chore(deps): bump league/commonmark from 2.6.1 to 2.8.2

[dependabot]

Bumps league/commonmark from 2.6.1 to 2.8.2.

Release notes

Sourced from league/commonmark's releases.

2.8.2

This is a security release to address an issue where the allowed_domains setting for the Embed extension can be bypassed, resulting in a possible SSRF and XSS vulnerabilities.

Fixed

• Fixed DomainFilteringAdapter hostname boundary bypass where domains like youtube.com.evil could match an allowlist entry for youtube.com (GHSA-hh8v-hgvp-g3f5)

Full Changelog: thephpleague/commonmark@2.8.1...2.8.2

2.8.1

What's Changed

This is a security release to address an issue where DisallowedRawHtml can be bypassed, resulting in a possible cross-site scripting (XSS) vulnerability.

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML tags with trailing ASCII whitespace (GHSA-4v6x-c7xx-hw9f)
• Fixed PHP 8.5 deprecation (#1107)

New Contributors

• @​Kocal made their first contribution in thephpleague/commonmark#1106
• @​freost made their first contribution in thephpleague/commonmark#1107

Full Changelog: thephpleague/commonmark@2.8.0...2.8.1

2.8.0

What's Changed

Added

• Added a new HighlightExtension for marking important text using == syntax (#1100)

Fixed

• Fixed AutolinkExtension incorrectly matching URLs after invalid www. prefix (#1095, #1103)

New Contributors

• @​samwilson made their first contribution in thephpleague/commonmark#1090
• @​ossobuffo made their first contribution in thephpleague/commonmark#1100

Full Changelog: thephpleague/commonmark@2.7.1...2.8.0

2.7.1

Notable Changes

Changed

• Optimized several regular expressions in RegexHelper to improve performance (#674, #1086)

Fixed

• EmbedProcessor no longer calls updateEmbeds() when there are no embeds to update (#1081)
• Fixed missing benchmark.php CSV path validation for non-existent files (#1068, #1085)

New Contributors

... (truncated)

Changelog

Sourced from league/commonmark's changelog.

[2.8.2] - 2026-03-19

This is a security release to address an issue where the allowed_domains setting for the Embed extension can be bypassed, resulting in a possible SSRF and XSS vulnerabilities.

Fixed

• Fixed DomainFilteringAdapter hostname boundary bypass where domains like youtube.com.evil could match an allowlist entry for youtube.com (GHSA-hh8v-hgvp-g3f5)

[2.8.1] - 2026-03-05

This is a security release to address an issue where DisallowedRawHtml can be bypassed, resulting in a possible cross-site scripting (XSS) vulnerability.

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML tags with trailing ASCII whitespace (GHSA-4v6x-c7xx-hw9f)
• Fixed PHP 8.5 deprecation (#1107)

[2.8.0] - 2025-11-26

Added

• Added a new HighlightExtension for marking important text using == syntax (#1100)

Fixed

• Fixed AutolinkExtension incorrectly matching URLs after invalid www. prefix (#1095, #1103)

[2.7.1] - 2025-07-20

Changed

• Optimized several regular expressions in RegexHelper to improve performance (#674, #1086)

Fixed

• EmbedProcessor no longer calls updateEmbeds() when there are no embeds to update (#1081)
• Fixed missing benchmark.php CSV path validation for non-existent files (#1068, #1085)

[2.7.0] - 2025-05-05

This is a security release to address a potential cross-site scripting (XSS) vulnerability when using the AttributesExtension with untrusted user input.

Added

• Added attributes/allow config option to specify which attributes users are allowed to set on elements (default allows virtually all attributes)

Changed

• The AttributesExtension blocks all attributes starting with on unless explicitly allowed via the attributes/allow config option
• The allow_unsafe_links option is now respected by the AttributesExtension when users specify href and src attributes

[2.6.2] - 2025-04-18

Fixed

• Fixed Attributes extension parsing regression (#1071)

Commits

• 59fb075 Fix DomainFilteringAdapter hostname boundary bypass
• 74b4487 Document dangers of enabling an unsafe php.ini setting
• 84b1ca4 Almost forgot this entry
• bcf54f5 Merge commit from fork
• 7a68ed1 Prepare to release 2.8.1
• 5c0c4c8 Fix DisallowedRawHtml bypass via newline/tab in tag names
• f6e7443 Add regression test
• 0719b67 Merge pull request #1107 from freost/fix-php85-deprecation-error
• 63ff2e0 Fix PHP 8.5 deprecation
• 8608e9c Merge pull request #1106 from Kocal/patch-1
• Additional commits viewable in compare view

[dsebastien]

@dependabot rebase