[dependabot]

Bumps league/commonmark from 2.8.3 to 2.10.4.

Release notes

Sourced from league/commonmark's releases.

2.10.4

Fixed

• Fixed HeadingPermalinkExtension overwriting an id set on a heading by the AttributesExtension when heading_permalink/apply_id_to_heading is enabled; the existing id is now used (with the configured prefix) for both the heading and its permalink (#1159, #1160)
• Fixed Symfony DebugClassLoader deprecation notice about ArrayCollection::offsetGet() by adding an explicit @return annotation (#1158)

2.10.3

Fixed

• Fixed footnote links and backlinks pointing at the wrong anchor when footnote/footnote_id_prefix or footnote/ref_id_prefix contains an uppercase character; the configured prefix is now emitted verbatim in the href as it already was in the matching id (#524)
• Fixed inline raw HTML tags being escaped when the tag name or an attribute name contains an uppercase letter, such as <svg viewBox="..."> or <Warning> (#1096)

2.10.2

This is a security release to address a denial of service vulnerability in the Table extension and a raw HTML filtering bypass in the DisallowedRawHtml extension.

Changed

• Improved performance of parsing table delimiter rows and splitting table rows into cells by scanning bytes directly instead of stepping a Cursor (roughly 4x faster for delimiter rows and 6x for cell splitting, and more on multibyte rows)

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML that ends with a disallowed tag name, such as a line containing only <script (GHSA-97jj-33gv-5xf9)
• Fixed quadratic-time parsing of long paragraphs when the Table extension is enabled (GHSA-3q6v-r5mr-hxv8)
• Fixed table detection to match the GFM spec and reference implementation:
  • Header rows no longer require a | character
  • Header rows must now have the same number of cells as the delimiter row (previously, fewer cells were accepted)

Full Changelog: thephpleague/commonmark@2.10.1...2.10.2

2.10.1

What's Changed

• fix: accept unordered_list_markers config in InlinesOnlyExtension by @​dualfroz in thephpleague/commonmark#1151

New Contributors

• @​dualfroz made their first contribution in thephpleague/commonmark#1151

Full Changelog: thephpleague/commonmark@2.10.0...2.10.1

2.10.0

This is a security release to address a denial of service vulnerability in the AttributesExtension.

Added

• Added a new table_of_contents/max_placeholder_entries option to limit how many table of contents entries a document may render across all of its placeholders (#1134)
• Added Cursor::matchInPlace(), which matches a regular expression at the cursor's position within the line using PCRE's native offset semantics instead of copying the remainder (#1145)
  • \G anchors at the cursor, ^ anchors at the start of the line, and lookbehinds and \b see the characters actually preceding the cursor; this keeps scanning loops linear and enables left-context assertions that match() cannot express
• Added RegexHelper::PARTIAL_LINK_TITLE_UNANCHORED and RegexHelper::PARTIAL_LINK_DESTINATION_BRACES, unanchored fragments so each call site can supply its own anchor
• Added a default_attributes configuration format which pairs the node attribute map with a new strict_callables option: ['default_attributes' => ['attributes' => [...], 'strict_callables' => true]]. With strict_callables enabled, only closures and invokable objects are treated as callbacks, so strings and arrays are always used as literal attribute values. Callbacks written as string or array callables can be wrapped with Closure::fromCallable(). The original format - passing the node map directly - is still accepted, and defaults strict_callables to false.
• Added a new slug_normalizer/reserved option which treats the given slugs as already-used, so colliding headings receive an incremental numeric suffix just like duplicate headings do (#1080)

Changed

• Changed the TableOfContents extension to render the table of contents once and share it across all placeholders instead of cloning it into each one (#1134)

... (truncated)

Changelog

Sourced from league/commonmark's changelog.

