Skip to content

Bump league/commonmark from 2.8.2 to 2.9.0 - #201

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/league/commonmark-2.9.0
Open

Bump league/commonmark from 2.8.2 to 2.9.0#201
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/league/commonmark-2.9.0

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 8, 2026

Copy link
Copy Markdown
Contributor

Bumps league/commonmark from 2.8.2 to 2.9.0.

Release notes

Sourced from league/commonmark's releases.

2.9.0

This is a security release to address five denial-of-service vulnerabilities and one cross-site scripting (XSS) vulnerability.

Added

  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)
    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)

Changed

  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly

Fixed

  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)

New Contributors

Special Thanks

Special thanks to @​GrahamCampbell and @​TungNGo02 for responsibly disclosing the security vulnerabilities and contributing to the fixes in this release.

Full Changelog: thephpleague/commonmark@2.8.3...2.9.0

2.8.3

What's Changed

Fixed

  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)

... (truncated)

Changelog

Sourced from league/commonmark's changelog.

[2.9.0] - 2026-08-03

This is a security release to address five denial of service vulnerabilities and one cross-site scripting (XSS) vulnerability.

Added

  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)
    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)

Changed

  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly

Fixed

  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)

[2.8.3] - 2026-07-12

Fixed

  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump league/commonmark from 2.8.2 to 2.9.0
151133c
Bumps [league/commonmark](https://github.com/thephpleague/commonmark) from 2.8.2 to 2.9.0.
- [Release notes](https://github.com/thephpleague/commonmark/releases)
- [Changelog](https://github.com/thephpleague/commonmark/blob/2.9/CHANGELOG.md)
- [Commits](thephpleague/commonmark@2.8.2...2.9.0)
---
updated-dependencies:
- dependency-name: league/commonmark
dependency-version: 2.9.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file php Pull requests that update Php code labels Aug 8, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependenciesPull requests that update a dependency filephpPull requests that update Php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Bump league/commonmark from 2.8.2 to 2.9.0 by dependabot[bot] · Pull Request #201 · CatLabInteractive/catlab-drinks · GitHub
Skip to content
Bump league/commonmark from 2.8.2 to 2.9.0 - #201
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/composer/league/commonmark-2.9.0
Open
Bump league/commonmark from 2.8.2 to 2.9.0#201
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/composer/league/commonmark-2.9.0
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 8, 2026

Copy link


Copy Markdown

Contributor
Bumps league/commonmark from 2.8.2 to 2.9.0.
Release notes
Sourced from league/commonmark's releases.
2.9.0
This is a security release to address five denial-of-service vulnerabilities and one cross-site scripting (XSS) vulnerability.
Added
  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)

    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)
Changed
  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly
Fixed
  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)
New Contributors
Special Thanks
Special thanks to @​GrahamCampbell and @​TungNGo02 for responsibly disclosing the security vulnerabilities and contributing to the fixes in this release.
Full Changelog: thephpleague/commonmark@2.8.3...2.9.0
2.8.3
What's Changed
Fixed
  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
... (truncated)
Changelog
Sourced from league/commonmark's changelog.
[2.9.0] - 2026-08-03
This is a security release to address five denial of service vulnerabilities and one cross-site scripting (XSS) vulnerability.
Added
  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)

    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)
Changed
  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly
Fixed
  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)
[2.8.3] - 2026-07-12
Fixed
  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
Commits

Dependabot compatibility score
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    
You can disable automated security fix PRs for this repo from the Security Alerts page.
@dependabot
Bump league/commonmark from 2.8.2 to 2.9.0
151133c
Bumps [league/commonmark](https://github.com/thephpleague/commonmark) from 2.8.2 to 2.9.0.
- [Release notes](https://github.com/thephpleague/commonmark/releases)
- [Changelog](https://github.com/thephpleague/commonmark/blob/2.9/CHANGELOG.md)
- [Commits](thephpleague/commonmark@2.8.2...2.9.0)
---
updated-dependencies:
- dependency-name: league/commonmark
dependency-version: 2.9.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
php
Pull requests that update Php code
labels
Aug 8, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filephpPull requests that update Php code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Bump league/commonmark from 2.8.2 to 2.9.0 by dependabot[bot] · Pull Request #201 · CatLabInteractive/catlab-drinks · GitHub
Skip to content
Bump league/commonmark from 2.8.2 to 2.9.0 - #201
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/composer/league/commonmark-2.9.0
Open
Bump league/commonmark from 2.8.2 to 2.9.0#201
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/composer/league/commonmark-2.9.0
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 8, 2026

