(chore): Bump league/commonmark from 2.10.0 to 2.10.3

[dependabot]

Bumps league/commonmark from 2.10.0 to 2.10.3.

Release notes

Sourced from league/commonmark's releases.

2.10.3

Fixed

• Fixed footnote links and backlinks pointing at the wrong anchor when footnote/footnote_id_prefix or footnote/ref_id_prefix contains an uppercase character; the configured prefix is now emitted verbatim in the href as it already was in the matching id (#524)
• Fixed inline raw HTML tags being escaped when the tag name or an attribute name contains an uppercase letter, such as <svg viewBox="..."> or <Warning> (#1096)

2.10.2

This is a security release to address a denial of service vulnerability in the Table extension and a raw HTML filtering bypass in the DisallowedRawHtml extension.

Changed

• Improved performance of parsing table delimiter rows and splitting table rows into cells by scanning bytes directly instead of stepping a Cursor (roughly 4x faster for delimiter rows and 6x for cell splitting, and more on multibyte rows)

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML that ends with a disallowed tag name, such as a line containing only <script (GHSA-97jj-33gv-5xf9)
• Fixed quadratic-time parsing of long paragraphs when the Table extension is enabled (GHSA-3q6v-r5mr-hxv8)
• Fixed table detection to match the GFM spec and reference implementation:
  • Header rows no longer require a | character
  • Header rows must now have the same number of cells as the delimiter row (previously, fewer cells were accepted)

Full Changelog: thephpleague/commonmark@2.10.1...2.10.2

2.10.1

What's Changed

• fix: accept unordered_list_markers config in InlinesOnlyExtension by @​dualfroz in thephpleague/commonmark#1151

New Contributors

• @​dualfroz made their first contribution in thephpleague/commonmark#1151

Full Changelog: thephpleague/commonmark@2.10.0...2.10.1

Changelog

Sourced from league/commonmark's changelog.

[2.10.3] - 2026-09-21

Fixed

• Fixed footnote links and backlinks pointing at the wrong anchor when footnote/footnote_id_prefix or footnote/ref_id_prefix contains an uppercase character; the configured prefix is now emitted verbatim in the href as it already was in the matching id (#524)
• Fixed inline raw HTML tags being escaped when the tag name or an attribute name contains an uppercase letter, such as <svg viewBox="..."> or <Warning> (#1096)

[2.10.2] - 2026-09-21

This is a security release to address a denial of service vulnerability in the Table extension and a raw HTML filtering bypass in the DisallowedRawHtml extension.

Changed

• Improved performance of parsing table delimiter rows and splitting table rows into cells by scanning bytes directly instead of stepping a Cursor (roughly 4x faster for delimiter rows and 6x for cell splitting, and more on multibyte rows)

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML that ends with a disallowed tag name, such as a line containing only <script (GHSA-97jj-33gv-5xf9)
• Fixed quadratic-time parsing of long paragraphs when the Table extension is enabled (GHSA-3q6v-r5mr-hxv8)
• Fixed table detection to match the GFM spec and reference implementation:
  • Header rows no longer require a | character
  • Header rows must now have the same number of cells as the delimiter row (previously, fewer cells were accepted)

[2.10.1] - 2026-09-07

Fixed

• Accept unordered_list_markers config in InlinesOnlyExtension (#1015, #1151)

Commits

• 6efbd9c Prepare to release 2.10.3
• 19b3037 case insensitive for HTML attributes (#1096)
• 053ebd3 Keep the configured footnote id prefixes out of the href lowercasing (#1153)
• 692e90b Prepare to release 2.10.2
• 411afcc Escape disallowed raw HTML tags that end the rendered output
• b99b2b6 Scan table delimiter and cell rows as bytes
• fc7e537 Match GFM table header detection
• 5f63680 Fix quadratic-time table start detection on long paragraphs
• be378ba Document that allowed_domains only checks the Markdown URL (#1154)
• 276b7ab docs: clarify priority ordering behavior (#1152)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Composer package changes

Prod Packages	Operation	Base	Target	Link	License
league/commonmark	Upgraded	2.10.0	2.10.3	Compare	BSD-3-Clause
symfony/polyfill-php80	Upgraded	v1.37.0	v1.43.0	Compare	MIT