{"id":606708,"name":"league/commonmark","ecosystem":"packagist","description":"Highly-extensible PHP Markdown parser which fully supports the CommonMark spec and GitHub-Flavored Markdown (GFM)","homepage":"https://commonmark.thephpleague.com","licenses":"BSD-3-Clause","normalized_licenses":["BSD-3-Clause"],"repository_url":"https://github.com/thephpleague/commonmark","keywords_array":["parser","markdown","github","md","gfm","commonmark","flavored","github-flavored"],"namespace":"league","versions_count":151,"first_release_published_at":"2014-09-08T13:43:41.000Z","latest_release_published_at":"2026-10-31T13:35:37.000Z","latest_release_number":"2.10.7","latest_published_release_number":"2.10.7","last_synced_at":"2026-11-12T12:33:20.606Z","created_at":"2022-04-07T10:01:47.646Z","updated_at":"2026-11-12T13:21:05.922Z","registry_url":"https://packagist.org/packages/league/commonmark#","install_command":"composer require league/commonmark","documentation_url":null,"metadata":{"funding":[{"url":"https://www.colinodell.com/sponsor","type":"custom"},{"url":"https://www.paypal.me/colinpodell/10.00","type":"custom"},{"url":"https://github.com/colinodell","type":"github"},{"url":"https://tidelift.com/funding/github/packagist/league/commonmark","type":"tidelift"}],"abandoned":false,"malware":[],"packagist_snapshot":{"last_modified":1793453759,"sha256":"69abd78d34dec884eadceb7a2d2f7d3799534aa9e9400311c406728c9c0415eb"}},"repo_metadata":{"id":20490768,"uuid":"23768977","full_name":"thephpleague/commonmark","owner":"thephpleague","description":"Highly-extensible PHP Markdown parser which fully supports the CommonMark and GFM specs.","archived":false,"fork":false,"pushed_at":"2026-11-08T00:05:12.000Z","size":6988,"stargazers_count":2982,"open_issues_count":20,"forks_count":221,"subscribers_count":33,"default_branch":"2.10","last_synced_at":"2026-11-08T20:24:13.058Z","etag":null,"topics":["commonmark","gfm","github-flavored-markdown","hacktoberfest","markdown","php"],"latest_commit_sha":null,"homepage":"https://commonmark.thephpleague.com","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/thephpleague.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG-0.x.md","contributing":".github/CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":".github/CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":".github/SECURITY.md","accessibility":null,"support":".github/SUPPORT.MD","governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":"CLAUDE.md","gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null},"funding":{"github":"colinodell","tidelift":"packagist/league/commonmark","custom":["https://www.colinodell.com/sponsor","https://www.paypal.me/colinpodell/10.00"]}},"created_at":"2014-09-07T19:37:12.000Z","updated_at":"2026-11-08T03:45:58.000Z","dependencies_parsed_at":"2026-10-25T16:28:48.630Z","dependency_job_id":null,"html_url":"https://github.com/thephpleague/commonmark","commit_stats":{"total_commits":2259,"total_committers":120,"mean_commits":18.825,"dds":"0.24435590969455512","last_synced_commit":"d990688c91cedfb69753ffc2512727ec646df2ad"},"previous_names":[],"tags_count":151,"template":false,"template_full_name":null,"purl":"pkg:github/thephpleague/commonmark","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/thephpleague","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/refs/heads/2.10","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/sbom","scorecard":{"id":518745,"data":{"date":"2025-08-11","repo":{"name":"github.com/thephpleague/commonmark","commit":"10732241927d3971d28e7ea7b5712721fa2296ca"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":6.1,"checks":[{"name":"Maintained","score":10,"reason":"28 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Code-Review","score":4,"reason":"Found 4/9 approved changesets -- score normalized to 4","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"CII-Best-Practices","score":10,"reason":"badge detected: Gold","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: BSD 3-Clause \"New\" or \"Revised\" License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Pinned-Dependencies","score":-1,"reason":"no dependencies found","details":null,"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 26 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-20T02:25:50.107Z","repository_id":20490768,"created_at":"2025-08-20T02:25:50.108Z","updated_at":"2025-08-20T02:25:50.108Z"},"funding_links":["https://github.com/sponsors/colinodell","https://tidelift.com/funding/github/packagist/league/commonmark","https://www.colinodell.com/sponsor","https://www.paypal.me/colinpodell/10.00"],"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":349647599,"owners_count":38599631,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-11-03T11:36:44.738Z","status":"online","status_checked_at":"2026-11-09T02:00:07.000Z","response_time":106,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"thephpleague","name":"The League of Extraordinary Packages","uuid":"527621","kind":"organization","description":"A group of developers who have banded together to build solid, well tested PHP packages using modern coding standards.","email":null,"website":"https://thephpleague.com","location":"Worldwide","twitter":"thephpleague","company":null,"icon_url":"https://avatars.githubusercontent.com/u/527621?v=4","repositories_count":159,"last_synced_at":"2026-11-11T18:21:57.311Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/thephpleague","funding_links":[],"total_stars":75189,"followers":958,"following":0,"created_at":"2022-11-02T16:21:15.697Z","updated_at":"2026-11-11T18:21:57.337Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/thephpleague","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/thephpleague/repositories"},"tags":[{"name":"2.10.7","sha":"8eb53e906fd60c67038d22f1f1cab420ed58b8be","kind":"tag","published_at":"2026-10-31T13:35:48.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.10.7","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.10.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.10.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.7/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.10.7"},{"name":"2.10.6","sha":"cb3d6a523587751db4b8e1d0c3945d2d68535bd3","kind":"tag","published_at":"2026-10-30T12:24:50.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.10.6","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.10.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.10.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.6/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.10.6"},{"name":"2.10.5","sha":"6d6ed049ee31e1e644ce51a11a7b1b12f2dc3ade","kind":"tag","published_at":"2026-10-30T11:53:57.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.10.5","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.10.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.10.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.5/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.10.5"},{"name":"2.10.4","sha":"40821b7606d8d946bac57dbd2290076c722e3a65","kind":"tag","published_at":"2026-10-17T20:02:29.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.10.4","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.10.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.10.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.10.4"},{"name":"2.10.3","sha":"6efbd9c472b91db0a3350fcd601c8332c2382e1f","kind":"tag","published_at":"2026-09-21T13:07:34.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.10.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.10.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.10.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.10.3"},{"name":"2.10.2","sha":"692e90b901877bdfd727e51270ce4394633c6e74","kind":"tag","published_at":"2026-09-21T12:29:14.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.10.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.10.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.10.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.10.2"},{"name":"2.10.1","sha":"9d489ab67a02960fd8ffe624d93f751daf95439e","kind":"commit","published_at":"2026-09-07T13:44:26.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.10.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.10.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.10.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.10.1"},{"name":"2.10.0","sha":"d2d1aa8b35e072966c89bc0c66cf926e56767dc4","kind":"tag","published_at":"2026-08-11T16:15:01.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.10.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.10.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.10.0"},{"name":"2.9.2","sha":"72e9a87efcf41a8e83be3ed0866b69d77565cb12","kind":"tag","published_at":"2026-08-11T00:59:02.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.9.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.9.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.9.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.9.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.9.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.9.2"},{"name":"2.9.1","sha":"73cb188c785abfa7a7bec73487148202968274c6","kind":"tag","published_at":"2026-08-09T14:17:59.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.9.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.9.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.9.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.9.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.9.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.9.1"},{"name":"2.9.0","sha":"5703d83ba3da3b2e356a5fedc848ed6d8ffb6529","kind":"tag","published_at":"2026-08-03T14:04:51.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.9.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.9.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.9.0"},{"name":"2.8.3","sha":"1902f60f984235023acbe03db6ad614a37b3c3e7","kind":"tag","published_at":"2026-07-12T15:29:19.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.8.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.8.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.8.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.8.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.8.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.8.3"},{"name":"2.8.2","sha":"59fb075d2101740c337c7216e3f32b36c204218b","kind":"tag","published_at":"2026-03-19T13:19:02.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.8.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.8.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.8.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.8.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.8.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.8.2"},{"name":"2.8.1","sha":"84b1ca48347efdbe775426f108622a42735a6579","kind":"tag","published_at":"2026-03-05T21:37:11.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.8.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.8.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.8.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.8.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.8.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.8.1"},{"name":"2.8.0","sha":"4efa10c1e56488e658d10adf7b7b7dcd19940bfb","kind":"tag","published_at":"2025-11-26T21:48:40.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.8.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.8.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.8.0"},{"name":"2.7.1","sha":"10732241927d3971d28e7ea7b5712721fa2296ca","kind":"tag","published_at":"2025-07-20T12:47:52.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.7.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.7.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.7.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.7.1"},{"name":"2.7.0","sha":"6fbb36d44824ed4091adbcf4c7d4a3923cdb3405","kind":"tag","published_at":"2025-05-05T12:20:34.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.7.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.7.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.7.0"},{"name":"2.6.2","sha":"06c3b0bf2540338094575612f4a1778d0d2d5e94","kind":"tag","published_at":"2025-04-18T21:12:07.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.6.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.6.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.6.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.6.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.6.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.6.2"},{"name":"2.6.1","sha":"d990688c91cedfb69753ffc2512727ec646df2ad","kind":"tag","published_at":"2024-12-29T14:11:11.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.6.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.6.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.6.1"},{"name":"2.6.0","sha":"d150f911e0079e90ae3c106734c93137c184f932","kind":"tag","published_at":"2024-12-07T15:34:35.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.6.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.6.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.6.0"},{"name":"2.5.3","sha":"b650144166dfa7703e62a22e493b853b58d874b0","kind":"tag","published_at":"2024-08-16T11:46:37.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.5.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.5.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.5.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.5.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.5.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.5.3"},{"name":"2.5.2","sha":"df09d5b6a4188f8f3c3ab2e43a109076a5eeb767","kind":"tag","published_at":"2024-08-14T10:57:13.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.5.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.5.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.5.2"},{"name":"2.5.1","sha":"ac815920de0eff6de947eac0a6a94e5ed0fb147c","kind":"tag","published_at":"2024-07-24T12:52:13.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.5.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.5.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.5.1"},{"name":"2.5.0","sha":"0026475f5c9a104410ae824cb5a4d63fa3bdb1df","kind":"tag","published_at":"2024-07-22T18:23:38.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.5.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.5.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.5.0"},{"name":"2.4.4","sha":"50bd4dce0d53e1b3b51a153fc2e44a7dc3f7ee5b","kind":"tag","published_at":"2024-07-22T17:11:30.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.4.4","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.4.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.4.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.4.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.4.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.4.4"},{"name":"2.4.3","sha":"b7a7af3a23a818dcc5836e62e93e4b9ce4704481","kind":"tag","published_at":"2024-07-22T12:31:31.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.4.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.4.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.4.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.4.3"},{"name":"2.4.2","sha":"91c24291965bd6d7c46c46a12ba7492f83b1cadf","kind":"tag","published_at":"2024-02-02T11:59:45.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.4.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.4.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.4.2"},{"name":"2.4.1","sha":"3669d6d5f7a47a93c08ddff335e6d945481a1dd5","kind":"tag","published_at":"2023-08-30T16:55:08.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.4.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.4.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.4.1"},{"name":"2.4.0","sha":"d44a24690f16b8c1808bf13b1bd54ae4c63ea048","kind":"tag","published_at":"2023-03-24T15:18:34.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.4.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.4.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.4.0"},{"name":"2.3.9","sha":"c1e114f74e518daca2729ea8c4bf1167038fa4b5","kind":"tag","published_at":"2023-02-15T14:07:34.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.3.9","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.3.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.3.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.9/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.3.9"},{"name":"2.3.8","sha":"c493585c130544c4e91d2e0e131e6d35cb0cbc47","kind":"tag","published_at":"2022-12-10T16:02:20.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.3.8","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.3.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.3.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.8/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.3.8"},{"name":"2.3.7","sha":"a36bd2be4f5387c0f3a8792a0d76b7d68865abbf","kind":"tag","published_at":"2022-11-03T17:30:06.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.3.7","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.3.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.3.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.7/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.3.7"},{"name":"2.3.6","sha":"857afc47ce113454bd629037213378ba3219dd40","kind":"tag","published_at":"2022-10-30T16:45:44.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.3.6","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.3.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.3.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.6/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.3.6"},{"name":"2.3.5","sha":"84d74485fdb7074f4f9dd6f02ab957b1de513257","kind":"tag","published_at":"2022-07-29T10:59:59.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.3.5","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.3.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.3.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.5/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.3.5"},{"name":"2.3.4","sha":"155ec1c95626b16fda0889cf15904d24890a60d5","kind":"tag","published_at":"2022-07-17T16:25:59.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.3.4","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.3.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.3.4"},{"name":"2.3.3","sha":"0da1dca5781dd3cfddbe328224d9a7a62571addc","kind":"tag","published_at":"2022-06-07T21:28:31.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.3.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.3.3"},{"name":"2.3.2","sha":"6eddb90a9e4a1a8c5773226068fcfb48cb36812a","kind":"tag","published_at":"2022-06-03T14:07:45.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.3.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.3.2"},{"name":"2.2.5","sha":"3a466decc0bd43d9f63ed7c008043a4e9a9cb1b7","kind":"tag","published_at":"2022-06-03T14:05:36.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.2.5","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.2.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.2.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.2.