@@ -5,7 +5,9 @@ gem "posix-spawn", :platforms => :ruby
 gem "redcarpet", :platforms => :ruby
 gem "kramdown", :platforms => :jruby
 gem "RedCloth"
-gem "commonmarker", "~> 0.18.1"
+# using a tag version here because 0.18.3 was not published by the author to encourage users to upgrade.
+# however we want to bump up to this version since this has a security patch
+gem "commonmarker", git: "https://github.com/gjtorikian/commonmarker.git", tag: "v0.18.3"
 gem "rdoc", "~>3.6"
 gem "org-ruby", "= 0.9.9"
 gem "creole", "~>0.3.6"
 
@@ -1,3 +1,6 @@
+## 4.0.1 - 2022-03-07
+* Update to commonmarker 0.18.3; There isn't a version on RubyGems for this, so this is pointing to a [tag version on GitHub](https://github.com/gjtorikian/commonmarker/blob/v0.18.3/commonmarker.gemspec)
+
 ## 4.0.0 - 2021-03-31
 
 * Drop support for Python 2 in RST rendering [#1456](https://github.com/github/markup/pull/1456)
 
@@ -1,6 +1,6 @@
 module GitHub
   module Markup
-    VERSION = '4.0.0'
+    VERSION = '4.0.1'
     Version = VERSION
   end
 end
@@ -9,7 +9,7 @@ <h2>Subtitle</h2>
 </ul>
 </div>
 <a name="header-2"></a>
-<h2><a href="#id1">Header 2</a></h2>
+<h2><a href="#toc-entry-1">Header 2</a></h2>
 <ol>
 <li>Blah blah <code>code</code> blah</li>
 <li>More <code>code</code>, hooray</li>
@@ -106,7 +106,7 @@ <h2><a href="#id1">Header 2</a></h2>
 </a>
 <img alt="Coverity Scan Build Status" src="https://scan.coverity.com/projects/621/badge.svg">
 <a name="field-list"></a>
-<h2><a href="#id2">Field list</a></h2>
+<h2><a href="#toc-entry-2">Field list</a></h2>
 <table frame="void" rules="none">
 
 
@@ -131,9 +131,7 @@ <h2><a href="#id2">Field list</a></h2>
 </tr>
 </tbody>
 </table>
-
 <p><a href="mailto:someone@somewhere.org">someone@somewhere.org</a></p>
-
 <p>Press <kbd>Ctrl+C</kbd> to quit</p>
 
-<p><strong>RAW HTML!</strong></p> p {color:blue;}
+<p><strong>RAW HTML!</strong></p> p {color:blue;}