwards compatibility
-    // TODO think about this option!!! and remove backwards compatibility
-    if (options.tablesHeaderId || options.tableHeaderId) {
+    if (options.tablesHeaderId) {
       attributes.id = headerText.replace(/ /g, '_').toLowerCase();
     }
     return '<th' + showdown.helper._populateAttributes(attributes) + '>' + headerText + '</th>\n';