…n generation (#4070)

* perf: fast-fail link tokenizing when no ')' remains ahead

The inline link rule backtracks quadratically over unterminated
link sequences. '[a](b'.repeat(n) parses in O(n^2) — 97KB took
~2.5s — because at every '[' the regex's greedy unquoted-href run
re-partitions the whole remainder while hunting for a closing ')'
that never comes.

Lexer.inlineTokens now anchors one paren scan per inline run
(lastIndexOf(')') over the paragraph), and Tokenizer.link consults
it: since every src it receives during the run is a suffix of that
anchor, 'is there a ) ahead?' is O(1). When none remains the regex
cannot match anyway, so skipping is semantics-preserving; anchors
are saved/restored around nested runs (e.g. link labels) and live
in a WeakMap so they stay off the public tokenizer API.

Measured on Node 24:

  '[a](b'.repeat(20000)   ~2500ms -> ~24ms
  '[a](b'.repeat(80000)   (OOM-adjacent) -> ~60ms

Differential check: 1506 generated documents (links with titles,
balanced parens, angle destinations, images, autolinks, code spans,
reflinks + defs, nested brackets, unterminated sequences) x gfm on/
off produce byte-identical output before and after the change.

Adds test/specs/redos/quadratic_unterminated_links.cjs following
the existing guard convention; it exceeds the redos budget on
master and passes with this change.

* refactor: one paren scan per inline run via lexer state

Per review feedback: drop the WeakMap anchor machinery in favor of a
single state flag. Lexer.inlineTokens scans for ')' once per run and
stores it in state.linkParenPossible (same pattern as linkEmitted),
restoring the previous value after nested runs. Tokenizer.link bails
out only when the flag is false, which is exactly when its regex
cannot match.

This keeps the fast-fail while avoiding a repeated full-text
includes() on reflink-heavy paragraphs, where attempting link() at
every token would otherwise re-scan the remainder each time
(quadratic_inline_masking[2]: ~1.03s vs ~144ms here, upstream ~140ms).

* refactor: skip paren scan for nested runs when outer had no ')'

When the outer inline run contains no ')' (linkParenPossible=false),
a nested run's substring can't contain one either, so skip the
redundant src.includes(')') scan. Addresses UziTech's observation
on line 354: 'This also only needs to be checked if prevLinkParenPossible
is true.'

* make inner function private

Co-authored-by: Steven <steven@ceriously.com>

* Change inlineTokensInner to private method call

---------

Co-authored-by: Tony Brix <tony@brix.ninja>
Co-authored-by: Steven <steven@ceriously.com>

Bumps  and [undici](https://github.com/nodejs/undici). These dependencies needed to be updated together.

Updates `undici` from 7.29.0 to 7.30.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.29.0...v7.30.0)

Updates `undici` from 6.28.0 to 6.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.29.0...v7.30.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.30.0
  dependency-type: indirect
- dependency-name: undici
  dependency-version: 6.29.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…tion (#4106)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

# [18.1.0](v18.0.14...v18.1.0) (2026-10-05)

### Bug Fixes

* avoid cubic backtracking on unicode whitespace in a link destination ([#4106](#4106)) ([0d20220](0d20220))
* load CLI configs with top-level await ([#4100](#4100)) ([c61543e](c61543e))
* reject unbalanced parentheses in link destinations ([#4107](#4107)) ([3363c99](3363c99))

### Features

* add linkParenPossible to lexer state to fail fast for link token generation ([#4070](#4070)) ([4ee44f7](4ee44f7))