From c4195c6151ec9964082eaf91bd8dca8b7cfcb082 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 5 Sep 2026 08:44:22 +0000
Subject: [PATCH] Update league/commonmark to 2.10.0 for high-severity DoS
 advisory

league/commonmark 2.9.1 is affected by PKSA-zyf5-hrxv-hrd7 (high): denial
of service via distinctly-named attributes in the Attributes extension,
affecting >=1.5.0,<2.10.0.

The package is transitive through laravel/framework, which already requires
^2.8.1, so 2.10.0 installs without any constraint change. Every other PHP
repository in this group already resolved 2.10.0; this lockfile had simply
fallen behind.

composer audit --locked now reports no advisories.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AyeXQ1rZNiSN63TB17Z3kT
---
 composer.lock | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/composer.lock b/composer.lock
index 92342ae..abb24ae 100644
--- a/composer.lock
+++ b/composer.lock
@@ -3068,16 +3068,16 @@
         },
         {
             "name": "league/commonmark",
-            "version": "2.9.1",
+            "version": "2.10.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/thephpleague/commonmark.git",
-                "reference": "73cb188c785abfa7a7bec73487148202968274c6"
+                "reference": "d2d1aa8b35e072966c89bc0c66cf926e56767dc4"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/73cb188c785abfa7a7bec73487148202968274c6",
-                "reference": "73cb188c785abfa7a7bec73487148202968274c6",
+                "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/d2d1aa8b35e072966c89bc0c66cf926e56767dc4",
+                "reference": "d2d1aa8b35e072966c89bc0c66cf926e56767dc4",
                 "shasum": ""
             },
             "require": {
@@ -3114,7 +3114,7 @@
             "type": "library",
             "extra": {
                 "branch-alias": {
-                    "dev-main": "2.10-dev"
+                    "dev-main": "2.11-dev"
                 }
             },
             "autoload": {
@@ -3171,7 +3171,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-09T14:10:38+00:00"
+            "time": "2026-08-11T16:06:25+00:00"
         },
         {
             "name": "league/config",
@@ -16011,5 +16011,5 @@
         "ext-intl": "*"
     },
     "platform-dev": {},
-    "plugin-api-version": "2.9.0"
+    "plugin-api-version": "2.6.0"
 }