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.2.5/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.2.5"},{"name":"2.3.1","sha":"cb36fee279f7fca01d5d9399ddd1b37e48e2eca1","kind":"tag","published_at":"2022-05-14T15:38:54.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.3.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.3.1"},{"name":"2.2.4","sha":"9981c77d62ebe1d3038e3cb3d79cd83bc50cb465","kind":"tag","published_at":"2022-05-14T15:33:12.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.2.4","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.2.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.2.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.2.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.2.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.2.4"},{"name":"2.3.0","sha":"32a49eb2b38fe5e5c417ab748a45d0beaab97955","kind":"tag","published_at":"2022-04-07T22:41:28.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.3.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.3.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.3.0"},{"name":"2.2.3","sha":"47b015bc4e50fd4438c1ffef6139a1fb65d2ab71","kind":"tag","published_at":"2022-02-26T21:25:07.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.2.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.2.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.2.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.2.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.2.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.2.3"},{"name":"2.1.3","sha":"7cdfc405d1c0ac925965f4f04e75a2652120e9c0","kind":"tag","published_at":"2022-02-26T21:21:02.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.1.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.1.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.1.3"},{"name":"2.0.4","sha":"39031adf944087c1d5a4fd9875c65e668f986e96","kind":"tag","published_at":"2022-02-26T21:10:54.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.0.4","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.0.4"},{"name":"2.2.2","sha":"13d7751377732637814f0cda0e3f6d3243f9f769","kind":"tag","published_at":"2022-02-13T15:01:10.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.2.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.2.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.2.2"},{"name":"2.1.2","sha":"34712ca82dc1bc44e0bc2594b9ad472b66195ab8","kind":"tag","published_at":"2022-02-13T14:57:30.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.1.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.1.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.1.2"},{"name":"2.0.3","sha":"36949f88678df34526871f32055bce429be23b13","kind":"tag","published_at":"2022-02-13T14:22:29.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.0.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.0.3"},{"name":"2.2.1","sha":"f8afb78f087777b040e0ab8a6b6ca93f6fc3f18a","kind":"tag","published_at":"2022-01-25T14:37:56.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.2.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.2.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.2.1"},{"name":"2.2.0","sha":"c5aadcc15548629787d02b86a7afef03b46271b5","kind":"tag","published_at":"2022-01-22T14:06:36.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.2.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.2.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.2.0"},{"name":"1.6.7","sha":"2b8185c13bc9578367a5bf901881d1c1b5bbd09b","kind":"tag","published_at":"2022-01-13T17:18:17.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.6.7","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.6.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.6.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.7/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.6.7"},{"name":"2.1.1","sha":"17d2b9cb5161a2ea1a8dd30e6991d668e503fb9d","kind":"tag","published_at":"2022-01-02T18:27:39.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.1.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.1.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.1.1"},{"name":"2.1.0","sha":"819276bc54e83c160617d3ac0a436c239e479928","kind":"tag","published_at":"2021-12-05T18:28:52.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.1.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.1.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.1.0"},{"name":"2.0.2","sha":"2df87709f44b0dd733df86aef0830dce9b1f0f13","kind":"tag","published_at":"2021-08-14T14:06:13.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.0.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.0.2"},{"name":"2.0.1","sha":"0d57f20aa03129ee7ef5f690e634884315d4238c","kind":"tag","published_at":"2021-07-31T19:16:23.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.0.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.0.1"},{"name":"2.0.0","sha":"167142baf9a6b946f99ad9325b06028606f8238e","kind":"tag","published_at":"2021-07-24T20:13:05.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.0.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.0.0"},{"name":"2.0.0-rc2","sha":"61f4efe57db6b8c02a1470dd0894fbacf23ef19b","kind":"tag","published_at":"2021-07-17T17:20:55.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.0.0-rc2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.0.0-rc2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.0.0-rc2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.0-rc2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.0-rc2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.0.0-rc2"},{"name":"1.6.6","sha":"c4228d11e30d7493c6836d20872f9582d8ba6dcf","kind":"tag","published_at":"2021-07-17T17:13:26.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.6.6","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.6.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.6.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.6/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.6.6"},{"name":"2.0.0-rc1","sha":"4b7060e5b7aad24c34e72581cbb9728997394765","kind":"tag","published_at":"2021-07-10T19:57:56.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.0.0-rc1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.0.0-rc1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.0.0-rc1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.0-rc1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.0-rc1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.0.0-rc1"},{"name":"2.0.0-beta3","sha":"d8b7646c9b8c7e21c6753a77e1cb6c893e0bbcdc","kind":"tag","published_at":"2021-07-03T22:34:11.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.0.0-beta3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.0.0-beta3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.0.0-beta3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.0-beta3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.0-beta3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.0.0-beta3"},{"name":"2.0.0-beta2","sha":"68ef5589dec9fb78d35353a018890eeb1b34d915","kind":"tag","published_at":"2021-06-27T16:40:25.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.0.0-beta2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.0.0-beta2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.0.0-beta2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.0-beta2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.0-beta2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.0.0-beta2"},{"name":"1.6.5","sha":"44ffd8d3c4a9133e4bd0548622b09c55af39db5f","kind":"tag","published_at":"2021-06-26T11:57:16.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.6.5","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.6.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.6.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.5/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.6.5"},{"name":"2.0.0-beta1","sha":"8cde9a26daaaf6bfb0f5b1fdf7c0d7127e5b18be","kind":"tag","published_at":"2021-06-20T19:32:11.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/2.0.0-beta1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/2.0.0-beta1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@2.0.0-beta1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.0-beta1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/2.0.0-beta1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/2.0.0-beta1"},{"name":"1.6.4","sha":"c3c8b7217c52572fb42aaf84211abccf75a151b2","kind":"tag","published_at":"2021-06-19T20:08:17.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.6.4","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.6.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.6.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.6.4"},{"name":"1.6.3","sha":"9b8cd7e3f234f15a25204e1e875571af7cc3dc8b","kind":"tag","published_at":"2021-06-19T15:03:40.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.6.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.6.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.6.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.6.3"},{"name":"1.6.2","sha":"7d70d2f19c84bcc16275ea47edabee24747352eb","kind":"tag","published_at":"2021-05-12T11:39:45.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.6.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.6.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.6.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.6.2"},{"name":"1.6.1","sha":"2651c497f005de305c7ba3f232cbd87b8c00ee8c","kind":"tag","published_at":"2021-05-08T16:08:05.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.6.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.6.1"},{"name":"1.6.0","sha":"19a9673b833cc37770439097b381d86cd125bfe8","kind":"tag","published_at":"2021-05-01T19:01:06.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.6.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.6.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.6.0"},{"name":"1.5.8","sha":"08fa59b8e4e34ea8a773d55139ae9ac0e0aecbaf","kind":"tag","published_at":"2021-03-28T18:51:43.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.5.8","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.5.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.5.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.8/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.5.8"},{"name":"1.5.7","sha":"11df9b36fd4f1d2b727a73bf14931d81373b9a54","kind":"tag","published_at":"2020-10-31T13:49:37.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.5.7","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.5.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.5.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.7/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.5.7"},{"name":"1.5.6","sha":"a56e91e0fa1f6d0049153a9c34f63488f6b7ce61","kind":"tag","published_at":"2020-10-17T21:33:07.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.5.6","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.5.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.5.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.6/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.5.6"},{"name":"1.5.5","sha":"45832dfed6007b984c0d40addfac48d403dc6432","kind":"tag","published_at":"2020-09-13T14:44:51.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.5.5","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.5.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.5.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.5/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.5.5"},{"name":"1.5.4","sha":"21819c989e69bab07e933866ad30c7e3f32984ba","kind":"tag","published_at":"2020-08-18T01:19:29.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.5.4","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.5.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.5.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.5.4"},{"name":"1.5.3","sha":"2574454b97e4103dc4e36917bd783b25624aefcd","kind":"tag","published_at":"2020-07-19T22:47:33.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.5.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.5.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.5.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.5.3"},{"name":"1.5.2","sha":"9bc3b1d6148b3d9dfcced033f672d77cb8e535b1","kind":"tag","published_at":"2020-07-19T22:14:26.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.5.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.5.2"},{"name":"1.5.1","sha":"6d74caf6abeed5fd85d6ec20da23d7269cd0b46f","kind":"tag","published_at":"2020-06-27T12:50:12.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.5.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.5.1"},{"name":"1.5.0","sha":"fc33ca12575e98e57cdce7d5f38b2ca5335714b3","kind":"tag","published_at":"2020-06-21T20:50:16.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.5.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.5.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.5.0"},{"name":"1.4.3","sha":"412639f7cfbc0b31ad2455b2fe965095f66ae505","kind":"tag","published_at":"2020-05-04T22:15:33.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.4.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.4.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.4.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.4.3"},{"name":"1.4.2","sha":"9e780d972185e4f737a03bade0fd34a9e67bbf31","kind":"tag","published_at":"2020-04-24T13:40:00.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.4.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.4.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.4.2"},{"name":"1.4.1","sha":"c995966d35424bae20f76f8b31248099487a3f57","kind":"tag","published_at":"2020-04-20T13:36:55.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.4.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.4.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.4.1"},{"name":"1.4.0","sha":"517cbe1c6faf90afeb38a0e917c73acc6d3051ce","kind":"tag","published_at":"2020-04-18T20:46:28.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.4.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.4.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.4.0"},{"name":"1.3.4","sha":"dd3261eb9a322e009fa5d96d19b9ae19708ce04b","kind":"tag","published_at":"2020-04-13T20:52:27.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.3.4","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.3.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.3.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.3.4"},{"name":"1.3.3","sha":"5a67afc2572ec6d430526cdc9c637ef124812389","kind":"tag","published_at":"2020-04-05T16:01:54.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.3.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.3.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.3.3"},{"name":"1.3.2","sha":"75542a366ccbe1896ed79fcf3e8e68206d6c4257","kind":"tag","published_at":"2020-03-25T19:55:37.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.3.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.3.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.3.2"},{"name":"1.3.1","sha":"8015f806173c6ee54de25a87c2d69736696e88db","kind":"tag","published_at":"2020-02-28T18:54:10.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.3.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.3.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.3.1"},{"name":"1.3.0","sha":"4f30be7a2cbf3bfa5788abab71384713e48f451f","kind":"tag","published_at":"2020-02-08T23:42:10.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.3.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.3.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.3.0"},{"name":"1.2.2","sha":"34cf4ddb3892c715ae785c880e6691d839cff88d","kind":"tag","published_at":"2020-01-16T01:18:17.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.2.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.2.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.2.2"},{"name":"1.1.3","sha":"b9ffbab283593d94ed486f73ea2a2e8ac022e24b","kind":"tag","published_at":"2020-01-16T01:09:57.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.1.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.1.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.1.3"},{"name":"1.2.1","sha":"74e08793c41c72c8ed7a22df803f2ffcaf77efb7","kind":"tag","published_at":"2020-01-15T03:32:46.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.2.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.2.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.2.1"},{"name":"1.2.0","sha":"2533c389fd2a7573d4f7be279b1c33cf941c8dfc","kind":"tag","published_at":"2020-01-09T22:41:13.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.2.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.2.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.2.0"},{"name":"1.1.2","sha":"772e03fa9c6477ef5ef2d154fefd8a2a8d8ed03c","kind":"tag","published_at":"2019-12-10T02:55:11.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.1.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.1.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.1.2"},{"name":"1.1.1","sha":"d74654d85954e3b9451d67faaebacd210fc70252","kind":"tag","published_at":"2019-11-11T22:23:33.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.1.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.1.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.1.1"},{"name":"1.1.0","sha":"d927c05e9a391688b1e59a606c97465a90531789","kind":"tag","published_at":"2019-10-31T13:30:39.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.1.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.1.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.1.0"},{"name":"1.0.0","sha":"7a40f2b0931602c504c2a9692d9f1e33635fd5ef","kind":"tag","published_at":"2019-06-29T11:19:05.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.0.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.0.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.0.0"},{"name":"1.0.0-rc1","sha":"a6721350ecae7594962e2cf99ff68b450cf20194","kind":"tag","published_at":"2019-06-20T01:47:38.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.0.0-rc1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.0.0-rc1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.0.0-rc1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.0.0-rc1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.0.0-rc1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.0.0-rc1"},{"name":"0.19.3","sha":"c6ecea928b432ae417fa9942840bbfd8c332448c","kind":"tag","published_at":"2019-06-18T18:29:19.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.19.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.19.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.19.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.19.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.19.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.19.3"},{"name":"1.0.0-beta4","sha":"a080b1e8b38ebb2776fa5192391b2f3f024424f2","kind":"tag","published_at":"2019-06-05T21:46:23.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.0.0-beta4","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.0.0-beta4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.0.0-beta4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.0.0-beta4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.0.0-beta4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.0.0-beta4"},{"name":"1.0.0-beta3","sha":"322dd4bbd56c5e5444088dd64bdca762245079c1","kind":"tag","published_at":"2019-05-28T00:52:39.