[dependabot]

Bumps league/commonmark from 2.6.0 to 2.10.7.

Release notes

Sourced from league/commonmark's releases.

2.10.7

Fixed

• Fixed AutolinkExtension keeping trailing punctuation inside very long URLs containing long runs of punctuation, and removed the excessive regex backtracking that caused it (#1170)

2.10.6

Fixed

• Fixed ExternalLinkExtension not treating some links as external when browsers would navigate to an external host, such as https:///example.com, http:example.com, or ///example.com; hosts are now determined the way browsers do (#1169)

2.10.5

Fixed

• Fixed link reference definitions keeping a partially parsed title when the title on the following line is never closed or is followed by other text; the definition now has no title, as the spec requires (#1162)
• Fixed task list items being recognized when the [ ] or [x] marker is directly followed by other content (- [x]done); the GFM spec requires whitespace after the marker (#1164)
• Fixed the content indentation of a list item whose content is a single character after two to four spaces (- a): it was computed as if one space followed the marker, so the next line could be read as part of the item, nesting a following item inside it (#1163)
• Fixed a table inside a block quote or list item absorbing the lines that follow it as table rows when those lines are lazy continuation lines (not prefixed with > or indented); they now end the container as in GitHub's cmark-gfm (#1165)
• Fixed link reference definitions accepting an unescaped ( inside a parenthesized title (#1168)

2.10.4

Fixed

• Fixed HeadingPermalinkExtension overwriting an id set on a heading by the AttributesExtension when heading_permalink/apply_id_to_heading is enabled; the existing id is now used (with the configured prefix) for both the heading and its permalink (#1159, #1160)
• Fixed Symfony DebugClassLoader deprecation notice about ArrayCollection::offsetGet() by adding an explicit @return annotation (#1158)

2.10.3

Fixed

• Fixed footnote links and backlinks pointing at the wrong anchor when footnote/footnote_id_prefix or footnote/ref_id_prefix contains an uppercase character; the configured prefix is now emitted verbatim in the href as it already was in the matching id (#524)
• Fixed inline raw HTML tags being escaped when the tag name or an attribute name contains an uppercase letter, such as <svg viewBox="..."> or <Warning> (#1096)

2.10.2

This is a security release to address a denial of service vulnerability in the Table extension and a raw HTML filtering bypass in the DisallowedRawHtml extension.

Changed

• Improved performance of parsing table delimiter rows and splitting table rows into cells by scanning bytes directly instead of stepping a Cursor (roughly 4x faster for delimiter rows and 6x for cell splitting, and more on multibyte rows)

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML that ends with a disallowed tag name, such as a line containing only <script (GHSA-97jj-33gv-5xf9)
• Fixed quadratic-time parsing of long paragraphs when the Table extension is enabled (GHSA-3q6v-r5mr-hxv8)
• Fixed table detection to match the GFM spec and reference implementation:
  • Header rows no longer require a | character
  • Header rows must now have the same number of cells as the delimiter row (previously, fewer cells were accepted)

Full Changelog: thephpleague/commonmark@2.10.1...2.10.2

2.10.1

What's Changed

• fix: accept unordered_list_markers config in InlinesOnlyExtension by @​dualfroz in thephpleague/commonmark#1151

... (truncated)

Changelog

Sourced from league/commonmark's changelog.

[2.10.7] - 2026-10-31

Fixed

• Fixed AutolinkExtension keeping trailing punctuation inside very long URLs containing long runs of punctuation, and removed the excessive regex backtracking that caused it (#1170)

[2.10.6] - 2026-10-30

Fixed

• Fixed ExternalLinkExtension not treating some links as external when browsers would navigate to an external host, such as https:///example.com, http:example.com, or ///example.com; hosts are now determined the way browsers do (#1169)

[2.10.5] - 2026-10-30

Fixed

• Fixed link reference definitions keeping a partially parsed title when the title on the following line is never closed or is followed by other text; the definition now has no title, as the spec requires (#1162)
• Fixed task list items being recognized when the [ ] or [x] marker is directly followed by other content (- [x]done); the GFM spec requires whitespace after the marker (#1164)
• Fixed the content indentation of a list item whose content is a single character after two to four spaces (- a): it was computed as if one space followed the marker, so the next line could be read as part of the item, nesting a following item inside it (#1163)
• Fixed a table inside a block quote or list item absorbing the lines that follow it as table rows when those lines are lazy continuation lines (not prefixed with > or indented); they now end the container as in GitHub's cmark-gfm (#1165)
• Fixed link reference definitions accepting an unescaped ( inside a parenthesized title (#1168)

[2.10.4] - 2026-10-17

Fixed

• Fixed HeadingPermalinkExtension overwriting an id set on a heading by the AttributesExtension when heading_permalink/apply_id_to_heading is enabled; the existing id is now used (with the configured prefix) for both the heading and its permalink (#1159, #1160)
• Fixed Symfony DebugClassLoader deprecation notice about ArrayCollection::offsetGet() by adding an explicit @return annotation (#1158)

[2.10.3] - 2026-09-21

Fixed

• Fixed footnote links and backlinks pointing at the wrong anchor when footnote/footnote_id_prefix or footnote/ref_id_prefix contains an uppercase character; the configured prefix is now emitted verbatim in the href as it already was in the matching id (#524)
• Fixed inline raw HTML tags being escaped when the tag name or an attribute name contains an uppercase letter, such as <svg viewBox="..."> or <Warning> (#1096)

[2.10.2] - 2026-09-21

This is a security release to address a denial of service vulnerability in the Table extension and a raw HTML filtering bypass in the DisallowedRawHtml extension.

Changed

• Improved performance of parsing table delimiter rows and splitting table rows into cells by scanning bytes directly instead of stepping a Cursor (roughly 4x faster for delimiter rows and 6x for cell splitting, and more on multibyte rows)

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML that ends with a disallowed tag name, such as a line containing only <script (GHSA-97jj-33gv-5xf9)
• Fixed quadratic-time parsing of long paragraphs when the Table extension is enabled (GHSA-3q6v-r5mr-hxv8)
• Fixed table detection to match the GFM spec and reference implementation:
  • Header rows no longer require a | character
  • Header rows must now have the same number of cells as the delimiter row (previously, fewer cells were accepted)

[2.10.1] - 2026-09-07

Fixed

• Accept unordered_list_markers config in InlinesOnlyExtension (#1015, #1151)

... (truncated)

Commits

• 8eb53e9 Prepare to release 2.10.7
• 5da14da Strip trailing autolink punctuation without a backtracking regex (#1170)
• cb3d6a5 Prepare to release 2.10.6
• e4e5339 Find external link hosts the way browsers do (#1169)
• 6d6ed04 Prepare to release 2.10.5
• f292c64 Reject an unescaped ( in a parenthesized reference definition title (#1168)
• baa5b10 Do not add lazy continuation lines to a table inside a container (#1165)
• 67ce8b3 Fix the list item padding for single-character content (#1163)
• 5bddd73 Require whitespace after a task list item marker (#1164)
• de6e417 Drop a link reference definition title that fails to parse (#1162)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.