From cfb2a76354499c1f0daabf7b5df875e007521aa1 Mon Sep 17 00:00:00 2001
From: mithil <mithil.katkoria@gmail.com>
Date: Tue, 1 Sep 2026 09:41:53 +0000
Subject: [PATCH] fix(util/markdown): preserve at signs in URLs (#45555)

---
 lib/util/markdown.spec.ts | 10 ++++++++++
 lib/util/markdown.ts      |  8 +++++---
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/lib/util/markdown.spec.ts b/lib/util/markdown.spec.ts
index fc55051bb3..3eb2915636 100644
--- a/lib/util/markdown.spec.ts
+++ b/lib/util/markdown.spec.ts
@@ -110,5 +110,15 @@ describe('util/markdown', () => {
         'mention @&#8203;user here',
       );
     });
+
+    it('should not add zero-width space to @ inside URLs', async () => {
+      const input =
+        'Read more at https://medium.com/@fastifyjs/fastify-v4-ga-59f2103b5f0e by @user';
+      const linkified = await linkify(input, { repository: 'some/repo' });
+
+      expect(sanitizeMarkdown(linkified)).toEqual(
+        'Read more at <https://medium.com/@fastifyjs/fastify-v4-ga-59f2103b5f0e> by [@&#8203;user](https://github.com/user)\n',
+      );
+    });
   });
 });
diff --git a/lib/util/markdown.ts b/lib/util/markdown.ts
index d15cdf765a..03106dd634 100644
--- a/lib/util/markdown.ts
+++ b/lib/util/markdown.ts
@@ -10,11 +10,13 @@ export function sanitizeMarkdown(markdown: string): string {
   // Put a zero width space after every # followed by a digit
   res = res.replace(regEx(/(\W)#(\d)/gi), '$1#&#8203;$2');
   // Put a zero width space after every @ symbol to prevent unintended hyperlinking,
-  // but leave code blocks (triple backticks) and inline code spans untouched
+  // but leave URLs, code blocks (triple backticks), and inline code spans untouched
   res = res
-    .split(regEx(/(```[\s\S]*?```|`[^`\n]*?`)/g))
+    .split(regEx(/(```[\s\S]*?```|`[^`\n]*?`|https?:\/\/[^\s<]+)/gi))
     .map((part) =>
-      part.startsWith('`') ? part : part.replace(regEx(/@/g), '@&#8203;'),
+      part.startsWith('`') || regEx(/^https?:\/\//i).test(part)
+        ? part
+        : part.replace(regEx(/@/g), '@&#8203;'),
     )
     .join('');
   res = res.replace(regEx(/([a-z]@)&#8203;/gi), '$1');