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.0.0-beta3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.0.0-beta3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.0.0-beta3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.0.0-beta3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.0.0-beta3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.0.0-beta3"},{"name":"1.0.0-beta2","sha":"e96544a3ae4daf7d85ddc2544fe7b47cf3b48c99","kind":"tag","published_at":"2019-05-27T17:49:07.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.0.0-beta2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.0.0-beta2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.0.0-beta2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.0.0-beta2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.0.0-beta2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.0.0-beta2"},{"name":"1.0.0-beta1","sha":"211be90ed241f45e688c2dcc3487d019802b0715","kind":"tag","published_at":"2019-05-26T21:53:15.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/1.0.0-beta1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/1.0.0-beta1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@1.0.0-beta1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.0.0-beta1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/1.0.0-beta1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/1.0.0-beta1"},{"name":"0.19.2","sha":"8401e1c1e409a08fcf558aadb6951c33749d701e","kind":"tag","published_at":"2019-05-19T13:39:42.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.19.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.19.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.19.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.19.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.19.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.19.2"},{"name":"0.19.1","sha":"d42b2d4a5d0a8eb2a4514f828ecb6f5db13a7c6f","kind":"tag","published_at":"2019-04-11T04:37:09.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.19.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.19.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.19.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.19.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.19.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.19.1"},{"name":"0.19.0","sha":"deb4f7ed434ba9b7a147efd3726be4895eb9b157","kind":"tag","published_at":"2019-04-11T02:28:38.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.19.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.19.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.19.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.19.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.19.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.19.0"},{"name":"0.18.5","sha":"f94e18d68260f43a7d846279cad88405854b1306","kind":"tag","published_at":"2019-03-28T13:52:37.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.18.5","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.18.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.18.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.18.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.18.5/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.18.5"},{"name":"0.18.4","sha":"93fa5e85c2e5e7f59ee2537449abc677096fb1c8","kind":"tag","published_at":"2019-03-24T02:45:43.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.18.4","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.18.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.18.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.18.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.18.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.18.4"},{"name":"0.18.3","sha":"b1ec41ce15c3bd6f7cbe86a645b3efc78d927446","kind":"tag","published_at":"2019-03-21T22:47:41.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.18.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.18.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.18.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.18.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.18.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.18.3"},{"name":"0.18.2","sha":"ad51c7cafb90e0bbd9f34b71d18d05994547e352","kind":"tag","published_at":"2019-03-17T01:42:11.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.18.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.18.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.18.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.18.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.18.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.18.2"},{"name":"0.18.1","sha":"e5029f74ba39e043ce4b3ca6c05dc719d8aafd94","kind":"commit","published_at":"2018-12-30T01:55:29.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.18.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.18.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.18.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.18.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.18.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.18.1"},{"name":"0.18.0","sha":"006af077d4b1b7eb1d9760964f9f984ba188632c","kind":"commit","published_at":"2018-09-18T13:13:55.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.18.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.18.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.18.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.18.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.18.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.18.0"},{"name":"0.17.5","sha":"82d7ab62d7f68391cb9d323f3ccce50be24a5369","kind":"commit","published_at":"2018-03-29T14:35:19.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.17.5","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.17.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.17.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.17.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.17.5/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.17.5"},{"name":"0.17.4","sha":"b02bfcbaca5a83666494eef5caa9d338c279a0ce","kind":"commit","published_at":"2018-03-29T03:10:21.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.17.4","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.17.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.17.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.17.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.17.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.17.4"},{"name":"0.17.3","sha":"fae7d27d6667365b0f497418014916d9918827ab","kind":"commit","published_at":"2018-03-26T20:05:02.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.17.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.17.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.17.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.17.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.17.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.17.3"},{"name":"0.17.2","sha":"ea1f655153cd618876634d86000b9b60c15bacd2","kind":"commit","published_at":"2018-03-26T01:39:03.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.17.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.17.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.17.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.17.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.17.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.17.2"},{"name":"0.17.1","sha":"38b2fca6b8493abd9314fcf6b5b042cfba6a0f11","kind":"commit","published_at":"2018-03-18T13:01:30.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.17.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.17.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.17.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.17.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.17.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.17.1"},{"name":"0.17.0","sha":"3b4c2224524776a584de663c7a04bc8eb2e1544d","kind":"commit","published_at":"2017-12-30T22:08:48.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.17.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.17.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.17.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.17.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.17.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.17.0"},{"name":"0.16.0","sha":"c0e41be0f80c51ad3170c9c713f74a0b8dec59ce","kind":"commit","published_at":"2017-10-31T00:49:55.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.16.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.16.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.16.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.16.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.16.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.16.0"},{"name":"0.15.7","sha":"36d82f166e441dfa28643f8d01dd8bdd3a579adf","kind":"commit","published_at":"2017-10-26T15:41:07.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.15.7","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.15.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.15.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.7/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.15.7"},{"name":"0.15.6","sha":"91742543c25fecedc84a4883d2919213e04a73b7","kind":"commit","published_at":"2017-08-08T11:47:33.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.15.6","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.15.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.15.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.6/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.15.6"},{"name":"0.15.5","sha":"1162ff74f8ab66593d62c58142310101b415cd2a","kind":"commit","published_at":"2017-08-05T19:40:59.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.15.5","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.15.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.15.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.5/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.15.5"},{"name":"0.15.4","sha":"c4c8e6bf99e62d9568875d9fc3ef473fe3e18e0c","kind":"commit","published_at":"2017-05-09T12:47:53.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.15.4","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.15.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.15.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.15.4"},{"name":"0.15.3","sha":"c8b43ee5821362216f8e9ac684f0f59de164edcc","kind":"commit","published_at":"2016-12-19T00:11:43.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.15.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.15.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.15.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.15.3"},{"name":"0.15.2","sha":"c3b08b911e7344e45b87529eabc8b559d48093d4","kind":"commit","published_at":"2016-11-22T17:30:29.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.15.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.15.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.15.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.15.2"},{"name":"0.15.1","sha":"20bdba6777e6c63f861711501eec8887e65412fc","kind":"commit","published_at":"2016-11-08T15:28:32.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.15.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.15.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.15.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.15.1"},{"name":"0.15.0","sha":"19fb96643beba24e681c371dc133e25409742664","kind":"commit","published_at":"2016-09-14T15:44:35.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.15.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.15.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.15.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.15.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.15.0"},{"name":"0.14.0","sha":"b73c0b7288bd0e6f9f56bd0b20d0657214b91838","kind":"commit","published_at":"2016-07-02T18:48:39.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.14.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.14.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.14.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.14.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.14.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.14.0"},{"name":"0.13.4","sha":"83f8210427fb01f671e272bb8d44b4ed3a94d459","kind":"commit","published_at":"2016-06-14T14:49:29.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.13.4","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.13.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.13.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.13.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.13.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.13.4"},{"name":"0.13.3","sha":"35816f39eb2498484fbb7b1495633a976ee1a8de","kind":"commit","published_at":"2016-05-21T18:41:30.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.13.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.13.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.13.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.13.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.13.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.13.3"},{"name":"0.13.2","sha":"35ac362082ca983a8123df2ee2cdfcf456ab6295","kind":"commit","published_at":"2016-03-27T19:10:13.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.13.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.13.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.13.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.13.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.13.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.13.2"},{"name":"0.13.1","sha":"2c10de455649e3a544d45016d9df457248bcd37f","kind":"commit","published_at":"2016-03-09T15:20:24.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.13.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.13.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.13.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.13.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.13.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.13.1"},{"name":"0.13.0","sha":"a4e93bc4fd1a8ff8f534040c4a07371ea5f4b484","kind":"commit","published_at":"2016-01-14T04:29:54.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.13.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.13.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.13.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.13.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.13.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.13.0"},{"name":"0.12.0","sha":"3eb64850ee688623db494398a5284a7a4cdf7b47","kind":"commit","published_at":"2015-11-04T14:24:41.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.12.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.12.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.12.0"},{"name":"0.11.3","sha":"d22d6a6a4b049faccc2f8e491cce6076eeb165c7","kind":"commit","published_at":"2015-09-25T12:40:32.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.11.3","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.11.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.11.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.11.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.11.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.11.3"},{"name":"0.11.2","sha":"467d06b442cc2da542cc0e34a81236142623a66b","kind":"commit","published_at":"2015-09-23T14:07:24.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.11.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.11.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.11.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.11.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.11.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.11.2"},{"name":"0.11.1","sha":"38551450ca8a065f5caa5f5fc64a777b3630bef2","kind":"commit","published_at":"2015-09-22T12:05:57.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.11.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.11.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.11.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.11.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.11.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.11.1"},{"name":"0.11.0","sha":"1af805de706b10705dea159a7ba927c4def2c0a1","kind":"commit","published_at":"2015-09-19T15:04:43.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.11.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.11.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.11.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.11.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.11.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.11.0"},{"name":"0.10.0","sha":"984455f72d4f07669c1f5c545768f60c4e871585","kind":"commit","published_at":"2015-07-25T14:37:05.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.10.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.10.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.10.0"},{"name":"0.9.0","sha":"8b681a57233f00578195573d7d251c2f143c1a5d","kind":"commit","published_at":"2015-06-19T00:39:51.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.9.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.9.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.9.0"},{"name":"0.8.0","sha":"91696c88df298f75fdd2075e4bb19c6dbd7338ca","kind":"commit","published_at":"2015-04-29T18:01:46.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.8.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.8.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.8.0"},{"name":"0.7.2","sha":"7fecb7bdef265e45c80c53e1000e2056a9463401","kind":"commit","published_at":"2015-03-08T17:48:53.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.7.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.7.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.7.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.7.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.7.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.7.2"},{"name":"0.7.1","sha":"7b428e962fb83a13715e057c65c88873d3165df0","kind":"commit","published_at":"2015-03-01T21:29:05.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.7.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.7.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.7.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.7.1"},{"name":"0.7.0","sha":"5f5137889b2aec36f8a1009ebe8673dac45f004e","kind":"commit","published_at":"2015-02-16T23:59:27.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.7.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.7.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.7.0"},{"name":"0.6.1","sha":"ad1b89403026158529620e0f6096be0eae96817c","kind":"commit","published_at":"2015-01-25T16:08:20.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.6.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.6.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.6.1"},{"name":"0.6.0","sha":"c352207aab15706a1ca9c25e5bd30c847899a0c9","kind":"tag","published_at":"2015-01-09T19:27:44.