[chrisjsewell]

Release 0.7.0: the security and bug-fix release for #143, plus the new section_ref plugin.

This PR only writes the changelog entry (CHANGELOG.md).
__version__ has said 0.7.0 since #146 and is the only version the package keeps.

The entry is dated 2026-11-10: re-date it to the tag day before merging if the tag is later.

What the entry covers

Every PR merged since v0.6.1, grouped as Upgrade notes, 🔒 Security, ✨ New, 🐛 Fixes, 📚 Documentation and 🔧 Maintenance,
with external contributors credited.
The upgrade notes give the new markdown-it-py >= 3.0 floor (#170) and list each change of rendered output:
the stricter attrs defaults, the escaping in five plugin renderers, the anchors ids, attrs.parse.parse() raising on an unterminated group,
and the section_ref token shape becoming public API.

Checks run on this branch

• pytest: 728 passed, 3 skipped, 1 xfailed (Python 3.13, markdown-it-py 4.2.0); 648 passed, 3 skipped, 1 xfailed at the floor (Python 3.10, markdown-it-py 3.0.0).
• CI green on Python 3.10–3.14, PyPy 3.10 and the markdown-it-py 3.0.0 floor job.
• pre-commit run --all-files: clean.
• Docs: sphinx-build -nW --keep-going clean (Python 3.13, Sphinx 9.2).
• python -m build and twine check --strict dist/*: both distributions pass; the wheel requires markdown-it-py>=3.0.0,<5.0.0, and the workflow's tag check accepts v0.7.0.
• MyST-Parser master's full suite with this branch and markdown-it-py master installed: 1514 passed, 11 skipped,
  including test_attributes[32-list-style] (the {style=...} list syntax still works).

Release checklist

• Publishing set-up: the PyPI trusted publisher for tests.yml / environment pypi is registered;
  gh api repos/executablebooks/mdit-py-plugins/environments shows pypi with one deployment policy, v* (tag), and no required reviewers.
• Squash-merge this PR with the message below.
• Tag the squash commit: git tag v0.7.0 <sha> && git push origin v0.7.0.
• The publish job is green (the first trusted-publishing upload for this project).
  If it fails, fix the configuration and re-run the job; never re-tag.
• Provenance: https://pypi.org/integrity/mdit-py-plugins/0.7.0/mdit_py_plugins-0.7.0-py3-none-any.whl/provenance returns 200
  (and the same for mdit_py_plugins-0.7.0.tar.gz).
• Draft the GitHub Release v0.7.0 from this changelog entry.
• Read the Docs builds the tag, and stable points at 0.7.0.
• Release markdown-it-py 4.3.0 the same day.
• Publish the GitHub security advisories for Reporting security vulnerabilities #143, crediting @KrisKennawayDD and @KyleKing.
• conda-forge (conda-forge/mdit-py-plugins-feedstock): the run requirement changes markdown-it-py >=2.0.0,<5.0.0 → >=3.0.0,<5.0.0 (🔧 MAINTAIN: require markdown-it-py >= 3.0, test the floor and Python 3.14 #170);
  update the recipe by hand, since the autotick bot does not change run requirements. The host flit-core >=3.4,<4 and python_min 3.10 are unchanged.
• After the release: revoke the old PyPI API token and delete the PYPI_KEY secret;
  file the follow-up issues (texmath equation numbers never rendered, two dollarmath overrun cases, texmath \( quadratic scan, attrs newline-in-quoted-value and full-line check);
  bump MyST-Parser's mypy pin to mdit-py-plugins~=0.7.0.

Squash commit

Title: 🚀 RELEASE: v0.7.0 (#171)

Write the 0.7.0 changelog entry: the #143 security fixes (renderer
escaping, stricter attrs defaults, ReDoS), the gfm_autolink and texmath
hang fixes, the section_ref plugin, the markdown-it-py >= 3.0 floor,
and upgrade notes for every change of rendered output.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.66%. Comparing base (d11bdaf) to head (6669918).
⚠️ Report is 36 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #171      +/-   ##
==========================================
+ Coverage   92.80%   94.66%   +1.86%     
==========================================
  Files          31       40       +9     
  Lines        1835     2325     +490     
==========================================
+ Hits         1703     2201     +498     
+ Misses        132      124       -8     

Flag	Coverage Δ
pytests	94.66% <ø> (+1.86%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.