php-league-commonmark (2.10.0-1) unstable; urgency=medium

  [ Colin O'Dell ]
  * Fix XSS filter bypass via form feed in attribute names (GHSA-f8fg-pg57-v4j8)
  * Prevent quadratic backtracking in the fenced code start pattern
    (GHSA-j8pm-gj4c-rq4x)
  * Apply the 999-character link label limit when resolving references
    (GHSA-j8pm-gj4c-rq4x)
  * Bound the openersBottom cache key space in delimiter processors
    (GHSA-j8pm-gj4c-rq4x)
  * Append in place when merging adjacent text nodes (GHSA-jjv6-8j6v-6j52)
  * Fix quadratic attribute block and class list resolution
    (GHSA-jjv6-8j6v-6j52)
  * Optimize Cursor character scanning (#1139)
  * Stop cloning a node from mutating the node it was cloned from (#1140)
  * Optimize inline link destination parsing (#1141)
  * Fix 2.9.0 regression: restore Cursor::match() remainder semantics (#1146)
  * Publish Cursor::matchInPlace() and deprecate the anchored RegexHelper
    constants (#1147)
  * Accumulate attributes without re-merging the whole set each time
    (GHSA-8rr7-cvq3-gmfh)

  [ David Prévot ]
  * Document CVE in previous changelog entry
  * Document lintian-overrides
  * Use debhelper-compat = 14

 -- David Prévot <taffit@debian.org>  Thu, 13 Aug 2026 08:50:32 +0200

php-league-commonmark (2.9.0-1) unstable; urgency=medium

  [ Eyüp Can Akman ]
  * Add NormalizeHeadingsExtension to constrain heading levels (#1113)

  [ chillbram ]
  * Allow disabling of inline footnotes + documentation on inline footnotes
    (#1112)

  [ Colin O'Dell ]
  * Repair skipped heading levels in NormalizeHeadingsExtension (#1127)
  * Linearize multibyte parsing with a dense character->byte offset map
    (GHSA-2q4p-g7hv-5rgv) [CVE-2026-71488]
  * Fix unsafe link filter bypass via obfuscated schemes (GHSA-29pj-957v-52mc)
    [CVE-2026-71478]
  * Fix quadratic footnote backref generation (GHSA-jfm3-95jq-q3rf)
  * Fix quadratic slug de-duplication (GHSA-mh25-x5hq-wrqp)
  * Fix quadratic inline attribute target resolution (GHSA-g2gp-3wwq-f4ph)
  * Cap XmlRenderer indentation depth (GHSA-mj63-m3rc-8ppr)
  * Prepare to release 2.9.0

  [ Graham Campbell ]
  * Prevent quadratic Markdown parsing
  * Declare MarkDelimiterProcessor as a cacheable delimiter processor (#1133)

  [ David Prévot ]
  * Simplify patch

 -- David Prévot <taffit@debian.org>  Wed, 05 Aug 2026 07:17:52 +0200

php-league-commonmark (2.8.3-1) unstable; urgency=medium

  [ Colin O'Dell ]
  * Support PHPUnit 12 and 13
  * Fix tab handling in fenced code blocks (#1130)
  * Prepare for 2.8.3 release

  [ Graham Campbell ]
  * Fix over-blocking of safe URLs by the unsafe link filter (#1131)

  [ David Prévot ]
  * Last release is not signed

 -- David Prévot <taffit@debian.org>  Tue, 14 Jul 2026 18:46:55 -0300

php-league-commonmark (2.8.2-2) unstable; urgency=medium

  * Document CVE in previouss changelog entry
  * Use full version with RequiresPhpunit
  * Upgrade upstream signing key to new packet format
  * Update standards version to 4.7.4

 -- David Prévot <taffit@debian.org>  Thu, 07 May 2026 08:51:47 +0200

php-league-commonmark (2.8.2-1) unstable; urgency=medium

  [ Colin O'Dell ]
  * Fix DomainFilteringAdapter hostname boundary bypass [CVE-2026-33347]

  [ David Prévot ]
  * Documet CVE in previous changelog entries

 -- David Prévot <taffit@debian.org>  Mon, 23 Mar 2026 09:55:34 +0100

php-league-commonmark (2.8.1-1) unstable; urgency=medium

  [ Colin O'Dell ]
  * Fix DisallowedRawHtml bypass via newline/tab in tag names [CVE-2026-30838]
  * Prepare to release 2.8.1

  [ Frederic G. Østby ]
  * Fix PHP 8.5 deprecation

  [ David Prévot ]
  * Convert d/watch to version 5
  * Update Standards-Version to 4.7.3

 -- David Prévot <taffit@debian.org>  Fri, 06 Mar 2026 08:08:18 +0100

php-league-commonmark (2.8.0-1) unstable; urgency=medium

  [ Daniel Johnson ]
  * Add Mark (highlight) extension

  [ Colin O'Dell ]
  * Refactor docs to use major version folders instead of minor versions
  * Prepare to release 2.8.0

  [ copilot-swe-agent[bot] ]
  * Fix AutolinkExtension to anchor regex and add test cases

 -- David Prévot <taffit@debian.org>  Tue, 02 Dec 2025 10:26:20 +0100

php-league-commonmark (2.7.1-2) unstable; urgency=medium

  * Upload to unstable now that Trixie has been released
  * Remove Rules-Requires-Root
  * debian/control: Document nocheck flag