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.6.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.6.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.6.0"},{"name":"0.5.1","sha":"356dbd781b898163994c8e094b902d74dcdafcca","kind":"commit","published_at":"2014-12-27T15:58:34.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.5.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.5.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.5.1"},{"name":"0.5.0","sha":"132babb2eb0ed51ecf2541eb3c585004cc6d4f1d","kind":"tag","published_at":"2014-12-24T22:51:43.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.5.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.5.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.5.0"},{"name":"0.4.0","sha":"f841f3fc1cd4b38a08dc51032c7d8db9fd0fd3e6","kind":"tag","published_at":"2014-12-15T18:53:41.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.4.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.4.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/releases/0.4.0"},{"name":"0.3.0","sha":"8256de6ff7b73a0633ef5bfa3f72e8964ffce1a5","kind":"tag","published_at":"2014-11-29T01:57:29.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.3.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.3.0/manifests","release_url":null},{"name":"0.2.1","sha":"9f02985aab63a8d1bfa33376191706608ee7c9fd","kind":"tag","published_at":"2014-11-10T01:30:42.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.2.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.2.1/manifests","release_url":null},{"name":"0.2.0","sha":"d143807ca5efa982229952bb7b0ae18d61a53aa6","kind":"tag","published_at":"2014-11-10T00:29:04.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.2.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.2.0/manifests","release_url":null},{"name":"0.1.2","sha":"d1b296681790a3ec8e9ccf0bf7b0014784309cd5","kind":"tag","published_at":"2014-09-28T12:54:54.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.1.2","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.1.2/manifests","release_url":null},{"name":"0.1.1","sha":"e04632ab466a88857d0071da013c1e8626bf2609","kind":"tag","published_at":"2014-09-08T18:03:15.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.1.1","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.1.1/manifests","release_url":null},{"name":"0.1.0","sha":"ccad94ba70f3eba5b803fe1652e11f8e1584788b","kind":"tag","published_at":"2014-09-08T13:43:57.000Z","download_url":"https://codeload.github.com/thephpleague/commonmark/tar.gz/0.1.0","html_url":"https://github.com/thephpleague/commonmark/releases/tag/0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/thephpleague/commonmark@0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/tags/0.1.0/manifests","release_url":null}]},"repo_metadata_updated_at":"2026-11-12T12:33:22.259Z","dependent_packages_count":477,"downloads":516006537,"downloads_period":"total","dependent_repos_count":238335,"rankings":{"downloads":0.029825423484342875,"dependent_repos_count":0.021513420218214535,"dependent_packages_count":0.08140873787119818,"stargazers_count":0.13763699525971343,"forks_count":0.33101330653934635,"docker_downloads_count":0.039848721540556464,"average":0.10687443415222864},"purl":"pkg:composer/league/commonmark","advisories":[{"uuid":"GSA_kwCzR0hTQS05N2pqLTMzZ3YtNXhmOc4AB7Nk","url":"https://github.com/advisories/GHSA-97jj-33gv-5xf9","title":"league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal","description":"## Summary\n\nThe `DisallowedRawHtml` extension does not escape a disallowed tag when the tag name is the last thing in the raw HTML. A Markdown line containing just `\u003cscript` is emitted unchanged, and the next block can supply its attributes. With the shipped GFM defaults this allows stored XSS by anyone who can post Markdown.\n\n## Details\n\n`DisallowedRawHtmlRenderer` escapes tags with this regex:\n\n```\n/\u003c(\\/?(?:title|textarea|style|xmp|iframe|noembed|noframes|script|plaintext)[\\s\\/\u003e])/i\n```\n\nThe trailing character class requires one character after the tag name. The block parser does not: `RegexHelper::PARTIAL_HTMLBLOCKOPEN` accepts end of line after a tag name, so `\u003cscript` alone opens an HTML block. Because a rendered `HtmlBlock` has no trailing newline, the regex has nothing to match and the `\u003c` passes through.\n\nIn the browser the newline is still present, so the tag name terminates there and whatever follows becomes attributes.\n\nThis is the same filter that GHSA-4v6x-c7xx-hw9f fixed in 2.8.1. That fix widened the character class but still requires one character, so this case was not covered.\n\n## Reproduction\n\nRender this with `GithubFlavoredMarkdownConverter` and default settings:\n\n```\n\u003cdiv\u003e\n\u003cscript\n\n\u003cspan src=\"/evil.js\"\u003e\n```\n\nOutput:\n\n```html\n\u003cdiv\u003e\n\u003cscript\n\u003cspan src=\"/evil.js\"\u003e\n```\n\nA browser parses that as `\u003cscript src=\"/evil.js\"\u003e` with a junk `\u003cspan` attribute, and the script runs. `\u003ciframe` with `\u003cspan onload=\"...\"\u003e` works the same way and does not need a later `\u003c/script\u003e` in the page.\n\nControl: `\u003cscript src=\"/evil.js\"\u003e\u003c/script\u003e` is correctly escaped to `\u0026lt;script src=\"/evil.js\"\u003e\u0026lt;/script\u003e`.\n\n## Affected versions\n\n1.3.0 (when the extension was added) through the current release. The `\u003c/style` and mid-line forms are only affected as continuation lines inside an already-open HTML block.\n\n## Preconditions\n\n- `html_input` is `allow` (the default)\n- The `DisallowedRawHtml` extension is active, which the GFM extension enables automatically\n- Untrusted users can post Markdown\n\nSetting `html_input` to `escape` or `strip` fully mitigates this.\n\n## Suggested fix\n\nAllow end of string after the tag name:\n\n```php\n$regex = \\sprintf('/\u003c(\\/?(?:%s))([\\s\\/\u003e]|$)/i', \\implode('|', \\array_map('preg_quote', $tags)));\n\nreturn \\preg_replace($regex, '\u0026lt;$1$2', $rendered);\n```\n\nThis escapes every bypass shape above and leaves `\u003cdiv\u003e`, `\u003cscripts\u003e` and `\u003cspan class=\"a\"\u003e` untouched. The existing unit test only covers tag names followed by another character, so a case for a bare tag name should be added.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-09-30T15:36:33.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-97jj-33gv-5xf9","https://github.com/thephpleague/commonmark/commit/411afcc2a7402756d96c89af8882c724d12d47ca","https://github.com/thephpleague/commonmark/releases/tag/2.10.2","https://github.com/advisories/GHSA-97jj-33gv-5xf9"],"source_kind":"github","identifiers":["GHSA-97jj-33gv-5xf9"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-30T16:00:09.068Z","updated_at":"2026-11-04T06:01:57.932Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05N2pqLTMzZ3YtNXhmOc4AB7Nk","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05N2pqLTMzZ3YtNXhmOc4AB7Nk","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.10.2","vulnerable_version_range":"\u003e= 1.3.0, \u003c= 2.10.1"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05N2pqLTMzZ3YtNXhmOc4AB7Nk/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zcTZ2LXI1bXItaHh2OM4AB7Nj","url":"https://github.com/advisories/GHSA-3q6v-r5mr-hxv8","title":"league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan","description":"## Summary\n\n`league/commonmark`'s GitHub Flavored Markdown Table extension registers `TableStartParser` as a block-start parser. While a paragraph is the active block, the core block parser calls `TableStartParser::tryStart()` on every non-blank line. Its first action fetches the entire growing paragraph buffer via `getParagraphContent()` and runs `strpos($paragraph, '|')` across all of it. For a paragraph of M pipe-free lines, line k rescans about k lines of buffer, so total work is 1+2+...+M, which is O(M^2). An unauthenticated user who submits a single large paragraph of pipe-free lines that do not begin with a letter (see Attack Chain) to any service that converts untrusted Markdown with `GithubFlavoredMarkdownConverter` (or any environment that enables `TableExtension`) drives seconds to tens of seconds of single-core CPU that grows quadratically with body size, enough to exhaust worker processes and deny service.\n\n## Root Cause\n\nThe GFM table detector performs a per-line \"quick check\" against the whole accumulated paragraph rather than only the portion that could form a table header. A paragraph never closes while non-blank lines keep arriving, so its buffer grows without bound, and the quick check rescans the entire buffer on each line. Only the paragraph's last line can ever be a table header (it is extracted separately via `strrpos`/`substr`), so scanning the full multi-line buffer for a pipe on every line is unnecessary work and creates quadratic time complexity. There is no input-size cap and the default nesting limit is not reached, so nothing bounds the scan.\n\n```text\nAffected function: League\\CommonMark\\Extension\\Table\\TableStartParser::tryStart\nLocation: src/Extension/Table/TableStartParser.php:35-38\n  $paragraph = $parserState-\u003egetParagraphContent();       // returns the FULL growing buffer\n  if ($paragraph === null || \\strpos($paragraph, '|') === false) {\n      return BlockStart::none();                           // strpos scans whole buffer each line\n  }\nBuffer growth: src/Reference/ReferenceParser.php:89-95 ($this-\u003eparagraph .= \"\\n\"; $this-\u003eparagraph .= $line;)\nPer-line dispatch: src/Parser/MarkdownParser.php:135-147 and :224-236\n```\n\n## Impact\n\nAn unauthenticated, remote attacker with no user interaction can cause denial of service against any application that renders untrusted Markdown with the GitHub Flavored Markdown converter or any configuration that enables the Table extension (the default GFM bundle enables it). A single request carrying a large paragraph of pipe-free, blank-line-free lines that do not begin with a letter consumes CPU proportional to the square of the input size: measured runs show roughly 4x CPU growth per input doubling. A body of a few megabytes ties up a worker for seconds to tens of seconds; repeated or concurrent requests exhaust all available PHP worker processes, denying service to legitimate users. Impact is limited to availability; there is no confidentiality or integrity impact.\n\n## Proof of Concept\n\n`Requires PHP with league/commonmark 2.x installed. The harness parses pipe-free paragraphs of increasing size with the real MarkdownParser and the real block-start parsers, comparing a GFM-plus-Table configuration against a core-only configuration to isolate the Table parser's contribution.`\n\n1. Install `league/commonmark` (2.10.1 or any 2.x release).\n2. Convert a single large paragraph of pipe-free, blank-line-free lines that do not begin with a letter, with `GithubFlavoredMarkdownConverter`.\n3. Measure wall-clock time as the paragraph size doubles.\n\n```php\n\u003c?php\nrequire 'vendor/autoload.php';\nuse League\\CommonMark\\GithubFlavoredMarkdownConverter;\n\n$converter = new GithubFlavoredMarkdownConverter();\nforeach ([25000, 50000, 100000, 200000] as $lines) {\n    $md = str_repeat(\"12345678\\n\", $lines); // one paragraph, no blank lines, no '|', lines not starting with a letter\n    $t = microtime(true);\n    $converter-\u003econvert($md);\n    printf(\"%7d lines  %6.3fs\\n\", $lines, microtime(true) - $t);\n}\n```\n\n```text\n   lines    input    letter-leading    non-letter-leading\n                     (\"aaaaaaaa\")          (\"12345678\")\n   25000   0.23MB        0.27s               0.75s\n   50000   0.45MB        0.50s               2.36s\n  100000   0.90MB        1.07s               7.70s\n  200000   1.80MB        2.26s              27.81s\n```\n\nLetter-leading input scales linearly (doubles per input doubling) because `SkipLinesStartingWithLettersParser` aborts before the Table parser is reached. Non-letter-leading input quadruples per doubling (0.75, 2.36, 7.70, 27.81), confirming O(M^2) behavior attributable to the Table start parser.\n\n## Attack Chain\n\n1. **Exposure:** The attacker submits a Markdown body to any endpoint that converts untrusted Markdown with `GithubFlavoredMarkdownConverter`, or any environment that adds `TableExtension`. The default GFM bundle registers the Table extension: `GithubFlavoredMarkdownExtension` adds `TableExtension` (src/Extension/GithubFlavoredMarkdownExtension.php:30), which registers `TableStartParser` (src/Extension/Table/TableExtension.php:56).\n2. **Control:** The attacker fully controls the Markdown body. The exploit input is one paragraph with no blank lines, no `|` character, and lines that do not begin with a letter (for example `str_repeat(\"12345678\\n\", 200000)`).\n3. **Path:** `MarkdownParser::parseLine()` loops over block-start parsers for every non-blank line while a paragraph is active (src/Parser/MarkdownParser.php:135-147). `ParagraphParser::tryContinue()` keeps the paragraph open for every non-blank line, so the buffer keeps growing (src/Parser/Block/ParagraphParser.php:46-53), appended line by line in `ReferenceParser::parse()` (src/Reference/ReferenceParser.php:89-95). Since 2.0.2, the highest-priority `SkipLinesStartingWithLettersParser` returns `BlockStart::abort()` for any line whose first non-space character is a letter, short-circuiting `findBlockStart()` before `TableStartParser`. When lines begin with a non-letter (e.g. a digit), that parser returns none and every remaining core parser returns null, so control reaches `TableStartParser` on every line (src/Parser/MarkdownParser.php:224-236).\n5. **Guard:** There is no input-size cap in `MarkdownInput`, and `max_nesting_level` defaults to `PHP_INT_MAX`, which the depth-1 paragraph never approaches. No guard bounds the whole-buffer scan.\n6. **Primitive:** `TableStartParser::tryStart()` runs `strpos($paragraph, '|')` over the entire buffer returned by `getParagraphContent()` (src/Extension/Table/TableStartParser.php:35-38). With no pipe present, `strpos` scans to the end of the buffer on every line.\n7. **Result:** Cumulative scanning work is O(M^2). A single small request drives disproportionate, quadratically growing CPU, exhausting worker processes and denying service.\n\n## Bypass Evidence\n\nNo prior fix exists for this code path, so this is not an incomplete-fix or regression case; it is a distinct, previously undisclosed quadratic path. The strongest disproof attempts were made and all failed:\n\n- Attempt: the observed quadratic is core-parser or PHP string overhead, not the Table parser. Refuted: the only difference between the two measured configurations is `TableStartParser`; the core-only baseline is linear while the isolated Table contribution quadruples per input doubling.\n- Attempt: `strpos` short-circuits or the buffer does not actually grow. Refuted by source trace: `ReferenceParser::parse()` appends every line unconditionally before its state switch, and for pipe-free text `strpos` finds no `|` and scans the full buffer each line.\n- Attempt: another parser short-circuits before `TableStartParser`. Partially correct: since 2.0.2 `SkipLinesStartingWithLettersParser` aborts block-start scanning for lines beginning with a letter, so letter-leading input (including the original `aaaaaaaa` PoC) never reaches the Table parser and runs in linear time. Input whose lines begin with a non-letter (e.g. a digit) passes every core parser and reaches `TableStartParser` on every line, exhibiting the quadratic behavior.\n- Attempt: an input-size or nesting guard neutralizes it. Refuted: there is no size cap and the default nesting limit is never reached.\n- Attempt: this duplicates an existing quadratic-DoS advisory or was already fixed. Refuted: published quadratic advisories address per-line position translation and other distinct mechanisms in other files; `git log` on `src/Extension/Table/TableStartParser.php` shows no security fix ever touched this rescan, and the code is present unchanged in the latest release.\n\n## Affected Versions\n\n- `Ecosystem: composer`\n- `Package: league/commonmark`\n- `Confirmed affected range: \u003e= 2.0.0, \u003c= 2.10.1`\n- `Latest release checked: 2.10.1 (Packagist, repo.packagist.org/p2/league/commonmark.json)`\n- `Fix status: not fixed`\n\nNote: `SkipLinesStartingWithLettersParser` was introduced in 2.0.2. On 2.0.0 and 2.0.1 the issue can also be triggered with letter-leading lines. Regardless, the underlying quadratic scan itself is present across the whole \u003e= 2.0.0, \u003c= 2.10.1 range.\n\nThe vulnerable rescan is artifact-verified present in tags 2.8.0 and 2.10.1 (the latest published release). The lower bound 2.0.0 is inferred from the 2.x block-parser rewrite that introduced the `getParagraphContent()`-based architecture this quick check depends on; the checkout contains only tags 2.8.0 through 2.10.1, so the path is not artifact-verified below 2.8.0. No published release removes or bounds the whole-buffer scan.\n\n## Suggested Fix\n\nEnforce that the per-line quick check inspects only the paragraph's last line, which is the only line that can form a table header. Compute the last line break with `strrpos($paragraph, \"\\n\")`, derive the last line, and test `strpos($lastLine, '|')` instead of scanning the whole buffer. This bounds the per-line check to the length of the last line and removes the quadratic behavior without changing table detection semantics. As an interim mitigation without a code change, operators can cap the size of untrusted Markdown accepted for conversion, or disable the Table extension for untrusted input, which reduces exposure but does not remove the underlying quadratic path.\n\nReported by zx (GitHub: @manus-pi).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-30T15:36:13.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-3q6v-r5mr-hxv8","https://github.com/thephpleague/commonmark/commit/5f63680a5e29dd57f9c6be9743b0e90493d3c2d0","https://github.com/thephpleague/commonmark/releases/tag/2.10.2","https://github.com/advisories/GHSA-3q6v-r5mr-hxv8"],"source_kind":"github","identifiers":["GHSA-3q6v-r5mr-hxv8"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-30T16:00:09.069Z","updated_at":"2026-11-04T06:01:57.933Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zcTZ2LXI1bXItaHh2OM4AB7Nj","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zcTZ2LXI1bXItaHh2OM4AB7Nj","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.10.2","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.10.1"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zcTZ2LXI1bXItaHh2OM4AB7Nj/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04cnI3LWN2cTMtZ21maM4ABnWo","url":"https://github.com/advisories/GHSA-8rr7-cvq3-gmfh","title":"league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension","description":"### Impact\n\n`AttributesExtension` ships with the library but must be explicitly registered on the `Environment`; it is not included in `CommonMarkConverter`, `GithubFlavoredMarkdownConverter`, or `GithubFlavoredMarkdownExtension`. **Applications that do not register `AttributesExtension` are not affected by this advisory.