ROBOTSTXT/robotstxt-documentation-markdown
ROBOTSTXT/robotstxt-documentation-markdown
Watch
7
0
Fork
You've already forked robotstxt-documentation-markdown
 0
Code Issues Pull requests Releases 6 Activity

v1.2.0

Browse source
This commit is contained in:
Javier Casares 2026-08-08 08:53:08 +00:00
commit 7d3fc1969d
52 changed files with 1776 additions and 295 deletions
Download patch file Download diff file Expand all files Collapse all files

43
vendor/league/commonmark/CHANGELOG.md vendored
View file

@ -6,6 +6,45 @@ Updates should follow the [Keep a CHANGELOG](https://keepachangelog.com/) princi
## [Unreleased][unreleased]
## [2.9.0] - 2026-08-03
This is a **security release** to address five denial of service vulnerabilities and one cross-site scripting (XSS) vulnerability.
### Added
- Added a new `NormalizeHeadingsExtension` to constrain headings to a configured level range (#989)
- Rewrites headings that skip levels so the resulting HTML is valid (#1115)
- `normalize_headings/rebase_to_min_level` - rebases each document so its headings begin at `min_level`
- Added a new `footnote/enable_inline_footnotes` config option to disable the inline `^[Footnote text]` syntax (#1112)
- Added `Cursor::getBytePosition()` for obtaining the cursor's current byte offset within the line
- Added a new `xml/max_indentation_level` config option to control how far `XmlRenderer` indents nested elements (default: `16`; set to `0` for unindented output)
### Changed
- The `FootnoteExtension` now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
- `NumberFootnotesListener` now stores footnote backrefs under a single `footnote/backrefs` key in the document data instead of one key per footnote destination
- Optimized `Cursor` to translate character positions to byte offsets in constant time instead of re-decoding the line with `mb_substr()`
- Optimized `Cursor::match()` to match against the line at the cursor's byte offset instead of copying the remaining line on every call
- Optimized `InlineParserEngine` and `UrlAutolinkParser` to work with byte offsets directly
### Fixed
- Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
- Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as `java<TAB>script:`), which allowed the `allow_unsafe_links` protection to be bypassed via `href` and `src` attributes (GHSA-29pj-957v-52mc)
- Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
- Fixed footnote labels being treated as `.`/`/`-delimited key paths when storing backrefs, which allowed distinct labels such as `[^a.b]` and `[^a/b]` to share a single backref list (GHSA-jfm3-95jq-q3rf)
- Fixed a fatal error when one footnote label was a prefix of another, such as `[^a]` and `[^a.b]`
- Fixed the unique slug normalizer restarting its suffix search from `1` on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
- Fixed the `AttributesExtension` scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
- Fixed `XmlRenderer` indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
- Fixed `MarkDelimiterProcessor` not being declared as a `CacheableDelimiterProcessorInterface`, preventing the delimiter stack from caching the opener search for `==` runs (#1133)
## [2.8.3] - 2026-07-12
### Fixed
- Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
- Fixed the unsafe link filter incorrectly blocking safe URLs containing `vbscript:`, `file:`, or `data:` anywhere after the start (#1131)
## [2.8.2] - 2026-03-19
This is a **security release** to address an issue where the `allowed_domains` setting for the `Embed` extension can be bypassed, resulting in a possible SSRF and XSS vulnerabilities.
@ -732,7 +771,9 @@ No changes were introduced since the previous release.
- Alternative 1: Use `CommonMarkConverter` or `GithubFlavoredMarkdownConverter` if you don't need to customize the environment
- Alternative 2: Instantiate a new `Environment` and add the necessary extensions yourself
[unreleased]: https://github.com/thephpleague/commonmark/compare/2.8.2...HEAD
[unreleased]: https://github.com/thephpleague/commonmark/compare/2.9.0...HEAD
[2.9.0]: https://github.com/thephpleague/commonmark/compare/2.8.3...2.9.0
[2.8.3]: https://github.com/thephpleague/commonmark/compare/2.8.2...2.8.3
[2.8.2]: https://github.com/thephpleague/commonmark/compare/2.8.1...2.8.2
[2.8.1]: https://github.com/thephpleague/commonmark/compare/2.8.0...2.8.1
[2.8.0]: https://github.com/thephpleague/commonmark/compare/2.7.1...2.8.0