 -- David Prévot <taffit@debian.org>  Wed, 27 Aug 2025 08:20:09 +0200

php-league-commonmark (2.7.1-1) experimental; urgency=medium

  * Upload to experimental during the freeze

  [ Dries Vints ]
  * Update EmbedProcessor.php

  [ Colin O'Dell ]
  * Optimize REGEX_PUNCTUATION by removing redundant explicit characters
  * Optimize REGEX_THEMATIC_BREAK by consolidating anchors
  * Add atomic group to PARTIAL_ENTITY to prevent backtracking
  * Optimize PARTIAL_HTMLCOMMENT with better grouping
  * Add possessive quantifiers to HTML tag patterns to prevent backtracking
  * Optimize HTML Block Type 6 pattern with possessive quantifiers
  * Prepare to release 2.7.1

  [ copilot-swe-agent[bot] ]
  * Fix benchmark.php CSV path validation for non-existent files

 -- David Prévot <taffit@debian.org>  Wed, 23 Jul 2025 10:10:47 +0200

php-league-commonmark (2.7.0-1) unstable; urgency=medium

  [ Colin O'Dell ]
  * Fix XSS in AttributesExtension [CVE-2025-46734]
  * Prepare to release 2.7.0

 -- David Prévot <taffit@debian.org>  Mon, 05 May 2025 16:16:52 +0200

php-league-commonmark (2.6.2-1) unstable; urgency=medium

  [ Colin O'Dell ]
  * Fix Attributes extension parsing regression (#1071)
  * Prepare to release 2.6.2

  [ David Prévot ]
  * Update Standards-Version to 4.7.2

 -- David Prévot <taffit@debian.org>  Tue, 22 Apr 2025 13:01:30 +0200

php-league-commonmark (2.6.1-2) unstable; urgency=medium

  * Modernize PHPUnit syntax
  * Revert "Force system dependencies loading"
  * Simplify build
  * Update Standards-Version to 4.7.1

 -- David Prévot <taffit@debian.org>  Sat, 22 Feb 2025 12:46:35 +0100

php-league-commonmark (2.6.1-1) unstable; urgency=medium

  [ Colin O'Dell ]
  * Rendered list items should only add newlines around block-level children
  * Prepare to release 2.6.1

 -- David Prévot <taffit@debian.org>  Mon, 30 Dec 2024 13:56:06 +0100

php-league-commonmark (2.6.0-1) unstable; urgency=medium

  [ Colin O'Dell ]
  * Limit number of subdomains allowed in an autolink
  * Use a separate stack for brackets
  * Flag this as a security release
  * Prepare to release 2.6.0

 -- David Prévot <taffit@debian.org>  Thu, 26 Dec 2024 10:31:38 +0100

php-league-commonmark (2.5.3-1) unstable; urgency=medium

  [ Colin O'Dell ]
  * commonmark 0.31.1 compatibility
  * Release 2.5.3

 -- David Prévot <taffit@debian.org>  Sat, 17 Aug 2024 09:22:38 +0200

php-league-commonmark (2.5.1-1) unstable; urgency=medium

  [ Jason Varga ]
  * only need final lookahead

  [ Colin O'Dell ]
  * Fix incorrect Table start line numbers
  * Remove unnecessary unset()
  * Prepare to release 2.5.1

 -- David Prévot <taffit@debian.org>  Sat, 27 Jul 2024 11:12:40 +0900

php-league-commonmark (2.5.0-1) unstable; urgency=medium

  [ Colin O'Dell ]
  * Don't change already-formatted quotation marks
  * Bump CommonMark spec to 0.31.0
  * Allow closing fence to be followed by tabs
  * Remove restrictive limitation on inline comments
  * Treat unicode symbols like punctuation for purposes of flankingness
  * Exclude trailing tabs on the last line of indented code blocks
  * Fix list tightness and ending line numbers
  * Improve HTML comment matching
  * Accept lowercase inline HTML declarations
  * Prepare to release 2.5.0

  [ Sven Luijten ]
  * Allow adding attributes without value

  [ Xavier Lacot ]
  * allow valid CSS level 3 selectors for classes and ids in the attributes extension

  [ Andrew Minion ]
  * fix text containing www and following link

  [ David Prévot ]
  * Mark Data Provider method as static
  * Update Standards-Version to 4.7.0

 -- David Prévot <taffit@debian.org>  Tue, 23 Jul 2024 20:55:40 +0900

php-league-commonmark (2.4.2-2) unstable; urgency=medium

  * Force system dependencies loading

 -- David Prévot <taffit@debian.org>  Tue, 05 Mar 2024 18:08:59 +0100

php-league-commonmark (2.4.2-1) unstable; urgency=medium

  [ Colin O'Dell ]
  * Allow declarations with no space, as per spec
  * Don't add `language-` to class if already prefixed
  * Allow testing with phpunit 11
  * Prepare to release 2.4.2

  [ David Prévot ]
  * Use php-yaml for tests
  * Don’t use PHPUnit coverage

 -- David Prévot <taffit@debian.org>  Wed, 07 Feb 2024 08:04:50 +0100

php-league-commonmark (2.4.1-1) unstable; urgency=medium

  * Upload to unstable now that Bookworm has been released

  [ Colin O'Dell ]
  * Fix ExternalLinkProcessor not fully disabling the `rel` attribute
  * Prepare to release 2.4.1

  [ David Prévot ]
  * Drop php-shellcommand build-dependency
  * Update PHPUnit cache path
  * Drop tests breaking under PHPUnit 10 (Closes: #1039786)

 -- David Prévot <taffit@debian.org>  Mon, 04 Sep 2023 15:36:59 +0530

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog php-league-commonmark`.