**\n\nTwo paths in the extension re-process every attribute a node has already collected each time another attribute is applied to it. When the attributes carry distinct names, the collected set grows by one on every step and is walked again in full, so a run of *n* attributes costs O(n²).\n\n**1. Attribute nodes resolving to a common target (affected from 1.5.0).**\n\n`AttributesListener::processDocument()` merges each attribute node into the set accumulated for its target, then filters the result. Both operations traverse that entire set: `AttributesHelper::mergeAttributes()` rebuilds it with `array_merge()`, and `AttributesHelper::filterAttributes()` matches a regular expression against every name in it. A run of attribute nodes sharing one target therefore re-walks a set that grows by a key per node.\n\nTwo input shapes reach this path: adjacent inline attributes at the start of a block (`{a0=\"v\"}{a1=\"v\"}…`, where quoting the values is what keeps them separate — an unquoted value swallows the `}{` that follows it), and a chain of attribute blocks held at their default target by reference definitions (`{a0=v}` / `[a]: u` / `{a1=v}` / `[a]: u` / …).\n\n256 KB of adjacent inline attributes takes 20.0 seconds to convert, against 0.09 seconds once patched.\n\n**2. Consecutive attribute-block lines (affected from 2.0.0).**\n\n`AttributesBlockContinueParser::tryContinue()` merges each continuation line into the block's accumulated attributes, again rebuilding the whole set on every line. One distinct attribute per line (`{a0=v}` / `{a1=v}` / …) grows it by a key each time.\n\n256 KB of such lines takes 1.9 seconds to convert while producing **zero bytes of output**, against 0.08 seconds once patched.\n\n**Relationship to GHSA-jjv6-8j6v-6j52.** The fix released in 2.9.1 for that advisory made the `class` attribute cheap to accumulate, but left every other attribute name on the original path. **Applications that upgraded to 2.9.1 or 2.9.2 remain exposed to this variant.**\n\n**Overall impact.** An unauthenticated attacker who can submit Markdown to an affected application can consume disproportionate CPU time with a comparatively small request, occupying PHP workers and preventing legitimate requests from completing. The impact is limited to availability: no data is disclosed, rendered output is unchanged, and no rendering restriction is bypassed.\n\n### Patches\n\nThe issue is patched in `2.10.0`. Both paths now fold each node — or each line — into the accumulated attributes at a cost proportional to that node or line alone, rather than re-merging and re-filtering everything gathered so far. Rendered output is unchanged, down to the order in which attributes appear.\n\nThe listener path affects `1.5.0` through `2.9.2`. The continuation-line path affects `2.0.0` through `2.9.2`. The 1.x release line is no longer supported, so its users must upgrade to `2.10.0` or later.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- **Do not register `AttributesExtension`** when converting untrusted Markdown. This fully removes both paths.\n- If the extension is required, **impose a strict maximum input length before conversion**. Because the cost is quadratic, the cap must be small to meaningfully bound worst-case CPU time.\n\nThe `attributes/allow` allow-list added in 2.7.0 is **not** a mitigation. A non-empty allow-list happens to bound the first path, because unlisted names are discarded before they accumulate, but it does nothing for the second: continuation lines are merged while parsing, before any filtering takes place.\n\nRestricting conversion to trusted users, applying strict execution-time limits, and rate-limiting requests reduce exposure but are not substitutes for upgrading.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-01T20:28:40.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-8rr7-cvq3-gmfh","https://github.com/thephpleague/commonmark/commit/f27eb720972490b5af4dbb635ad8634529faf9f2","https://github.com/thephpleague/commonmark/releases/tag/2.10.0","https://github.com/advisories/GHSA-8rr7-cvq3-gmfh"],"source_kind":"github","identifiers":["GHSA-8rr7-cvq3-gmfh"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-01T21:00:09.041Z","updated_at":"2026-11-04T06:02:30.099Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04cnI3LWN2cTMtZ21maM4ABnWo","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04cnI3LWN2cTMtZ21maM4ABnWo","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.10.0","vulnerable_version_range":"\u003e= 1.5.0, \u003c 2.10.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04cnI3LWN2cTMtZ21maM4ABnWo/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qanY2LThqNnYtNmo1Ms4ABnWm","url":"https://github.com/advisories/GHSA-jjv6-8j6v-6j52","title":"league/commonmark: Denial of service in the SmartPunct and Attributes extensions","description":"### Impact\n\nTwo first-party extensions contain quadratic parsing paths. Both ship with the library but must be explicitly registered on the `Environment`; neither is included in `CommonMarkConverter`, `GithubFlavoredMarkdownConverter`, or `GithubFlavoredMarkdownExtension`. **Applications that do not register `SmartPunctExtension` or `AttributesExtension` are not affected by this advisory.**\n\n**1. `SmartPunctExtension` — quote replacement recopies the whole text node (affected from 2.0.0).**\n\n`ReplaceUnpairedQuotesListener` converts each unpaired `Quote` node back to a `Text` node and merges it into its neighbours via `AdjacentTextMerger`. The merge reads the left node's literal into a local variable, appends to that variable, and writes it back — and because the read aliases the node's string, every append copies the entire accumulated literal rather than only the bytes added. The listener runs this once per surviving unpaired quote against the same continuously growing text node, so the same buffer is fully re-copied a linear number of times.\n\nA 1.2 MB document of alternating text segments and apostrophes takes 34.9 seconds to convert, against 0.069 seconds for the same input with the extension not registered.\n\nHardened configuration makes this *worse* rather than better: `QuoteParser` appends the `Quote` node to the AST before pushing it onto the delimiter stack, so `max_delimiters_per_line` removes the quote-pairing work while leaving every node the listener must process.\n\n**2. `AttributesExtension` — block-level attribute runs re-scan their siblings (affected from 1.5.0).**\n\n`AttributesListener::findTargetAndDirection()` walks the entire remaining sibling chain for every block-level `Attributes` node whose target is the following node. The backward half of that walk returns immediately for such nodes, and the forward half stops only at a sibling that is not itself an attributes node — which a contiguous run never provides — so a run of k nodes costs k(k-1)/2 steps.\n\nAn input placing each `{#a}` on its own line, with a single reference definition to keep the run contiguous, takes 28.4 seconds at 16,000 attribute blocks while producing **zero bytes of output**.\n\nThis is the block-level counterpart of GHSA-g2gp-3wwq-f4ph, patched in 2.9.0. **That fix is incomplete:** the early break it introduced is guarded on the node being an `AttributesInline`, so block-level `Attributes` nodes still re-scan. Applications that upgraded to 2.9.0 specifically to address GHSA-g2gp-3wwq-f4ph remain exposed to this variant.\n\n**3. `AttributesExtension` — class lists are rebuilt on every merge (affected from 1.5.0).**\n\n`AttributesHelper::mergeAttributes()` round-trips the accumulated class list through `explode` and `implode` on each merge. An `#id` attribute assigns a scalar and skips the branch entirely, but a `.class` attribute appends to an array which is then imploded to a string, written to the target node, and read back on the next iteration — so the *i*th merge pays a cost proportional to *i* three separate times.\n\n`{.c}` repeated 32,000 times takes 33.5 seconds, against 0.26 seconds for byte-identical input using `{#a}` — a 130x gap that widens with input size. Both the inline and the block-level attribute paths are affected.\n\n**Overall impact.** An unauthenticated attacker who can submit Markdown to an affected application can consume disproportionate CPU time with a comparatively small request, occupying PHP workers and preventing legitimate requests from completing. The impact is limited to availability: no data is disclosed, rendered output is unchanged, and no rendering restriction is bypassed.\n\nNo library-level configuration gates any of these paths. For the Attributes extension in particular, neither the `attributes/allow` allow-list nor the `on*` event-handler hardening added in 2.7.0 has any effect, because the expensive work happens while parsing and resolving the AST, before any attribute filtering or rendering takes place.\n\n### Patches\n\nThe issues are patched in `2.9.1` and later:\n\n- Adjacent text merging now appends in place instead of reading, modifying, and writing back the whole literal, so a merge costs only the bytes added. This fixes the defect for every caller, not only the SmartPunct listener.\n- `AttributesListener` now records the runs it has already walked, so each contiguous run of block-level attribute nodes is scanned once rather than once per node.\n- Accumulated class lists no longer pass through `mergeAttributes()` repeatedly; the listener holds pending attributes and joins them in a single pass.\n\nThe SmartPunct path affects `2.0.0` through `2.9.0`. The Attributes paths affect `1.5.0` through `2.9.0`, including releases that already contain the 2.9.0 fix for GHSA-g2gp-3wwq-f4ph. The 1.x release line is no longer supported, so its users must upgrade to `2.9.1` or later.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- **Do not register `SmartPunctExtension` or `AttributesExtension`** when converting untrusted Markdown. This fully removes the affected paths.\n- If either extension is required, **impose a strict maximum input length before conversion**. Because the cost is quadratic, even a modest cap must be small to meaningfully bound worst-case CPU time.\n\nRestricting conversion to trusted users, applying strict execution-time limits, and rate-limiting requests reduce exposure but are not substitutes for upgrading. Configuration options including `attributes/allow`, `max_delimiters_per_line`, `max_nesting_level`, `html_input`, and `allow_unsafe_links` do not mitigate these issues.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-01T20:21:45.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-jjv6-8j6v-6j52","https://github.com/thephpleague/commonmark/commit/04a5d11ef6bf2d0b927310810d6a2a85d3c184b9","https://github.com/thephpleague/commonmark/commit/2f611b599c51661b005dc45c16ceaa547546e687","https://github.com/thephpleague/commonmark/releases/tag/2.9.1","https://github.com/advisories/GHSA-jjv6-8j6v-6j52"],"source_kind":"github","identifiers":["GHSA-jjv6-8j6v-6j52"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-01T21:00:09.041Z","updated_at":"2026-11-04T06:02:30.101Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qanY2LThqNnYtNmo1Ms4ABnWm","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qanY2LThqNnYtNmo1Ms4ABnWm","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.9.1","vulnerable_version_range":"\u003e= 1.5.0, \u003c 2.9.1"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qanY2LThqNnYtNmo1Ms4ABnWm/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1mOGZnLXBnNTctdjRqOM4ABnWk","url":"https://github.com/advisories/GHSA-f8fg-pg57-v4j8","title":"league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed","description":"### Summary\n\nThe `AttributesExtension` documents a security guarantee:\n\n\u003e **Note:** Attributes starting with `on` (e.g. `onclick` or `onerror`) are capable of executing\n\u003e JavaScript code and are therefore **never allowed by default**. You must explicitly add them to\n\u003e the `allow` list if you want to use them.\n\u003e\n\u003e — `docs/2.x/extensions/attributes.md`\n\nPrefixing the attribute name with a single U+000C FORM FEED byte defeats that guarantee.\n`{\u003cFF\u003eonclick=\"alert(1)\"}` passes through `AttributesHelper::filterAttributes()` untouched and is\nwritten verbatim into the output, where browsers parse it as a genuine `onclick` handler.\n\nThe same prefix defeats the `allow_unsafe_links` check, letting a `javascript:` URI through on\n`href` / `src` even when `allow_unsafe_links` is `false`.\n\nThis bypasses the fix shipped in the **2.7.0 security release** (\"Fix XSS in AttributesExtension\",\n43207253ea5f14867c77c697cd3838c446cadcea), which added `filterAttributes()` for the express\npurpose of blocking these attributes.\n\nThroughout this report `\u003cFF\u003e` denotes a literal U+000C byte (`\"\\x0C\"` in PHP). It is invisible in\nrendered text, so all payloads below are written with PHP escape sequences to stay unambiguous.\n\n### Details\n\nThree behaviours combine.\n\n**1. `\\x0C` survives the parser's `trim()`.**\n\n`AttributesHelper::SINGLE_ATTRIBUTE` begins with `\\s*`, and `Cursor::match()` returns\n`$matches[0][0]` — the *entire* match, including that leading whitespace. The result is cleaned\nwith PHP's `trim()`:\n\n```php\n// src/Extension/Attributes/Util/AttributesHelper.php:62\nwhile ($attribute = \\trim((string) $attributeCursor-\u003ematch('/^' . self::SINGLE_ATTRIBUTE . '/i'))) {\n```\n\nPCRE `\\s` matches `\\x0C`, but PHP's default `trim()` charlist is `\" \\t\\n\\r\\0\\x0B\"` — it includes\nthe vertical tab `\\x0B` but **not** the form feed `\\x0C`. The byte is therefore consumed by the\nregex, retained in the returned match, and not stripped. It ends up inside the attribute name:\n\n```php\n// src/Extension/Attributes/Util/AttributesHelper.php:94\n$attributes[\\trim($name)] = \\trim($value);   // $name === \"\\x0Conclick\"\n```\n\n`\\x0C` is the only byte with this property: every other character the HTML5 tokenizer treats as\nwhitespace (`\\x09`, `\\x0A`, `\\x0D`, `\\x20`), plus `\\x0B`, is in PHP's trim charlist. The PoC\nincludes a `\\x0B` case as a control, and it is correctly stripped.\n\n**2. The filter's string comparisons miss it.**\n\n`filterAttributes()` compares the raw name against literal strings:\n\n```php\n// src/Extension/Attributes/Util/AttributesHelper.php:148-166\n$attrNameLower = \\strtolower($name);                            // \"\\x0conclick\"\n... ($attrNameLower === 'href' || $attrNameLower === 'src') ... // false\n... \\str_starts_with($attrNameLower, 'on') ...                  // false -\u003e not removed\n```\n\n**3. The renderer never escapes attribute names.**\n\n```php\n// src/Util/HtmlElement.php:123-129\n$result .= ' ' . $key . '=\"' . Xml::escape($value) . '\"';   // $key emitted raw\n```\n\nBecause the HTML5 tokenizer treats `\\x0C` as whitespace *between* attributes, the browser reads\nthe name as plain `onclick`.\n\n### PoC\n\n```php\n\u003c?php\nrequire 'vendor/autoload.php';\n\nuse League\\CommonMark\\Environment\\Environment;\nuse League\\CommonMark\\Extension\\Attributes\\AttributesExtension;\nuse League\\CommonMark\\Extension\\CommonMark\\CommonMarkCoreExtension;\nuse League\\CommonMark\\MarkdownConverter;\n\n// The most defensive configuration docs/2.x/security.md recommends.\n$env = new Environment([\n    'html_input'         =\u003e 'escape',\n    'allow_unsafe_links' =\u003e false,\n    'max_nesting_level'  =\u003e 100,\n    // 'attributes' =\u003e ['allow' =\u003e [...]] deliberately left at its default []\n]);\n$env-\u003eaddExtension(new CommonMarkCoreExtension());\n$env-\u003eaddExtension(new AttributesExtension());\n$converter = new MarkdownConverter($env);\n\n$FF = \"\\x0C\";\n\necho $converter-\u003econvert('hello {onclick=\"alert(1)\"}')-\u003egetContent();\n// \u003cp\u003ehello\u003c/p\u003e                                    \u003c- filtered, as documented\n\necho $converter-\u003econvert('hello {' . $FF . 'onclick=\"alert(1)\"}')-\u003egetContent();\n// \u003cp \\x0Conclick=\"alert(1)\"\u003ehello\u003c/p\u003e             \u003c- BYPASS\n```\n\nFull observed output (`\\x0C` shown escaped; it is a literal single byte in the real output):\n\n| # | Markdown input | Rendered output | Result |\n|---|---|---|---|\n| A | `hello {onclick=\"alert(1)\"}` | `\u003cp\u003ehello\u003c/p\u003e` | filtered (control) |\n| B | `hello {\\x0Conclick=\"alert(1)\"}` | `\u003cp \\x0Conclick=\"alert(1)\"\u003ehello\u003c/p\u003e` | **bypass** |\n| C | `hello {\\x0Bonclick=\"alert(1)\"}` | `\u003cp\u003ehello\u003c/p\u003e` | filtered (control) |\n| D | `[click](javascript:alert(1))` | `\u003cp\u003e\u003ca\u003eclick\u003c/a\u003e\u003c/p\u003e` | filtered (control) |\n| E | `[click](https://example.com){\\x0Chref=\"javascript:alert(1)\"}` | `\u003cp\u003e\u003ca \\x0Chref=\"javascript:alert(1)\" href=\"https://example.com\"\u003eclick\u003c/a\u003e\u003c/p\u003e` | **bypass** |\n| F | `![x](https://example.invalid/x.png){\\x0Conerror=\"alert(1)\"}` | `\u003cp\u003e\u003cimg \\x0Conerror=\"alert(1)\" src=\"…\" alt=\"x\" /\u003e\u003c/p\u003e` | **bypass** |\n| G | `# heading` + newline + `{\\x0Conclick=\"alert(1)\"}` | `\u003ch1 \\x0Conclick=\"alert(1)\"\u003eheading\u003c/h1\u003e` | **bypass** (block syntax) |\n\nIn case E the injected `href` precedes the legitimate one. Per the HTML5 duplicate-attribute rule\nthe **first** occurrence wins, so the `javascript:` URI is the one the browser actually uses.\n\n**Browser confirmation.** Loading the library's unmodified output in Chrome for Testing 148:\n\n```\n\u003cimg\u003e attribute names : [\"onerror\",\"src\",\"alt\"]      \u003c- parsed as a real `onerror`\ntypeof img.onerror    : function                     \u003c- bound as an event handler\nhandlers fired        : [\"img-onerror\"]              \u003c- fired on load, no interaction\ndocument.title        : XSS-FIRED\nlink href attribute   : \"javascript:void(0)\"\nlink href property    : \"javascript:void(0)\"         \u003c- javascript: URI is the effective href\npage errors           : []\n```\n\nThe `onerror` case executes with **no user interaction** — rendering the attacker's Markdown is\nsufficient.\n\nVerified against git HEAD (`f966b17a`) and against tag `2.9.0`, on PHP 8.5.8.\n\n### Impact\n\nStored cross-site scripting in any application that renders untrusted Markdown with\n`AttributesExtension` enabled and `attributes.allow` left at its default `[]` — even when the\napplication has followed every hardening step in `docs/2.x/security.md`\n(`html_input =\u003e 'escape'`, `allow_unsafe_links =\u003e false`, `max_nesting_level =\u003e 100`).\n\nConsequences are the usual for stored XSS: session and cookie theft, actions performed as the\nviewing user, and account takeover where the host application permits it. Because the payload can\nbe attached to an image (`onerror`), it fires on page load without requiring the victim to\ninteract with anything.\n\nThe affected configuration is the extension's default: `attributes.allow` defaults to `[]`, and\nthe documentation describes that default as safe with respect to `on*` attributes.\n\n### Workaround for users\n\nSetting an explicit allow list takes the other branch of `filterAttributes()`, which drops the\nform-feed name because it is not in the list:\n\n```php\n$config = ['attributes' =\u003e ['allow' =\u003e ['id', 'class', 'align']]];\n```\n\nVerified: `hello {\\x0Conclick=\"alert(1)\"}` then renders as `\u003cp\u003ehello\u003c/p\u003e`.\n\n### Suggested fix\n\nThe narrow fix is to add `\\x0C` to the trim charlist at `AttributesHelper.php` lines 62, 89, 90\nand 94. That closes this instance but leaves the shape of the problem in place.\n\nA more durable fix is to reject anything that is not a well-formed attribute name in\n`filterAttributes()`, reusing the constant the parser already defines (`RegexHelper` is already\nimported in that file):\n\n```php\nforeach ($attributes as $name =\u003e $value) {\n    // Names are compared against literal strings below and emitted without escaping,\n    // so anything that isn't a plain attribute name must not get through.\n    if (\\preg_match('/^' . RegexHelper::PARTIAL_ATTRIBUTENAME . '$/i', $name) !== 1) {\n        unset($attributes[$name]);\n        continue;\n    }\n\n    $attrNameLower = \\strtolower($name);\n    // ... existing logic unchanged\n}\n```\n\nAs defence in depth, `HtmlElement::__toString()` could validate or escape `$key`. It currently\ntrusts its callers to supply safe attribute names, and `filterAttributes()` is the only thing\nstanding between that method and user-supplied input.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-01T20:18:29.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.2,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-f8fg-pg57-v4j8","https://github.com/thephpleague/commonmark/commit/dfcdf4554c16aa37c15e3a5ee3243ee26147c239","https://github.com/thephpleague/commonmark/releases/tag/2.9.1","https://github.com/advisories/GHSA-f8fg-pg57-v4j8"],"source_kind":"github","identifiers":["GHSA-f8fg-pg57-v4j8"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-01T21:00:09.041Z","updated_at":"2026-11-04T06:02:30.103Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mOGZnLXBnNTctdjRqOM4ABnWk","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1mOGZnLXBnNTctdjRqOM4ABnWk","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.9.1","vulnerable_version_range":"\u003e= 2.7.0, \u003c 2.9.1"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mOGZnLXBnNTctdjRqOM4ABnWk/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qOHBtLWdqNGMtcnE0eM4ABnWl","url":"https://github.com/advisories/GHSA-j8pm-gj4c-rq4x","title":"league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters","description":"### Impact\n\nAffected versions of `league/commonmark` perform super-linear work on three independent parsing paths, all of which are reachable on a stock `new CommonMarkConverter()` with default configuration and no extensions registered. Each trigger fits on a single line of input, so no complex Markdown structure is required.\n\nThe three paths were introduced at different times. This advisory's version range is their union; the individual ranges are:\n\n| Path | Affected from | Affected through |\n|---|---|---|\n| 1. Fenced code block detection | `0.6.0` | `2.9.0` |\n| 2. Reference link label lookup | `0.6.0` | `2.9.0` |\n| 3. Emphasis / strikethrough delimiters (`*`, `_`, `~`) | `2.6.0` | `2.9.0` |\n| 3. Highlight delimiters (`=`) | `2.9.0` | `2.9.0` |\n\n**1. Fenced code block detection — quadratic, affected from 0.6.0.**\n\n`FencedCodeStartParser` matches the following pattern:\n\n```\n/^[ \\t]*(?:`{3,}(?!.*`)|~{3,})/\n```\n\nThe lookahead enforces the CommonMark rule that a backtick fence's info string may not itself contain a backtick, but neither the lookahead nor the backtick run it guards is atomic or possessive. On a line consisting of a long backtick run, filler text, and a single trailing backtick, the quantifier gives back one character at a time and re-runs the lookahead across the remainder of the line on every candidate fence length.\n\nA 320 KB single line takes roughly 27 seconds to convert. The identical payload with one `x` character prefixed — which fails the parser's own leading-character guard — takes 0.011 seconds. `preg_last_error()` returns `0` at every input size tested, including runs of 160,000 characters, so PCRE never reaches `pcre.backtrack_limit` and this is sustained CPU consumption rather than an early bail-out.\n\n**2. Reference link label lookup — effectively quadratic, affected from 0.6.0.**\n\nWhen a shortcut or collapsed reference link is attempted, `CloseBracketParser::tryParseReference()` copies the entire span between the brackets and passes it to `ReferenceMap::get()`, which normalizes the label — up to four full passes over its length (`trim`, `preg_replace`, `mb_check_encoding`, and `strtolower`, or `mb_convert_case` on the non-ASCII path). Nested brackets produce one such lookup per closing bracket, each on a span two characters longer than the last.\n\nIn 2.x the normalization sits behind an early return for an empty reference map, so a single 8-byte reference definition anywhere in the document (`[x]: y`) is enough to unlock the path. At n = 64,000 nested brackets the same input takes 22.0 seconds with that line present versus 0.59 seconds without it. A single non-ASCII character inside the brackets forces the `mb_convert_case` branch, costing roughly 2.5x more again.\n\n**3. Emphasis, strikethrough, and highlight delimiter processing — super-linear, affected from 2.6.0.**\n\n`DelimiterStack::processDelimiters()` remains linear only because of the `openersBottom` memo, which bounds the backward opener scan — an argument that holds only if the memo's key space is O(1). `EmphasisDelimiterProcessor::getCacheKey()`, and the equivalents in `StrikethroughDelimiterProcessor` and `MarkDelimiterProcessor`, embed the closer's raw current run length in the key, leaving that space unbounded. An attacker spends O(n) bytes minting a growing number of distinct run lengths; each distinct length is a fresh key whose recorded bound starts at zero, forcing a full backward re-scan of the entire pile of openers.\n\nThe resulting work grows as roughly n^1.5. This is sub-quadratic, but the amplification over linear growth itself scales with input size, so it worsens as inputs grow: 800 KB of ordinary asterisks, letters, and spaces costs roughly 27 seconds on a stock converter.\n\nThis path is a regression introduced in **2.6.0**. Before that release the cache key was the bare delimiter character — a bounded key space that amortized correctly. `*` and `_` are affected on any default configuration from 2.6.0 onward. `~` (`StrikethroughExtension`, included in `GithubFlavoredMarkdownConverter` and `GithubFlavoredMarkdownExtension`) is affected from 2.6.0. `=` (`HighlightExtension`) is affected only from **2.9.0**, when `MarkDelimiterProcessor` was declared cacheable.\n\n**Overall impact.** An unauthenticated attacker who can submit Markdown for conversion can use a comparatively small request to consume disproportionate CPU time. Repeated or concurrent requests can occupy all available PHP workers and prevent legitimate requests from completing. The impact is limited to availability: no data is disclosed, rendered output is unchanged, and no rendering restriction is bypassed. Applications that process only trusted Markdown are not remotely exploitable.\n\nSettings such as `html_input`, `allow_unsafe_links`, and `max_nesting_level` do not mitigate any of these, because the expensive work occurs during parsing, before rendering. `max_delimiters_per_line` bounds the third path only, and does so lossily — it silently discards emphasis once the cap is exhausted.\n\n### Patches\n\nThe issues are patched in `2.9.1` and later:\n\n- The fenced code block quantifier is now possessive, which is behavior-identical here: any character given back moves a backtick into the lookahead's scan range, so every retry was guaranteed to fail regardless.\n- Reference link *lookups* now apply the CommonMark 999-character link label limit before copying and normalizing the label, matching the limit already enforced when parsing reference *definitions*. Because a definition can never exceed that length, an over-length lookup label cannot match one directly. One edge case does change: a label longer than 999 characters that *collapses* to a shorter match once whitespace is normalized — for example `[a` followed by 998 spaces and `b]` against a `[a b]: /url` definition — previously rendered as a link and now renders literally. This follows cmark, which applies its own label-length cap before normalizing (`cmark_reference_lookup()`), and matches how this library has always handled the equivalent `[text][label]` form via `LinkParserHelper::parseLinkLabel()`. commonmark.js normalizes first and still resolves such labels.\n- Delimiter processor cache keys now clamp the run length to the coarsest bucket that can change behavior — `min(length, 2)` for emphasis, `min(length, 3)` for strikethrough and highlight — restoring a bounded key space while preserving byte-identical output.\n\nVersions from `0.6.0` through `2.9.0` are affected by at least one of these paths; see the table above for which paths apply to which releases. The 0.x and 1.x release lines are no longer supported, so their users must upgrade to `2.9.1` or later.\n\n### Workarounds\n\nIf you cannot upgrade immediately, enforce a **maximum length for individual lines** before passing input to the converter, in addition to a total request-size limit. A per-line limit matters because every trigger described above fits within a single line. Because the cost grows super-linearly, the cap must be genuinely small to bound worst-case CPU.\n\nSetting `max_delimiters_per_line` reduces exposure to the delimiter path only, and does so by silently dropping emphasis from the rendered output. It has no effect on the fenced code or reference link paths.\n\nRestricting conversion to trusted users, applying strict execution-time limits, rate-limiting requests, and limiting concurrent conversions all reduce exposure, but none is a complete substitute for upgrading.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-01T20:17:59.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-j8pm-gj4c-rq4x","https://github.com/thephpleague/commonmark/commit/0768217751fbfaeb8d76762f6944e9af7114295e","https://github.com/thephpleague/commonmark/commit/d9375fadc308a63a02950a68d822417a6e4c33b2","https://github.com/thephpleague/commonmark/commit/e0036ef031fd36ec1c3c82db8743fc928b5271c8","https://github.com/thephpleague/commonmark/releases/tag/2.9.1","https://github.com/advisories/GHSA-j8pm-gj4c-rq4x"],"source_kind":"github","identifiers":["GHSA-j8pm-gj4c-rq4x"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-01T21:00:09.041Z","updated_at":"2026-11-04T06:02:30.102Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qOHBtLWdqNGMtcnE0eM4ABnWl","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qOHBtLWdqNGMtcnE0eM4ABnWl","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.9.1","vulnerable_version_range":"\u003e= 0.6.0, \u003c 2.9.1"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qOHBtLWdqNGMtcnE0eM4ABnWl/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tajYzLW0zcmMtOHBwcs4ABhoY","url":"https://github.com/advisories/GHSA-mj63-m3rc-8ppr","title":"league/commonmark: Denial of service via deeply nested XML output","description":"### Impact\n\n`XmlRenderer` pretty-prints XML by emitting depth-proportional indentation whitespace for **every** opening and closing tag. For a tree of depth n, the indentation alone sums to **O(n²)** bytes of output (and corresponding memory), reachable through `MarkdownToXmlConverter` — e.g. `str_repeat('\u003e ', $depth) . \"x\\n\"`, a single line of nested blockquotes — or through a direct `XmlRenderer::renderDocument()` call on an attacker-influenced AST.\n\nThis affects applications that convert untrusted Markdown to XML, which is an **opt-in** output path. The parser's `max_nesting_level` bounds the depth of *parser-created* trees, but its default is high enough to reach damaging sizes, can be raised by the host application, and does not constrain custom or programmatically built ASTs handed straight to the renderer. The result is a memory / output-size amplification rather than a hard crash, which is why this issue is rated **Medium** rather than High. No confidentiality or integrity impact. XML rendering was introduced in 2.0.0 (first shipped in 2.0.0-beta1, June 2021) and has emitted depth-proportional indentation ever since, so all 2.x releases are affected (verified against 2.8.x, clean upstream `1902f60f`). 1.x has no XML renderer and is not affected.\n\n### Workarounds\n\nApplications converting untrusted Markdown to XML should:\n\n- **Lower `max_nesting_level`** to a conservative value appropriate to expected content, so the parser refuses to build extremely deep trees. This is the most direct lever for parser-produced ASTs, but does not protect trees built programmatically and passed straight to `XmlRenderer`.\n- **Cap input size before conversion**, since the amplification is driven by input-proportional depth.\n- **Constrain XML consumers** with memory / output-size limits (and streaming or size caps on any downstream XML parser or storage) so one request cannot allocate unbounded output.\n- **Prefer HTML rendering** for untrusted content where XML is not strictly required — the HTML renderer does not emit depth-proportional indentation and is not subject to this amplification.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-08-06T20:42:54.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-mj63-m3rc-8ppr","https://github.com/thephpleague/commonmark/commit/b5ac8c3947ca81844e85a09c7e0a5b4148bde2e1","https://github.com/thephpleague/commonmark/releases/tag/2.9.0","https://github.com/advisories/GHSA-mj63-m3rc-8ppr"],"source_kind":"github","identifiers":["GHSA-mj63-m3rc-8ppr"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-08-06T21:00:08.648Z","updated_at":"2026-11-04T06:02:54.427Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tajYzLW0zcmMtOHBwcs4ABhoY","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tajYzLW0zcmMtOHBwcs4ABhoY","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.9.0","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.9.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tajYzLW0zcmMtOHBwcs4ABhoY/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1taDI1LXg1aHEtd3JxcM4ABhoX","url":"https://github.com/advisories/GHSA-mh25-x5hq-wrqp","title":"league/commonmark: Denial of service via colliding heading slugs","description":"### Impact\n\n`UniqueSlugNormalizer::normalize()` makes each slug document-unique by searching for an unused numeric suffix, but **restarts that search from `1` on every collision**. The k-th heading that collapses to the same base slug performs k−1 array lookups, so K colliding slugs cost Σ(k−1) = **O(K²)**. An attacker can force every heading onto a single base slug trivially — many empty ATX headings, identical heading text, or punctuation-only headings that normalize to the empty string.\n\nThe path is reached whenever the shared slug normalizer runs over attacker-controlled text. That happens when `HeadingPermalinkExtension` is registered (its `HeadingPermalinkProcessor` normalizes every heading), independently through `FootnoteExtension` (its `AnonymousFootnoteRefParser` normalizes every `^[label]` reference), and on any `TableOfContentsExtension` site (which requires `HeadingPermalinkExtension` to be co-registered). The default `slug_normalizer/unique` setting (`UniqueSlugNormalizerInterface::PER_DOCUMENT`) accumulates collisions across the whole document. No authentication is required — a small document body turns into seconds of CPU and denies service. Availability impact only. **`UniqueSlugNormalizer` was introduced in 2.0.0 (first shipped in 2.0.0-beta1, May 2021); the 1.x heading-permalink slug generator performed no de-duplication and is not affected. All 2.x releases (including 2.8.x) are affected.**\n\n### Workarounds\n\nIntegrators who cannot upgrade immediately can:\n\n- **Set `slug_normalizer/unique` to `false` / `UniqueSlugNormalizerInterface::DISABLED`**, which stops the de-duplication scan entirely — at the cost of losing id uniqueness (colliding headings then share an anchor).\n- **Disable `HeadingPermalinkExtension`** (and `TableOfContentsExtension`, which depends on it), and `FootnoteExtension` where anonymous footnotes reach the same normalizer, for untrusted Markdown.\n- **Cap the accepted document size / heading count upstream** so K cannot reach the quadratic danger zone.\n\nEach of these trades off functionality or correctness; upgrading to the patched release (which removes the quadratic behavior while keeping unique ids and identical output) is the recommended remediation.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-08-06T20:41:45.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-mh25-x5hq-wrqp","https://github.com/thephpleague/commonmark/releases/tag/2.9.0","https://github.com/advisories/GHSA-mh25-x5hq-wrqp"],"source_kind":"github","identifiers":["GHSA-mh25-x5hq-wrqp"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-08-06T21:00:08.649Z","updated_at":"2026-11-04T06:02:54.428Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1taDI1LXg1aHEtd3JxcM4ABhoX","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1taDI1LXg1aHEtd3JxcM4ABhoX","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.9.0","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.9.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1taDI1LXg1aHEtd3JxcM4ABhoX/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qZm0zLTk1anEtcTNyZs4ABhoW","url":"https://github.com/advisories/GHSA-jfm3-95jq-q3rf","title":"league/commonmark:  Denial of service via duplicate footnote definitions","description":"### Impact\n\nThe Footnote extension records one backref per footnote *reference* and then appends the **entire** backref list for **every** footnote *definition* block in the document, without ever de-duplicating or removing repeated definitions of the same label (`GatherFootnotesListener`, populated by `NumberFootnotesListener`). A document that references a single label N times and also supplies N duplicate `[^a]:` definitions of that label therefore produces **N × N** `FootnoteBackref` nodes, so output size, parse time, and peak memory are all **O(N²)**.\n\nReaching the vulnerable path requires `FootnoteExtension` to be registered on the `Environment`. This is opt-in, but is a commonly enabled GFM-style feature; no other non-default configuration is required. An unauthenticated attacker can expand a **~10 KB** request into a **~62 MB** HTML response, **~3 s** of CPU, and **~440 MB** of peak memory — enough to OOM-kill a default 128 MB PHP worker and deny service. Availability impact only; no confidentiality or integrity effect. **The Footnote extension was introduced in 1.5.0 (May 2020) with this backref logic present from the first commit, so all releases from 1.5.0 onward (including every 2.x through 2.8.x) are affected.