Copy link


Copy Markdown

Contributor
Bumps league/commonmark from 2.8.2 to 2.9.0.
Release notes
Sourced from league/commonmark's releases.
2.9.0
This is a security release to address five denial-of-service vulnerabilities and one cross-site scripting (XSS) vulnerability.
Added
  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)

    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)
Changed
  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly
Fixed
  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)
New Contributors
Special Thanks
Special thanks to @​GrahamCampbell and @​TungNGo02 for responsibly disclosing the security vulnerabilities and contributing to the fixes in this release.
Full Changelog: thephpleague/commonmark@2.8.3...2.9.0
2.8.3
What's Changed
Fixed
  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
... (truncated)
Changelog
Sourced from league/commonmark's changelog.
[2.9.0] - 2026-08-03
This is a security release to address five denial of service vulnerabilities and one cross-site scripting (XSS) vulnerability.
Added
  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)

    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)
Changed
  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly
Fixed
  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)
[2.8.3] - 2026-07-12
Fixed
  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
Commits

Dependabot compatibility score
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    
You can disable automated security fix PRs for this repo from the Security Alerts page.
@dependabot
Bump league/commonmark from 2.8.2 to 2.9.0
151133c
Bumps [league/commonmark](https://github.com/thephpleague/commonmark) from 2.8.2 to 2.9.0.
- [Release notes](https://github.com/thephpleague/commonmark/releases)
- [Changelog](https://github.com/thephpleague/commonmark/blob/2.9/CHANGELOG.md)
- [Commits](thephpleague/commonmark@2.8.2...2.9.0)
---
updated-dependencies:
- dependency-name: league/commonmark
dependency-version: 2.9.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
php
Pull requests that update Php code
labels
Aug 8, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filephpPull requests that update Php code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Bump league/commonmark from 2.8.2 to 2.9.0 by dependabot[bot] · Pull Request #201 · CatLabInteractive/catlab-drinks · GitHub
Skip to content
Bump league/commonmark from 2.8.2 to 2.9.0 - #201
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/composer/league/commonmark-2.9.0
Open
Bump league/commonmark from 2.8.2 to 2.9.0#201
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/composer/league/commonmark-2.9.0
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 8, 2026

Copy link


Copy Markdown

Contributor
Bumps league/commonmark from 2.8.2 to 2.9.0.
Release notes
Sourced from league/commonmark's releases.
2.9.0
This is a security release to address five denial-of-service vulnerabilities and one cross-site scripting (XSS) vulnerability.
Added
  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)

    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)
Changed
  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly
Fixed
  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)
New Contributors
Special Thanks
Special thanks to @​GrahamCampbell and @​TungNGo02 for responsibly disclosing the security vulnerabilities and contributing to the fixes in this release.
Full Changelog: thephpleague/commonmark@2.8.3...2.9.0
2.8.3
What's Changed
Fixed
  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
... (truncated)
Changelog
Sourced from league/commonmark's changelog.
[2.9.0] - 2026-08-03
This is a security release to address five denial of service vulnerabilities and one cross-site scripting (XSS) vulnerability.
Added
  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)

    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)
Changed
  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly
Fixed
  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)
[2.8.3] - 2026-07-12
Fixed
  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
Commits

Dependabot compatibility score
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    
You can disable automated security fix PRs for this repo from the Security Alerts page.
@dependabot
Bump league/commonmark from 2.8.2 to 2.9.0
151133c
Bumps [league/commonmark](https://github.com/thephpleague/commonmark) from 2.8.2 to 2.9.0.
- [Release notes](https://github.com/thephpleague/commonmark/releases)
- [Changelog](https://github.com/thephpleague/commonmark/blob/2.9/CHANGELOG.md)
- [Commits](thephpleague/commonmark@2.8.2...2.9.0)
---
updated-dependencies:
- dependency-name: league/commonmark
dependency-version: 2.9.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
php
Pull requests that update Php code
labels
Aug 8, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filephpPull requests that update Php code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
Bump league/commonmark from 2.8.2 to 2.9.0 by dependabot[bot] · Pull Request #201 · CatLabInteractive/catlab-drinks · GitHub
Skip to content
Bump league/commonmark from 2.8.2 to 2.9.0 - #201
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/composer/league/commonmark-2.9.0
Open
Bump league/commonmark from 2.8.2 to 2.9.0#201
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/composer/league/commonmark-2.9.0
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 8, 2026

