Bumps [linkify-it](https://github.com/markdown-it/linkify-it) from 5.0.1 to 5.0.2.
- [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/linkify-it@5.0.1...5.0.2)

---
updated-dependencies:
- dependency-name: linkify-it
  dependency-version: 5.0.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* docs: make the maxLength example produce a non-empty result

* Update README.md

---------

Co-authored-by: Julian Gruber <julian@juliangruber.com>

* Bound total expansion length across comma alternatives

`maxLength` was enforced in `combine`, the one place output grows, but not on
the `values` array built to feed it. Each alternative in `{a,b,c,...}` is
expanded by its own `expand_` call, so each received a full independent
`maxLength` allowance, and the results were concatenated with no running total.
With `A` alternatives, `values` could reach `A * maxLength` characters before
`combine` ever got the chance to truncate it.

A ~25 KB input with 400 alternatives grew `values` past the heap limit and
crashed the process with an uncatchable out-of-memory error, bypassing the
mitigation added in 5.0.8 for CVE-2026-14257.

Track the running result count and character length while appending
alternatives, and stop once either bound is reached.

* Apply maxLength while generating sequences

`expandSequence` was bounded by `max`, the result count, but never consulted
`maxLength`. A padded element's width follows the input, so a wide pad made it
generate `max` wide elements only for `combine` to discard nearly all of them.

Memory stays flat here, since V8 represents those padded strings as
cons-strings, which is likely why this path was not caught alongside the
memory-exhaustion issue. The cost is time instead, proportional to
`max * width`: a ~400 KB input blocked the event loop for over two minutes.

Pass `maxLength` into the generation loop and stop once the sequence's own
characters reach it. Output is byte-identical; only the discarded work is
removed. The same input now returns in ~18 ms.

* fix: don't count dropped empties against `max`

Capping the intermediate `values` array at `max` entries counted
alternatives that `combine` goes on to drop as empty, so `max` stopped
bounding the number of *kept* results: `expand('{a,,b}', { max: 2 })`
returned `['a']` where it used to return `['a', 'b']`.

Skip those values rather than counting them. The cap itself stays - it is
what bounds the array when the values are empty and so contribute no
characters for `maxLength` to see.

The pre-filter added in 688a99e only skips empty alternatives when every
accumulated prefix is still empty. Once an earlier group has put a
non-empty string into `acc`, that filter switches off and `combine`'s own
empty-result check is the only thing dropping the empties the remaining
empty prefixes produce.

Nothing exercised that path, so branch coverage sat at 98.91% and `npm
test` exited 1 on tap's coverage gate even though all tests passed.

Cover it with `{a,}{,}` and friends, which bash expands to `a a`.