**\n\n### Workarounds\n\nThere is no library-level option to cap the number of footnotes, references, or definitions, so no configuration switch prevents the amplification. Integrators who cannot upgrade should:\n\n- **Disable the Footnote extension** for untrusted input, or\n- **Enforce a strict input-size limit before conversion** — but note this is a weak control here, since the ~10 KB payload that already triggers the 62 MB / ~440 MB blowup is well within typical request-body limits, so any cap must be aggressively small to help.\n\nUpgrading to the patched release is the recommended remediation.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-08-06T20:40:53.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-jfm3-95jq-q3rf","https://github.com/thephpleague/commonmark/commit/66028124a17ba193da7b11cc3dfda92df21bfbf4","https://github.com/thephpleague/commonmark/releases/tag/2.9.0","https://github.com/advisories/GHSA-jfm3-95jq-q3rf"],"source_kind":"github","identifiers":["GHSA-jfm3-95jq-q3rf"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-08-06T21:00:08.648Z","updated_at":"2026-11-04T06:02:54.428Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qZm0zLTk1anEtcTNyZs4ABhoW","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qZm0zLTk1anEtcTNyZs4ABhoW","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.9.0","vulnerable_version_range":"\u003e= 1.5.0, \u003c 2.9.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qZm0zLTk1anEtcTNyZs4ABhoW/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nMmdwLTN3d3EtZjRwaM4ABhoV","url":"https://github.com/advisories/GHSA-g2gp-3wwq-f4ph","title":"league/commonmark: Denial of service via adjacent inline attribute blocks","description":"### Impact\n\nWith the Attributes extension enabled, `AttributesListener::findTargetAndDirection()` resolves each attribute node's target by walking outward through its siblings. For a run of N adjacent inline attribute blocks placed at the start of a block (with nothing to their left), each node scans the **entire** sibling list to the far-right end before giving up and falling back to the parent. Each resolution is therefore Θ(N) and the whole run is **Θ(N²)**.\n\nReaching the path requires `AttributesExtension` (opt-in, but first-party: `League\\CommonMark\\Extension\\Attributes\\AttributesExtension`). No other configuration matters — the quadratic walk runs unconditionally during parsing and is **not** gated by the `attributes/allow` allow-list, the `on*` hardening added in 2.7.0, or `allow_unsafe_links`. An unauthenticated attacker can submit a **~32 KB** input (`{#a}` repeated 8,000 times) that takes **over 5 seconds** to convert, with time growing quadratically in input length — a cheap denial of service. Availability impact only. **The Attributes extension was introduced in 1.5.0 (May 2020) with this outward-walk resolver present from the first commit, so all releases from 1.5.0 onward (including every 2.x) are affected.**\n\n### Workarounds\n\nThere is no library-level configuration that gates the quadratic walk. Integrators who cannot upgrade can only reduce exposure indirectly:\n\n- **Disable the Attributes extension** for untrusted input, or\n- **Impose a strict maximum input length before conversion** — noting that because the cost is quadratic, even a modest cap must be small to meaningfully bound worst-case CPU.\n\nUpgrading to a release containing the fix is recommended.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-08-06T20:39:52.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-g2gp-3wwq-f4ph","https://github.com/thephpleague/commonmark/commit/2d4c0fafa62501be919262064cffa6d71687430b","https://github.com/thephpleague/commonmark/releases/tag/2.9.0","https://github.com/advisories/GHSA-g2gp-3wwq-f4ph"],"source_kind":"github","identifiers":["GHSA-g2gp-3wwq-f4ph"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-08-06T21:00:08.649Z","updated_at":"2026-11-04T06:02:54.428Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nMmdwLTN3d3EtZjRwaM4ABhoV","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nMmdwLTN3d3EtZjRwaM4ABhoV","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.9.0","vulnerable_version_range":"\u003e= 1.5.0, \u003c 2.9.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nMmdwLTN3d3EtZjRwaM4ABhoV/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0ycTRwLWc3aHYtNXJnds4ABhoU","url":"https://github.com/advisories/GHSA-2q4p-g7hv-5rgv","title":"league/commonmark: Quadratic-time denial of service when parsing crafted Markdown","description":"### Impact\n\nAffected versions of `league/commonmark` can have quadratic time complexity when parsing specially crafted Markdown lines. In practical terms, doubling the length of an affected line can make the parser perform roughly four times as much work. The parser identifies locations using character positions, but regular-expression matches report byte positions. These positions differ when a UTF-8 character uses more than one byte. Several parsing paths repeatedly rescan growing portions of the line to translate between the two positions. The Autolink extension can also copy and validate the remaining line at every URL-like prefix.\n\nIn current 2.x releases, a single non-ASCII character anywhere on a line can place that whole line on the slower multibyte path. An attacker can combine it with a long run of leading whitespace or repeated Markdown punctuation, causing increasingly large rescans. When the Autolink extension is enabled, repeated URL-like prefixes provide another trigger, even on ASCII-only lines. Each trigger fits within one long line, so complex Markdown structure is unnecessary.\n\nAn attacker who can submit Markdown for conversion can use a comparatively small request to consume disproportionate CPU time and allocation activity. Repeated or concurrent requests can occupy all available PHP workers and prevent legitimate requests from completing. The core paths affect `CommonMarkConverter`, `GithubFlavoredMarkdownConverter`, and custom environments. The autolink-specific path affects applications using `AutolinkExtension` or `GithubFlavoredMarkdownExtension`. Applications that process only trusted Markdown are not remotely exploitable. The impact is limited to availability: it does not disclose data, change rendered output, or bypass rendering restrictions. Settings such as `html_input` and `allow_unsafe_links` do not mitigate the issue because the expensive work occurs before rendering.\n\n### Patches\n\nThe issue is patched in `2.9.0` and later. Starting in that release, the parser records UTF-8 character-to-byte positions incrementally, converts ordered regular-expression match positions without restarting from the beginning of the line, and matches autolinks against the original line instead of copying every remaining suffix. The affected work then grows in direct proportion to the input size while preserving existing Markdown output and configuration behavior. Versions from `0.6.0` through `2.8.3` are affected. The 0.x and 1.x release lines are no longer supported, so their users must upgrade to `2.9.0` or later.\n\n### Workarounds\n\nIf you cannot upgrade immediately, reject or truncate inputs with excessively long individual lines before passing them to the converter. A total request-size limit is also useful, but a per-line limit is important because every demonstrated trigger fits on one line. Choose limits appropriate for the application and enforce them before Markdown parsing begins. Restricting conversion to trusted users, applying strict execution-time limits, rate-limiting requests, and limiting concurrent conversions can further reduce exposure, but these measures are not complete substitutes for upgrading.\n\nDisabling `AutolinkExtension` and avoiding `GithubFlavoredMarkdownExtension` removes the autolink-specific trigger, but the core multibyte parsing paths remain reachable in the standard parser. Existing nesting, delimiter, raw-HTML, and unsafe-link configuration options do not eliminate all affected paths. Applications that must continue processing untrusted Markdown should therefore enforce input limits even when autolinking is disabled.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-08-06T20:37:20.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-2q4p-g7hv-5rgv","https://github.com/thephpleague/commonmark/commit/a6ef6cdc308dfa39a34239c35818e75892a0e6a8","https://github.com/thephpleague/commonmark/commit/a70979ea0d7d3377bd7127536748454a922bf5eb","https://github.com/thephpleague/commonmark/commit/c97b02e5e652b992033b93ba5d6182f706343fc6","https://github.com/thephpleague/commonmark/releases/tag/2.9.0","https://github.com/advisories/GHSA-2q4p-g7hv-5rgv"],"source_kind":"github","identifiers":["GHSA-2q4p-g7hv-5rgv","CVE-2026-71488"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-08-06T21:00:08.649Z","updated_at":"2026-11-11T06:03:34.551Z","epss_percentage":0.0063,"epss_percentile":0.50526,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ycTRwLWc3aHYtNXJnds4ABhoU","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0ycTRwLWc3aHYtNXJnds4ABhoU","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.9.0","vulnerable_version_range":"\u003e= 0.6.0, \u003c 2.9.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ycTRwLWc3aHYtNXJnds4ABhoU/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yOXBqLTk1N3YtNTJtY84ABhoT","url":"https://github.com/advisories/GHSA-29pj-957v-52mc","title":"league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes","description":"## Summary\n\nThe `AttributesExtension`'s `href`/`src` unsafe-link filter (`AttributesHelper::filterAttributes()`) can be bypassed by embedding control bytes in a `javascript:` URL that browsers discard before parsing the scheme. Two variants:\n\n- **Tab/newline inside the scheme** — a literal ASCII TAB (0x09), CR (0x0D), or LF (0x0A), e.g. `java\u003cTAB\u003escript:alert(1)`. Per the WHATWG URL Standard's \"basic URL parser\" step 3, browsers \"remove all ASCII tab or newline from input\".\n- **Leading C0 controls** — e.g. `\u003c0x01\u003ejavascript:alert(1)`. Per step 1 of the same algorithm, browsers remove any leading or trailing C0 control or space. (A leading *space* alone does not bypass, because `parseAttributes()` already `trim()`s the value; other C0 bytes are not trimmed.)\n\nThe filter is a literal anchored-prefix regex (`RegexHelper::isLinkPotentiallyUnsafe()` / `REGEX_UNSAFE_PROTOCOL`) that matches neither obfuscated form, so in both cases the browser still executes `javascript:alert(1)`.\n\n**This is confirmed reproducible even with `allow_unsafe_links =\u003e false` set** — i.e. even applications that have followed the library's own documented hardening guidance for untrusted input remain exploitable.\n\nThis is a *sibling gap* in the same defense that CVE-2025-46734 (GHSA-3527-qv2q-pfvx) fixed in v2.7.0 — that fix made `href`/`src` respect `allow_unsafe_links`, but did not normalize control bytes before checking, so these obfuscation techniques were never covered.\n\n## Vulnerability\n\n**Files**:\n- `src/Util/RegexHelper.php:69` (`REGEX_UNSAFE_PROTOCOL`), `:239-242` (`isLinkPotentiallyUnsafe()`)\n- `src/Extension/Attributes/Util/AttributesHelper.php:149-179` (`filterAttributes()`)\n\n**CWE**: CWE-79 (Improper Neutralization of Input During Web Page Generation / XSS) — primary\n- CWE-692 (Incomplete Denylist to Cross-Site Scripting) — the anchored-prefix denylist in `REGEX_UNSAFE_PROTOCOL` is incomplete. This is a composite of CWE-184 and CWE-79, so it captures the full \"incomplete denylist → XSS\" chain on its own.\n- CWE-86 (Improper Neutralization of Invalid Characters in Identifiers in Web Pages) — the specific evasion technique: control bytes embedded within the URI scheme identifier, which the browser strips before resolving it.\n\n### Root Cause\n```php\n// src/Util/RegexHelper.php\npublic const REGEX_UNSAFE_PROTOCOL = '/^(?:javascript|vbscript|file|data):/i';\n\npublic static function isLinkPotentiallyUnsafe(string $url): bool\n{\n    return \\preg_match(self::REGEX_UNSAFE_PROTOCOL, $url) !== 0 \u0026\u0026 \\preg_match(self::REGEX_SAFE_DATA_PROTOCOL, $url) === 0;\n}\n\n// src/Extension/Attributes/Util/AttributesHelper.php\nforeach ($attributes as $name =\u003e $value) {\n    $attrNameLower = \\strtolower($name);\n    if (! $allowUnsafeLinks \u0026\u0026 ($attrNameLower === 'href' || $attrNameLower === 'src') \u0026\u0026 \\is_string($value) \u0026\u0026 RegexHelper::isLinkPotentiallyUnsafe($value)) {\n        unset($attributes[$name]);\n        continue;\n    }\n    ...\n```\nThe Attributes extension's own quote-value grammar (`PARTIAL_DOUBLEQUOTEDVALUE = '\"[^\"]*\"'`) accepts any byte except `\"` inside quotes, including raw tab/CR/LF and other C0 controls, and `parseAttributes()` only `trim()`s (leading/trailing, and only the default charlist `\" \\t\\n\\r\\0\\x0B\"` — so a leading `\\x01` survives). Critically, **the core Markdown link-destination path (`LinkParserHelper` → `UrlEncoder::unescapeAndEncode()`) percent-encodes every control byte before this same safety check ever runs — but the Attributes extension's `href`/`src` handling has no equivalent normalization step**, so the raw control byte reaches both the check and the final HTML output (`Xml::escape()` only escapes `\u0026 \u003c \u003e \" '`, not tab/CR/LF, since they're legal bytes inside an HTML attribute).\n\n### Attack Scenario\n1. An application enables the (commonly-used) `AttributesExtension` and sets `allow_unsafe_links =\u003e false` — the project's own documented hardening step for untrusted input.\n2. An attacker submits Markdown: `[Click me](javascript:alert(0)){href=\"java\u003cTAB\u003escript:alert(document.cookie)\"}` (TAB is one literal 0x09 byte).\n3. The library emits `\u003ca href=\"java\u003cTAB\u003escript:alert(document.cookie)\"\u003eClick me\u003c/a\u003e` — `isLinkPotentiallyUnsafe()` doesn't match the tab-split scheme, so the filter takes no action.\n4. A victim viewing/clicking the link has the browser strip the embedded TAB and execute `javascript:alert(document.cookie)` in the victim's session — stored XSS, cookie theft, account takeover potential.\n\n**Why the payload needs an unsafe core destination.** Step 2 above deliberately uses `[Click me](javascript:alert(0))` rather than a normal link. `LinkRenderer` overwrites `attrs['href']` with the node's own URL *unless* that URL is itself judged unsafe — so `[x](https://example.com){href=\"java\u003cTAB\u003escript:...\"}` renders the harmless `href=\"https://example.com\"`, and an empty destination `[x](){href=\"...\"}` renders `href=\"\"`. The attacker therefore supplies a core destination that the filter *does* catch, which suppresses the overwrite and lets the attribute-supplied `href` reach the final tag. This is no obstacle in practice — the attacker writes the entire Markdown document.\n\nTwo related forms that are **not** exploitable, noted so the fix isn't over-scoped:\n\n- Attaching the attribute to a non-link block — `hi {href=\"java\u003cTAB\u003escript:alert(1)\"}` — does bypass the filter and emits `\u003cp href=\"java\u003cTAB\u003escript:alert(1)\"\u003e`, but `href` on a `\u003cp\u003e` is inert: there is nothing to navigate. (An earlier draft of this report described this as a \"simpler, unconditional variant\" of the attack; it is a filter bypass, not an XSS.)\n- `\u003cimg src\u003e` is unaffected, since `ImageRenderer` unconditionally overwrites `src` from the core URL regardless of the safety verdict.\n\n### Recommended Fix\n\nNormalize inside `RegexHelper::isLinkPotentiallyUnsafe()` before testing, mirroring the WHATWG URL parser's own normalization. This covers both variants, fixes every call site at once (`LinkRenderer`, `ImageRenderer`, and any third-party callers), and needs no changes in the Attributes extension.\n\n## Affected Versions\n\n**`\u003e= 1.5.0, \u003c= 2.8.3`** - every release that ships the `AttributesExtension`. Verified by installing each version and rendering the payloads with `allow_unsafe_links =\u003e false`. The attribute-value grammar (`PARTIAL_DOUBLEQUOTEDVALUE = '\"[^\"]*\"'`) has accepted raw control bytes since the extension was introduced, and none of the intervening parser rewrites narrowed it.\n\n## Prior Related Advisories\n\nGHSA-3527-qv2q-pfvx / CVE-2025-46734 fixed a different Attributes-extension XSS (unallowlisted `on*` handlers, `href`/`src` not respecting `allow_unsafe_links` at all) in v2.7.0. This issue bypasses the specific `href`/`src` protection that fix introduced (the control-byte normalization gap was not part of that fix) - but the obfuscated inputs also work on older versions.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-08-06T20:30:39.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc","https://github.com/thephpleague/commonmark/commit/493a5aa7d65754b73846006eaff9c2c4431a8e2c","https://github.com/thephpleague/commonmark/releases/tag/2.9.0","https://github.com/advisories/GHSA-29pj-957v-52mc"],"source_kind":"github","identifiers":["GHSA-29pj-957v-52mc","CVE-2026-71478"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-08-06T21:00:08.649Z","updated_at":"2026-11-12T04:02:41.446Z","epss_percentage":0.00355,"epss_percentile":0.29602,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yOXBqLTk1N3YtNTJtY84ABhoT","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yOXBqLTk1N3YtNTJtY84ABhoT","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.9.0","vulnerable_version_range":"\u003e= 1.5.0, \u003c= 2.8.3"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yOXBqLTk1N3YtNTJtY84ABhoT/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1oaDh2LWhndnAtZzNmNc4ABT38","url":"https://github.com/advisories/GHSA-hh8v-hgvp-g3f5","title":"league/commonmark has an embed extension allowed_domains bypass","description":"### Impact\n\nThe `DomainFilteringAdapter` in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like `youtube.com.evil` passes the allowlist check when `youtube.com` is an allowed domain.\n\nThis enables two attack vectors:\n\n- **SSRF**: The `OscaroteroEmbedAdapter` makes server-side HTTP requests to the embed URL via the `embed/embed` library. A bypassed domain filter causes the server to make outbound requests to an attacker-controlled host, potentially probing internal services or exfiltrating request metadata.\n- **XSS**: `EmbedRenderer` outputs the oEmbed response HTML directly into the page with no sanitization. An attacker controlling the bypassed domain can return arbitrary HTML/JavaScript in their oEmbed response, which is rendered verbatim.\n\nAny application using the `Embed` extension and relying on `allowed_domains` to restrict domains when processing untrusted Markdown input is affected.\n\n### Patches\n\nThis has been patched in version **2.8.2**. The fix replaces the regex-based domain check with explicit hostname parsing using `parse_url()`, ensuring exact domain and subdomain matching only.\n\n### Workarounds\n\n- Disable the `Embed` extension, or restrict its use to trusted users\n- Provide your own domain-filtering implementation of `EmbedAdapterInterface`\n- Enable a [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) and outbound firewall restrictions","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-19T19:04:24.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-hh8v-hgvp-g3f5","https://nvd.nist.gov/vuln/detail/CVE-2026-33347","https://github.com/thephpleague/commonmark/commit/59fb075d2101740c337c7216e3f32b36c204218b","https://github.com/thephpleague/commonmark/releases/tag/2.8.2","https://github.com/advisories/GHSA-hh8v-hgvp-g3f5"],"source_kind":"github","identifiers":["GHSA-hh8v-hgvp-g3f5","CVE-2026-33347"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-19T20:00:10.218Z","updated_at":"2026-11-11T06:06:54.809Z","epss_percentage":0.00256,"epss_percentile":0.1728,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oaDh2LWhndnAtZzNmNc4ABT38","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1oaDh2LWhndnAtZzNmNc4ABT38","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.8.2","vulnerable_version_range":"\u003e= 2.3.0, \u003c= 2.8.1"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oaDh2LWhndnAtZzNmNc4ABT38/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS00djZ4LWM3eHgtaHc5Zs4ABTSQ","url":"https://github.com/advisories/GHSA-4v6x-c7xx-hw9f","title":"CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names","description":"### Impact\n\nThe `DisallowedRawHtml` extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing `\u003e`. For example, `\u003cscript\\n\u003e` would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input.\n\nAll applications using the `DisallowedRawHtml` extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected.\n\n### Patches\n\nFixed in 2.8.1. The regex character class `[ \\/\u003e]` was changed to `[\\s\\/\u003e]` to match all whitespace characters that browsers accept as valid tag name terminators.\n\n### Workarounds\n\n- Set the `html_input` configuration option to `'escape'` or `'strip'` to disable all raw HTML, though this is a broader restriction than the `DisallowedRawHtml` extension provides.\n- Pass the rendered HTML through a dedicated HTML sanitizer before serving it to users ([always recommended](https://commonmark.thephpleague.com/2.x/security/#additional-filtering))","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-06T23:27:03.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-4v6x-c7xx-hw9f","https://commonmark.thephpleague.com/extensions/disallowed-raw-html","https://nvd.nist.gov/vuln/detail/CVE-2026-30838","https://github.com/advisories/GHSA-4v6x-c7xx-hw9f"],"source_kind":"github","identifiers":["GHSA-4v6x-c7xx-hw9f","CVE-2026-30838"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-07T00:00:09.755Z","updated_at":"2026-11-04T06:06:17.372Z","epss_percentage":0.00245,"epss_percentile":0.1583,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00djZ4LWM3eHgtaHc5Zs4ABTSQ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS00djZ4LWM3eHgtaHc5Zs4ABTSQ","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.8.1","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.8.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00djZ4LWM3eHgtaHc5Zs4ABTSQ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zNTI3LXF2MnEtcGZ2eM4ABHen","url":"https://github.com/advisories/GHSA-3527-qv2q-pfvx","title":"league/commonmark contains a XSS vulnerability in Attributes extension","description":"### Summary\nCross-site scripting (XSS) vulnerability in the [Attributes extension](https://commonmark.thephpleague.com/extensions/attributes/) of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML.\n\n### Details\n\nThe league/commonmark library provides configuration options such as `html_input: 'strip'` and `allow_unsafe_links: false` to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces.\n\nAs a result, even with the secure configuration shown above, an attacker can inject dangerous attributes into applications using this extension via a payload such as:\n\n```md\n![](){onerror=alert(1)}\n```\n\nWhich results in the following HTML:\n\n```html\n\u003cp\u003e\u003cimg onerror=\"alert(1)\" src=\"\" alt=\"\" /\u003e\u003c/p\u003e\n```\n\nWhich causes the JS to execute immediately on page load.\n\n### Patches\n\nVersion 2.7.0 contains three changes to prevent this XSS attack vector:\n\n- All attributes starting with `on` are considered unsafe and blocked by default\n- [Support for an explicit allowlist of allowed HTML attributes](https://commonmark.thephpleague.com/2.7/extensions/attributes/#configuration)\n- Manually-added `href` and `src` attributes now respect the existing `allow_unsafe_links` configuration option\n\n### Workarounds\n\nIf upgrading is not feasible, please consider:\n\n- Disabling the `AttributesExtension` for untrusted users\n- [Filtering the rendered HTML through a library like HTMLPurifier](https://commonmark.thephpleague.com/security/#additional-filtering)","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-05-05T20:40:36.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.4,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-3527-qv2q-pfvx","https://github.com/thephpleague/commonmark/commit/f0d626cf05ad3e99e6db26ebcb9091b6cd1cd89b","https://nvd.nist.gov/vuln/detail/CVE-2025-46734","https://github.com/advisories/GHSA-3527-qv2q-pfvx"],"source_kind":"github","identifiers":["GHSA-3527-qv2q-pfvx","CVE-2025-46734"],"repository_url":"https://github.com/thephpleague/commonmark","blast_radius":0.0,"created_at":"2025-05-05T21:08:09.079Z","updated_at":"2026-11-06T02:05:08.212Z","epss_percentage":0.00384,"epss_percentile":0.32682,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zNTI3LXF2MnEtcGZ2eM4ABHen","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zNTI3LXF2MnEtcGZ2eM4ABHen","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.7.0","vulnerable_version_range":"\u003e= 1.5.0, \u003c 2.7.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zNTI3LXF2MnEtcGZ2eM4ABHen/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jMnBjLWc1cWYtcmZyZs4ABCNG","url":"https://github.com/advisories/GHSA-c2pc-g5qf-rfrf","title":"league/commonmark's quadratic complexity bugs may lead to a denial of service","description":"### Impact\n\nSeveral polynomial time complexity issues in league/commonmark may lead to unbounded resource exhaustion and subsequent denial of service.\n\nMalicious users could trigger that inefficient code with carefully crafted Markdown inputs that are specifically designed to ensure the worst-case performance is reached.  Sending multiple such requests in parallel could tie up all available CPU resources and/or PHP-FPM processes, leading to denial of service for legitimate users.\n\n### Patches\n\nThese vulnerabilities have been patched in version 2.6.0.  All users on older versions are highly encouraged to upgrade as soon as possible.\n\n### Workarounds\n\nIf you cannot upgrade, you may be able to mitigate the issues by:\n\n- Setting very low `memory_limit` and `max_execution_time` PHP configurations to prevent runaway resource usage\n- Implementing rate-limiting, bot protection, or other approaches to reduce the risk of simultaneous bad requests hitting your site\n- Limiting the size of inputs fed into this library (specifically the max length of each line)\n- Limiting the use of this library to trusted users\n\n### References\n\nMost of these issues were discovered in other Markdown parsers. You can read more about them here:\n\n* https://github.com/commonmark/commonmark.js/issues/129\n* https://github.com/commonmark/commonmark.js/issues/157\n* https://github.com/commonmark/commonmark.js/issues/172\n* https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p\n* https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r\n* https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c\n* https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5\n* https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5\n* https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh\n\nFor general information about this type of issue:\n\n* https://en.wikipedia.org/wiki/Time_complexity\n* https://cwe.mitre.org/data/definitions/407.html\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-12-09T20:42:07.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r","https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c","https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh","https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p","https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5","https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5","https://github.com/thephpleague/commonmark/security/advisories/GHSA-c2pc-g5qf-rfrf","https://github.com/commonmark/commonmark.js/issues/129","https://github.com/commonmark/commonmark.js/issues/157","https://github.com/commonmark/commonmark.js/issues/172","https://github.com/advisories/GHSA-c2pc-g5qf-rfrf"],"source_kind":"github","identifiers":["GHSA-c2pc-g5qf-rfrf"],"repository_url":"https://github.com/github/cmark-gfm","blast_radius":0.0,"created_at":"2024-12-09T21:07:48.369Z","updated_at":"2026-11-05T13:09:01.978Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jMnBjLWc1cWYtcmZyZs4ABCNG","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jMnBjLWc1cWYtcmZyZs4ABCNG","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"2.6.0","vulnerable_version_range":"\u003c 2.6.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jMnBjLWc1cWYtcmZyZs4ABCNG/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xeDc2LWM1M2YtNWM3cc4AAUX9","url":"https://github.com/advisories/GHSA-qx76-c53f-5c7q","title":"PHP League CommonMark vulnerable to Cross-Site Scripting (XSS)","description":"Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g., writing javascript as javascri%0apt).","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-05-14T01:40:50.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2018-20583","https://github.com/thephpleague/commonmark/issues/337","https://commonmark.thephpleague.com/changelog/","https://github.com/thephpleague/commonmark/releases/tag/0.18.1","https://github.com/FriendsOfPHP/security-advisories/blob/master/league/commonmark/CVE-2018-20583.yaml","https://github.com/advisories/GHSA-qx76-c53f-5c7q"],"source_kind":"github","identifiers":["GHSA-qx76-c53f-5c7q","CVE-2018-20583"],"repository_url":"https://github.com/thephpleague/commonmark","blast_radius":0.0,"created_at":"2022-12-21T16:11:59.663Z","updated_at":"2026-11-12T12:17:17.694Z","epss_percentage":0.01863,"epss_percentile":0.79548,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xeDc2LWM1M2YtNWM3cc4AAUX9","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xeDc2LWM1M2YtNWM3cc4AAUX9","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"0.18.1","vulnerable_version_range":"\u003e= 0.15.6, \u003c 0.18.1"}],"purl":null,"statistics":{"dependent_packages_count":477,"dependent_repos_count":238335,"downloads":515757450,"downloads_period":"total"},"affected_versions":["0.15.6","0.15.7","0.16.0","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.18.0"],"unaffected_versions":["0.1.0","0.1.1","0.1.2","0.2.0","0.2.1","0.3.0","0.4.0","0.5.0","0.5.1","0.6.0","0.6.1","0.7.0","0.7.1","0.7.2","0.8.0","0.9.0","0.10.0","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.14.0","0.15.0","0.15.1","0.15.2","0.15.3","0.15.4","0.15.5","0.18.1","0.18.2","0.18.3","0.18.4","0.18.5","0.19.0","0.19.1","0.19.2","0.19.3","1.0.0","1.1.0","1.1.1","1.1.2","1.1.3","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.4.0","1.4.1","1.4.2","1.4.3","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.1.0","2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.8.0","2.8.1","2.8.2","2.8.3","2.9.0","2.9.1","2.9.2","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.10.7"]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xeDc2LWM1M2YtNWM3cc4AAUX9/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTN2NDMtODc3eC1xZ21x","url":"https://github.com/advisories/GHSA-3v43-877x-qgmq","title":"Moderate severity vulnerability that affects league/commonmark","description":"## CVE-2019-10010\n\n### Impact\n\nIn `league/commonmark` 0.18.2 and below, malicious users can insert double-encoded HTML entities into their Markdown like this:\n\n```md\n[XSS](javascript\u0026amp;colon;alert%28\u0026#039;XSS\u0026#039;%29)\n```\n\nThis library would (correctly) unescape the `\u0026amp;` entity to `\u0026` during the parsing step.  However, **the renderer step would fail to properly re-escape the resulting `\u0026colon;` string**, thus producing the following malicious HTML output:\n\n```html\n\u003cp\u003e\u003ca href=\"javascript\u0026colon;alert('XSS')\"\u003eXSS\u003c/a\u003e\u003c/p\u003e\n```\n\nBrowsers would interpret `\u0026colon;` as a `:` character and allow the JS to be executed when the link is clicked.\n\nThis vulnerability was present in the upstream library this project was forked from and therefore exists in all prior versions of `league/commonmark`.\n\n### Solution\n\nThe new [0.18.3](https://github.com/thephpleague/commonmark/releases/tag/0.18.3) release mirrors [the fix made upstream](https://github.com/commonmark/commonmark.js/commit/c89b35c5fc99bdf1d2181f7f0c9fcb8a1abc27c8) - we no longer attempt to preserve entities when rendering HTML attributes like `href`, `src`, `title`, etc.\n\nThe `$preserveEntities` parameter of `Xml::escape()` is therefore no longer used internally, so it has been deprecated and marked for removal in the next major release (0.19.0).\n\n### Credits\n\n - Mohit Fawaz for identifying the issue\n - Sebastiaan Knijnenburg and Ross Tuck for responsibly disclosing/relaying the issue\n - John MacFarlane for investigating it and implementing the upstream fix we mirrored here\n\n### References\n\n - https://nvd.nist.gov/vuln/detail/CVE-2019-10010\n - https://github.com/thephpleague/commonmark/releases/tag/0.18.3\n - https://github.com/thephpleague/commonmark/issues/353\n- https://github.com/FriendsOfPHP/security-advisories/blob/master/league/commonmark/CVE-2019-10010.yaml","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2019-09-17T22:47:47.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-3v43-877x-qgmq","https://nvd.nist.gov/vuln/detail/CVE-2019-10010","https://github.com/thephpleague/commonmark/issues/353","https://github.com/advisories/GHSA-3v43-877x-qgmq","https://github.com/thephpleague/commonmark/releases/tag/0.18.3","https://github.com/FriendsOfPHP/security-advisories/blob/master/league/commonmark/CVE-2019-10010.yaml"],"source_kind":"github","identifiers":["GHSA-3v43-877x-qgmq","CVE-2019-10010"],"repository_url":"https://github.com/thephpleague/commonmark","blast_radius":0.0,"created_at":"2022-12-21T16:13:28.101Z","updated_at":"2026-11-12T12:19:48.532Z","epss_percentage":0.0105,"epss_percentile":0.6451,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTN2NDMtODc3eC1xZ21x","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTN2NDMtODc3eC1xZ21x","packages":[{"ecosystem":"packagist","package_name":"league/commonmark","versions":[{"first_patched_version":"0.18.3","vulnerable_version_range":"\u003c 0.18.3"}],"purl":null,"statistics":{"dependent_packages_count":477,"dependent_repos_count":238335,"downloads":515757450,"downloads_period":"total"},"affected_versions":["0.1.0","0.1.1","0.1.2","0.2.0","0.2.1","0.3.0","0.4.0","0.5.0","0.5.1","0.6.0","0.6.1","0.7.0","0.7.1","0.7.2","0.8.0","0.9.0","0.10.0","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.14.0","0.15.0","0.15.1","0.15.2","0.15.3","0.15.4","0.15.5","0.15.6","0.15.7","0.16.0","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.18.0","0.18.1","0.18.2"],"unaffected_versions":["0.18.3","0.18.4","0.18.5","0.19.0","0.19.1","0.19.2","0.19.3","1.0.0","1.1.0","1.1.1","1.1.2","1.1.3","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.4.0","1.4.1","1.4.2","1.4.3","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.1.0","2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.8.0","2.8.1","2.8.2","2.8.3","2.9.0","2.9.1","2.9.2","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.10.7"]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTN2NDMtODc3eC1xZ21x/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/packagist/league/commonmark","docker_dependents_count":965,"docker_downloads_count":748647308,"usage_url":"https://repos.ecosyste.ms/usage/packagist/league/commonmark","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/packagist/league/commonmark/dependencies","status":null,"funding_links":["https://www.colinodell.com/sponsor","https://www.paypal.me/colinpodell/10.00","https://github.com/colinodell","https://tidelift.com/funding/github/packagist/league/commonmark","https://github.com/sponsors/colinodell"],"critical":true,"issue_metadata":{"last_synced_at":"2026-11-11T23:20:50.471Z","issues_count":88,"pull_requests_count":193,"avg_time_to_close_issue":12556241.046875,"avg_time_to_close_pull_request":3114944.217142857,"issues_closed_count":64,"pull_requests_closed_count":175,"pull_request_authors_count":52,"issue_authors_count":67,"avg_comments_per_issue":2.0681818181818183,"avg_comments_per_pull_request":0.5492227979274611,"merged_pull_requests_count":155,"bot_issues_count":1,"bot_pull_requests_count":55,"past_year_issues_count":9,"past_year_pull_requests_count":46,"past_year_avg_time_to_close_issue":4838912.0,"past_year_avg_time_to_close_pull_request":1543926.2045454546,"past_year_issues_closed_count":6,"past_year_pull_requests_closed_count":44,"past_year_pull_request_authors_count":16,"past_year_issue_authors_count":6,"past_year_avg_comments_per_issue":0.7777777777777778,"past_year_avg_comments_per_pull_request":0.41304347826086957,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":3,"past_year_merged_pull_requests_count":40,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/thephpleague%2Fcommonmark/issues","maintainers":[{"login":"colinodell","count":66,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/colinodell"},{"login":"GrahamCampbell","count":9,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/GrahamCampbell"},{"login":"philsturgeon","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/philsturgeon"}],"active_maintainers":[{"login":"colinodell","count":25,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/colinodell"},{"login":"GrahamCampbell","count":8,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/GrahamCampbell"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/league%2Fcommonmark/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/league%2Fcommonmark/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/league%2Fcommonmark/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/league%2Fcommonmark/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/league%2Fcommonmark/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/league%2Fcommonmark/codemeta","maintainers":[{"uuid":"frankdejonge","login":"frankdejonge","name":null,"email":null,"url":null,"packages_count":128,"html_url":"https://packagist.org/users/frankdejonge","role":null,"created_at":"2022-11-10T10:41:04.421Z","updated_at":"2022-11-10T10:41:04.421Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/maintainers/frankdejonge/packages"},{"uuid":"colinodell","login":"colinodell","name":null,"email":null,"url":null,"packages_count":26,"html_url":"https://packagist.org/users/colinodell","role":null,"created_at":"2022-11-10T10:41:04.423Z","updated_at":"2022-11-10T10:41:04.423Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/maintainers/colinodell/packages"}]}