chore(deps): bump league/commonmark from 2.8.3 to 2.9.0

[dependabot]

Bumps league/commonmark from 2.8.3 to 2.9.0.

Release notes

Sourced from league/commonmark's releases.

2.9.0

This is a security release to address five denial-of-service vulnerabilities and one cross-site scripting (XSS) vulnerability.

Added

• Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)
  • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
  • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
• Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
• Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
• Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)

Changed

• The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
• NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
• Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
• Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
• Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly

Fixed

• Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
• Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
• Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
• Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
• Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
• Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
• Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
• Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
• Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)

New Contributors

• @​AJenbo made their first contribution in thephpleague/commonmark#1108
• @​eyupcanakman made their first contribution in thephpleague/commonmark#1113

Special Thanks

Special thanks to @​GrahamCampbell and @​TungNGo02 for responsibly disclosing the security vulnerabilities and contributing to the fixes in this release.

---

Full Changelog: thephpleague/commonmark@2.8.3...2.9.0

Changelog

Sourced from league/commonmark's changelog.

[2.9.0] - 2026-08-03

This is a security release to address five denial of service vulnerabilities and one cross-site scripting (XSS) vulnerability.

Added

• Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)
  • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
  • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
• Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
• Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
• Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)

Changed

• The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
• NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
• Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
• Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
• Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly

Fixed

• Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
• Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
• Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
• Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
• Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
• Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
• Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
• Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
• Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)

Commits

• 5703d83 Prepare to release 2.9.0
• 8755035 Merge branch 'main' into 2.9
• 915a198 Merge remote-tracking branch 'origin/main' into 2.9
• 31bb31f Merge remote-tracking branch 'origin/2.8'
• 5e95293 Recommend a finite nesting level for untrusted input (#1135)
• a86a910 Declare MarkDelimiterProcessor as a cacheable delimiter processor (#1133)
• 433f38c Document that max_delimiters_per_line does not limit brackets (#1132)
• cb8d46d Simplify changelog intro
• b5ac8c3 Cap XmlRenderer indentation depth (GHSA-mj63-m3rc-8ppr)
• 2d4c0fa Fix quadratic inline attribute target resolution (GHSA-g2gp-3wwq-f4ph)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)