Copy link


Copy Markdown

Contributor
Bumps league/commonmark from 2.8.2 to 2.9.0.
Release notes
Sourced from league/commonmark's releases.
2.9.0
This is a security release to address five denial-of-service vulnerabilities and one cross-site scripting (XSS) vulnerability.
Added
  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)

    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)
Changed
  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly
Fixed
  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)
New Contributors
Special Thanks
Special thanks to @​GrahamCampbell and @​TungNGo02 for responsibly disclosing the security vulnerabilities and contributing to the fixes in this release.
Full Changelog: thephpleague/commonmark@2.8.3...2.9.0
2.8.3
What's Changed
Fixed
  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
... (truncated)
Changelog
Sourced from league/commonmark's changelog.
[2.9.0] - 2026-08-03
This is a security release to address five denial of service vulnerabilities and one cross-site scripting (XSS) vulnerability.
Added
  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)

    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)
Changed
  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly
Fixed
  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)
[2.8.3] - 2026-07-12
Fixed
  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
Commits

Dependabot compatibility score
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    
You can disable automated security fix PRs for this repo from the Security Alerts page.
@dependabot
Bump league/commonmark from 2.8.2 to 2.9.0
151133c
Bumps [league/commonmark](https://github.com/thephpleague/commonmark) from 2.8.2 to 2.9.0.
- [Release notes](https://github.com/thephpleague/commonmark/releases)
- [Changelog](https://github.com/thephpleague/commonmark/blob/2.9/CHANGELOG.md)
- [Commits](thephpleague/commonmark@2.8.2...2.9.0)
---
updated-dependencies:
- dependency-name: league/commonmark
dependency-version: 2.9.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
php
Pull requests that update Php code
labels
Aug 8, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filephpPull requests that update Php code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Bump league/commonmark from 2.8.2 to 2.9.0 by dependabot[bot] · Pull Request #201 · CatLabInteractive/catlab-drinks · GitHub
Skip to content
Bump league/commonmark from 2.8.2 to 2.9.0 - #201
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/composer/league/commonmark-2.9.0
Open
Bump league/commonmark from 2.8.2 to 2.9.0#201
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/composer/league/commonmark-2.9.0
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 8, 2026

Copy link


Copy Markdown

Contributor
Bumps league/commonmark from 2.8.2 to 2.9.0.
Release notes
Sourced from league/commonmark's releases.
2.9.0
This is a security release to address five denial-of-service vulnerabilities and one cross-site scripting (XSS) vulnerability.
Added
  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)

    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)
Changed
  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly
Fixed
  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)
New Contributors
Special Thanks
Special thanks to @​GrahamCampbell and @​TungNGo02 for responsibly disclosing the security vulnerabilities and contributing to the fixes in this release.
Full Changelog: thephpleague/commonmark@2.8.3...2.9.0
2.8.3
What's Changed
Fixed
  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
... (truncated)
Changelog
Sourced from league/commonmark's changelog.
[2.9.0] - 2026-08-03
This is a security release to address five denial of service vulnerabilities and one cross-site scripting (XSS) vulnerability.
Added
  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)

    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)
Changed
  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly
Fixed
  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)
[2.8.3] - 2026-07-12
Fixed
  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
Commits

Dependabot compatibility score
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    
You can disable automated security fix PRs for this repo from the Security Alerts page.
@dependabot
Bump league/commonmark from 2.8.2 to 2.9.0
151133c
Bumps [league/commonmark](https://github.com/thephpleague/commonmark) from 2.8.2 to 2.9.0.
- [Release notes](https://github.com/thephpleague/commonmark/releases)
- [Changelog](https://github.com/thephpleague/commonmark/blob/2.9/CHANGELOG.md)
- [Commits](thephpleague/commonmark@2.8.2...2.9.0)
---
updated-dependencies:
- dependency-name: league/commonmark
dependency-version: 2.9.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
php
Pull requests that update Php code
labels
Aug 8, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filephpPull requests that update Php code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Bump league/commonmark from 2.8.2 to 2.9.0 by dependabot[bot] · Pull Request #201 · CatLabInteractive/catlab-drinks · GitHub
Skip to content
Bump league/commonmark from 2.8.2 to 2.9.0 - #201
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/composer/league/commonmark-2.9.0
Open
Bump league/commonmark from 2.8.2 to 2.9.0#201
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/composer/league/commonmark-2.9.0
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 8, 2026