[2.10.4] - 2026-10-17

Fixed

• Fixed HeadingPermalinkExtension overwriting an id set on a heading by the AttributesExtension when heading_permalink/apply_id_to_heading is enabled; the existing id is now used (with the configured prefix) for both the heading and its permalink (#1159, #1160)
• Fixed Symfony DebugClassLoader deprecation notice about ArrayCollection::offsetGet() by adding an explicit @return annotation (#1158)

[2.10.3] - 2026-09-21

Fixed

• Fixed footnote links and backlinks pointing at the wrong anchor when footnote/footnote_id_prefix or footnote/ref_id_prefix contains an uppercase character; the configured prefix is now emitted verbatim in the href as it already was in the matching id (#524)
• Fixed inline raw HTML tags being escaped when the tag name or an attribute name contains an uppercase letter, such as <svg viewBox="..."> or <Warning> (#1096)

[2.10.2] - 2026-09-21

This is a security release to address a denial of service vulnerability in the Table extension and a raw HTML filtering bypass in the DisallowedRawHtml extension.

Changed

• Improved performance of parsing table delimiter rows and splitting table rows into cells by scanning bytes directly instead of stepping a Cursor (roughly 4x faster for delimiter rows and 6x for cell splitting, and more on multibyte rows)

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML that ends with a disallowed tag name, such as a line containing only <script (GHSA-97jj-33gv-5xf9)
• Fixed quadratic-time parsing of long paragraphs when the Table extension is enabled (GHSA-3q6v-r5mr-hxv8)
• Fixed table detection to match the GFM spec and reference implementation:
  • Header rows no longer require a | character
  • Header rows must now have the same number of cells as the delimiter row (previously, fewer cells were accepted)

[2.10.1] - 2026-09-07

Fixed

• Accept unordered_list_markers config in InlinesOnlyExtension (#1015, #1151)

[2.10.0] - 2026-08-11

This is a security release to address a denial of service vulnerability in the AttributesExtension.

Added

• Added a new table_of_contents/max_placeholder_entries option to limit how many table of contents entries a document may render across all of its placeholders (#1134)
• Added Cursor::matchInPlace(), which matches a regular expression at the cursor's position within the line using PCRE's native offset semantics instead of copying the remainder (#1145)
  • \G anchors at the cursor, ^ anchors at the start of the line, and lookbehinds and \b see the characters actually preceding the cursor; this keeps scanning loops linear and enables left-context assertions that match() cannot express
• Added RegexHelper::PARTIAL_LINK_TITLE_UNANCHORED and RegexHelper::PARTIAL_LINK_DESTINATION_BRACES, unanchored fragments so each call site can supply its own anchor
• Added a default_attributes configuration format which pairs the node attribute map with a new strict_callables option: ['default_attributes' => ['attributes' => [...], 'strict_callables' => true]]. With strict_callables enabled, only closures and invokable objects are treated as callbacks, so strings and arrays are always used as literal attribute values. Callbacks written as string or array callables can be wrapped with Closure::fromCallable(). The original format - passing the node map directly - is still accepted, and defaults strict_callables to false.
• Added a new slug_normalizer/reserved option which treats the given slugs as already-used, so colliding headings receive an incremental numeric suffix just like duplicate headings do (#1080)

Changed

• Changed the TableOfContents extension to render the table of contents once and share it across all placeholders instead of cloning it into each one (#1134)
  • A custom renderer registered for the TableOfContents node is no longer called once per placeholder, so it must return the same markup each time it is called for a given document (#1134)
  • The first placeholder receives the table of contents itself, so a document still contains a TableOfContents node for listeners which locate and reposition it (#1143)
• $environment->getConfiguration()->get('default_attributes') now returns the normalized structure with attributes and strict_callables keys instead of the node map; read default_attributes/attributes to get the map. Configuration written in either format continues to work unchanged.

Deprecated

... (truncated)

Commits

• 40821b7 Prepare to release 2.10.4
• 6154417 Fix the Result block for the simple table example (#1155)
• 0292264 Respect ID in heading with HeadingPermalinkExtension (#1160)
• e407ccc Add explicit @​return to ArrayCollection::offsetGet() (#1161)
• 718fda4 Clarify preferred method for reporting vulnerabilities
• 0aad71c Update dependency jekyll-redirect-from to v0.17.0 (#1157)
• 6efbd9c Prepare to release 2.10.3
• 19b3037 case insensitive for HTML attributes (#1096)
• 053ebd3 Keep the configured footnote id prefixes out of the href lowercasing (#1153)
• 692e90b Prepare to release 2.10.2
• Additional commits viewable in compare view

[Mark-H]

@dependabot rebase

[dependabot]

Looks like league/commonmark is up-to-date now, so this is no longer needed.