fix(parse/html): fix panic caused by malformed tag <12

[dyc3]

Summary

This PR fixes a crash in the HTML parser caused by trying to parse <1 as a tag. Now we correctly emit an error for this case.

generated by glm-4.7

fixes #8363

Test Plan

snapshots

Docs

[changeset-bot]

🦋 Changeset detected

Latest commit: c7a0562

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 13 packages

Name	Type
@biomejs/biome	Patch
@biomejs/cli-win32-x64	Patch
@biomejs/cli-win32-arm64	Patch
@biomejs/cli-darwin-x64	Patch
@biomejs/cli-darwin-arm64	Patch
@biomejs/cli-linux-x64	Patch
@biomejs/cli-linux-arm64	Patch
@biomejs/cli-linux-x64-musl	Patch
@biomejs/cli-linux-arm64-musl	Patch
@biomejs/wasm-web	Patch
@biomejs/wasm-bundler	Patch
@biomejs/wasm-nodejs	Patch
@biomejs/backend-jsonrpc	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Walkthrough

Replaces a permissive tag-start check with a new is_tag_start_byte(byte: u8) -> bool that only treats ASCII alphabetic bytes as valid tag starts. The lexer now uses is_tag_start_byte in both InsideTag and Regular token-consumption paths to decide whether a < begins a tag, calling consume_l_angle() for valid starts and emitting an error otherwise. Adds a test case containing <div>Target <12 months</div> and a changelog entry documenting the fix for a crash when "<" is followed by a digit.

Suggested reviewers

• ematipico

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main fix: preventing a panic when the HTML parser encounters a malformed tag starting with '<' followed by a digit.
Description check	✅ Passed	The description clearly explains the motivation (fixing a crash), references the linked issue (#8363), and mentions the test approach (snapshots).
Linked Issues check	✅ Passed	The PR successfully addresses issue #8363 by replacing tag-name validation with tag-start validation, emitting a parse error instead of panicking when '<' is followed by a digit.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to fixing the HTML parser crash: lexer logic fix, test case, and changelog entry. No extraneous modifications detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch dyc3/fix-8363

Tip

🧪 Unit Test Generation v2 is now available!

We have significantly improved our unit test generation capabilities.

To enable: Add this to your .coderabbit.yaml configuration:

reviews:
  finishing_touches:
    unit_tests:
      enabled: true

Try it out by using the @coderabbitai generate unit tests command on your code files or under ✨ Finishing Touches on the walkthrough!

Have feedback? Share your thoughts on our Discord thread!

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chansuke]

lgtm