Copy link


Copy Markdown

Contributor
Bumps league/commonmark from 2.8.2 to 2.9.0.
Release notes
Sourced from league/commonmark's releases.
2.9.0
This is a security release to address five denial-of-service vulnerabilities and one cross-site scripting (XSS) vulnerability.
Added
  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)

    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)
Changed
  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly
Fixed
  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)
New Contributors
Special Thanks
Special thanks to @​GrahamCampbell and @​TungNGo02 for responsibly disclosing the security vulnerabilities and contributing to the fixes in this release.
Full Changelog: thephpleague/commonmark@2.8.3...2.9.0
2.8.3
What's Changed
Fixed
  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
... (truncated)
Changelog
Sourced from league/commonmark's changelog.
[2.9.0] - 2026-08-03
This is a security release to address five denial of service vulnerabilities and one cross-site scripting (XSS) vulnerability.
Added
  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)

    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)
Changed
  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly
Fixed
  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)
[2.8.3] - 2026-07-12
Fixed
  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
Commits

Dependabot compatibility score
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    
You can disable automated security fix PRs for this repo from the Security Alerts page.
@dependabot
Bump league/commonmark from 2.8.2 to 2.9.0
151133c
Bumps [league/commonmark](https://github.com/thephpleague/commonmark) from 2.8.2 to 2.9.0.
- [Release notes](https://github.com/thephpleague/commonmark/releases)
- [Changelog](https://github.com/thephpleague/commonmark/blob/2.9/CHANGELOG.md)
- [Commits](thephpleague/commonmark@2.8.2...2.9.0)
---
updated-dependencies:
- dependency-name: league/commonmark
dependency-version: 2.9.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
php
Pull requests that update Php code
labels
Aug 8, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filephpPull requests that update Php code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
Bump league/commonmark from 2.8.2 to 2.9.0 by dependabot[bot] · Pull Request #201 · CatLabInteractive/catlab-drinks · GitHub
Skip to content
Bump league/commonmark from 2.8.2 to 2.9.0 - #201
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/composer/league/commonmark-2.9.0
Open
Bump league/commonmark from 2.8.2 to 2.9.0#201
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/composer/league/commonmark-2.9.0
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubAug 8, 2026

Copy link


Copy Markdown

Contributor
Bumps league/commonmark from 2.8.2 to 2.9.0.
Release notes
Sourced from league/commonmark's releases.
2.9.0
This is a security release to address five denial-of-service vulnerabilities and one cross-site scripting (XSS) vulnerability.
Added
  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)

    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)
Changed
  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly
Fixed
  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)
New Contributors
Special Thanks
Special thanks to @​GrahamCampbell and @​TungNGo02 for responsibly disclosing the security vulnerabilities and contributing to the fixes in this release.
Full Changelog: thephpleague/commonmark@2.8.3...2.9.0
2.8.3
What's Changed
Fixed
  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
... (truncated)
Changelog
Sourced from league/commonmark's changelog.
[2.9.0] - 2026-08-03
This is a security release to address five denial of service vulnerabilities and one cross-site scripting (XSS) vulnerability.
Added
  • Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)

    • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
    • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
  • Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
  • Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
  • Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)
Changed
  • The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
  • NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
  • Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
  • Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
  • Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly
Fixed
  • Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
  • Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
  • Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
  • Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
  • Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
  • Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
  • Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
  • Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
  • Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)
[2.8.3] - 2026-07-12
Fixed
  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)
Commits

Dependabot compatibility score
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    
You can disable automated security fix PRs for this repo from the Security Alerts page.
@dependabot
Bump league/commonmark from 2.8.2 to 2.9.0
151133c
Bumps [league/commonmark](https://github.com/thephpleague/commonmark) from 2.8.2 to 2.9.0.
- [Release notes](https://github.com/thephpleague/commonmark/releases)
- [Changelog](https://github.com/thephpleague/commonmark/blob/2.9/CHANGELOG.md)
- [Commits](thephpleague/commonmark@2.8.2...2.9.0)
---
updated-dependencies:
- dependency-name: league/commonmark
dependency-version: 2.9.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
php
Pull requests that update Php code
labels
Aug 8, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filephpPull requests that update Php code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants