build(deps): bump the composer group across 1 directory with 3 updates by dependabot[bot] · Pull Request #1 · tuxevil/openAPI-ec

dependabot · 2026-09-29T20:37:56Z

Bumps the composer group with 3 updates in the / directory: laravel/framework, guzzlehttp/guzzle and league/commonmark.

Updates laravel/framework from 13.16.1 to 13.30.0

Release notes

Sourced from laravel/framework's releases.

v13.30.0

[12.x] Backport #60908: Avoid quadratic wildcard rule expansion by @matteo-palazzo in laravel/framework#61232

Fix resource loading by @taylorotwell in laravel/framework#61323

[13.x] Output the worker stop reason in queue:work by @jackbayliss in laravel/framework#61339

Fix incorrect $startTime type in Worker::stopIfNecessary docblock by @il-m-tomita in laravel/framework#61347

[13.x] Ability to opt out of vendor/default commands in DevCommands by @jackbayliss in laravel/framework#61344

[13.x] Confine Storage::path() to the configured disk root by @KIKOmanasijev in laravel/framework#61343

[13.x] Support Microsoft SQL Server DSN connection strings by @HenkPoley in laravel/framework#61341

[13.x] Restore the facade application after route:cache boots a fresh application by @reiarseni in laravel/framework#61346

[13.x] Gracefully handle missing param value or strings with request clamps by @kylemilloy in laravel/framework#61355

[13.x] Restore default database connection when seeding fails by @sayful1411 in laravel/framework#61354

[13.x] Cloud enhancements by @timacdonald in laravel/framework#61360

[13.x] Allow retrieving command by name without resolving all commands by @timacdonald in laravel/framework#61361

[13.x] Expose methods by @timacdonald in laravel/framework#61362

[13.x] Add basic test for query explain by @imanghafoori1 in laravel/framework#61363

[13.x] Add totalXSize methods to Cloud Queue by @jackbayliss in laravel/framework#61352

[13.x] Add chunkBy to collections by @JosephSilber in laravel/framework#61357

[13.x] spl_object_id over hash by @jackbayliss in laravel/framework#61372

[13.x] Add createPayloadUsing directly to the queue manager by @jackbayliss in laravel/framework#61367

[13.x] Set visibility on files that only exist on a read-through disk's fallback by @sulimanbenhalim in laravel/framework#61375

[12.x] Disable html by default on Laravel exception page tooltip by @crynobone in laravel/framework#61381

v13.29.0

No release notes provided.

v13.27.0

[13.x] Prevent duplicate scoped instance registrations by @jordanhavard in laravel/framework#61251

[13.x] Add refreshForUpdate() method to Eloquent models by @stevebauman in laravel/framework#61247

[13.x] Fix PHPUnit and Mockery deprecations in tests by @lucasmichot in laravel/framework#61244

[13.x] Throw on unsuccessful responses when creating images from URLs by @Button99 in laravel/framework#61254

Apply fixes from StyleCI by @taylorotwell in laravel/framework#61256

[13.x] Skip scheduled workflows on forks by @MrPunyapal in laravel/framework#61239

[13.x] Consolidate tearDown boilerplate into AfterEachTestSubscriber by @lucasmichot in laravel/framework#61245

[13.x] Pin rector version by @lucasmichot in laravel/framework#61257

[13.x] Re-introduce orWhereKey() and orWhereKeyNot() without breaking Builder subclasses by @kevariable in laravel/framework#61242

[13.x] Don't force release a unique lock the job never acquired by @sulimanbenhalim in laravel/framework#61234

[13.x] Convert foreach-loop tests to data providers by @lucasmichot in laravel/framework#61258

[13.x] Simplify testImageBmp by @lucasmichot in laravel/framework#61259

[13.x] Add missing test coverage for Str and Stringable by @lucasmichot in laravel/framework#61260

[13.x] Add Queue totalXSize methods by @jackbayliss in laravel/framework#61231

Add MariaDB support for vector distance queries by @Rhaima96 in laravel/framework#61250

[13.x] Add whereBinary() to the query builder by @xiCO2k in laravel/framework#61261

[13.x] Fix quietly() making throw() unreachable on process results by @xurshudyan in laravel/framework#61227

Revert "[13.x] Consolidate tearDown boilerplate into AfterEachTestSubscriber (#61245)" by @crynobone in laravel/framework#61262

Use nick-fields/retry to verify clustered redis ports are available by @crynobone in laravel/framework#61263

[13.x] Guard against false returns in PhpRedisConnection::mget() and hmget() by @matthewfarrugia in laravel/framework#61267

[13.x] Add stop() and ensureNotTimedOut() to FakeInvokedProcess by @xurshudyan in laravel/framework#61266

[13.x] Make eager-load constraint closures static to break Builder reference cycle by @mspasov in laravel/framework#61264

[13.x] Move and copy files that only exist on a read-through disk's fallback by @sulimanbenhalim in laravel/framework#61272

[13.x] Adjust QueueTest by @jackbayliss in laravel/framework#61284

... (truncated)

Changelog

Sourced from laravel/framework's changelog.

v13.30.0 - 2026-09-01

[12.x] Backport #60908: Avoid quadratic wildcard rule expansion by @matteo-palazzo in laravel/framework#61232

Fix resource loading by @taylorotwell in laravel/framework#61323

[13.x] Output the worker stop reason in queue:work by @jackbayliss in laravel/framework#61339

Fix incorrect $startTime type in Worker::stopIfNecessary docblock by @il-m-tomita in laravel/framework#61347

[13.x] Ability to opt out of vendor/default commands in DevCommands by @jackbayliss in laravel/framework#61344

[13.x] Confine Storage::path() to the configured disk root by @KIKOmanasijev in laravel/framework#61343

[13.x] Support Microsoft SQL Server DSN connection strings by @HenkPoley in laravel/framework#61341

[13.x] Restore the facade application after route:cache boots a fresh application by @reiarseni in laravel/framework#61346

[13.x] Gracefully handle missing param value or strings with request clamps by @kylemilloy in laravel/framework#61355

[13.x] Restore default database connection when seeding fails by @sayful1411 in laravel/framework#61354

[13.x] Cloud enhancements by @timacdonald in laravel/framework#61360

[13.x] Allow retrieving command by name without resolving all commands by @timacdonald in laravel/framework#61361

[13.x] Expose methods by @timacdonald in laravel/framework#61362

[13.x] Add basic test for query explain by @imanghafoori1 in laravel/framework#61363

[13.x] Add totalXSize methods to Cloud Queue by @jackbayliss in laravel/framework#61352

[13.x] Add chunkBy to collections by @JosephSilber in laravel/framework#61357

[13.x] spl_object_id over hash by @jackbayliss in laravel/framework#61372

[13.x] Add createPayloadUsing directly to the queue manager by @jackbayliss in laravel/framework#61367

[13.x] Set visibility on files that only exist on a read-through disk's fallback by @sulimanbenhalim in laravel/framework#61375

[12.x] Disable html by default on Laravel exception page tooltip by @crynobone in laravel/framework#61381

v13.29.0 - 2026-08-25

v13.27.0 - 2026-08-25

[13.x] Prevent duplicate scoped instance registrations by @jordanhavard in laravel/framework#61251

[13.x] Add refreshForUpdate() method to Eloquent models by @stevebauman in laravel/framework#61247

[13.x] Fix PHPUnit and Mockery deprecations in tests by @lucasmichot in laravel/framework#61244

[13.x] Throw on unsuccessful responses when creating images from URLs by @Button99 in laravel/framework#61254

Apply fixes from StyleCI by @taylorotwell in laravel/framework#61256

[13.x] Skip scheduled workflows on forks by @MrPunyapal in laravel/framework#61239

[13.x] Consolidate tearDown boilerplate into AfterEachTestSubscriber by @lucasmichot in laravel/framework#61245

[13.x] Pin rector version by @lucasmichot in laravel/framework#61257

[13.x] Re-introduce orWhereKey() and orWhereKeyNot() without breaking Builder subclasses by @kevariable in laravel/framework#61242

[13.x] Don't force release a unique lock the job never acquired by @sulimanbenhalim in laravel/framework#61234

[13.x] Convert foreach-loop tests to data providers by @lucasmichot in laravel/framework#61258

[13.x] Simplify testImageBmp by @lucasmichot in laravel/framework#61259

[13.x] Add missing test coverage for Str and Stringable by @lucasmichot in laravel/framework#61260

[13.x] Add Queue totalXSize methods by @jackbayliss in laravel/framework#61231

Add MariaDB support for vector distance queries by @Rhaima96 in laravel/framework#61250

[13.x] Add whereBinary() to the query builder by @xiCO2k in laravel/framework#61261

[13.x] Fix quietly() making throw() unreachable on process results by @xurshudyan in laravel/framework#61227

Revert "[13.x] Consolidate tearDown boilerplate into AfterEachTestSubscriber (#61245)" by @crynobone in laravel/framework#61262

Use nick-fields/retry to verify clustered redis ports are available by @crynobone in laravel/framework#61263

[13.x] Guard against false returns in PhpRedisConnection::mget() and hmget() by @matthewfarrugia in laravel/framework#61267

[13.x] Add stop() and ensureNotTimedOut() to FakeInvokedProcess by @xurshudyan in laravel/framework#61266

[13.x] Make eager-load constraint closures static to break Builder reference cycle by @mspasov in laravel/framework#61264

[13.x] Move and copy files that only exist on a read-through disk's fallback by @sulimanbenhalim in laravel/framework#61272

... (truncated)

Commits

9c008e7 Update version to v13.30.0
df92a8b Merge branch '12.x' into 13.x
b495ca2 [12.x] Disable html by default on Laravel exception page tooltip (#61381)
f9c010a fix validation disagreement
8390200 Update facade docblocks
e437d91 [13.x] Set visibility on files that only exist on a read-through disk's fallb...
356865b Update QueueManager.php (#61367)
a8b65eb [13.x] spl_object_id over hash (#61372)
bf309eb [13.x] Add chunkBy to collections (#61357)
62c4fd3 [13.x] Add totalXSize methods to Cloud Queue (#61352)
Additional commits viewable in compare view

Updates guzzlehttp/guzzle from 7.15.1 to 8.2.0

Release notes

Sourced from guzzlehttp/guzzle's releases.

8.2.0

Changed

Allow connection caps to be combined with persistent transport sharing on libcurl 8.22.0+

8.1.0

Added

Add PHP 8.6+ stream TLS session sharing, while persistent sharing remains cURL-only

Add support for PHP 8.6

Add in-transfer resends of seekable streamed uploads when PHP exposes CURLOPT_SEEKFUNCTION

Changed

Adjusted guzzlehttp/promises version constraint to ^3.0.2

Adjusted guzzlehttp/psr7 version constraint to ^3.1

Classify stream handler transport failures using PHP 8.6+ structured stream error codes

Hide URI credentials, queries, and fragments in automatic exception messages

Match no_proxy rules against IPv4 hosts written in the shorthand a transport reads as an address

Hold the cURL easy handle out of the reuse pool until a silent retry has been dispatched

Treat a deferred resolved with a pending retry promise as progress when waiting on cURL transfers

8.0.3

Changed

Adjusted guzzlehttp/psr7 version constraint to ^3.0.1

8.0.2

Changed

Adjusted guzzlehttp/promises version constraint to ^3.0.1

Fixed

Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked

Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows

Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms

Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

8.0.1

Security

Reject request URI hosts and Host header values that are not printable ASCII (GHSA-v5mv-p594-2x33)

Reject URI hosts with a percent escape or that are not valid RFC 3986 hosts (GHSA-v5mv-p594-2x33)

Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)

Treat percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)

Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

8.0.0

Added

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

8.2.0 - 2026-09-06

Changed

Allow connection caps to be combined with persistent transport sharing on libcurl 8.22.0+

8.1.0 - 2026-08-24

Added

Add PHP 8.6+ stream TLS session sharing, while persistent sharing remains cURL-only

Add support for PHP 8.6

Add in-transfer resends of seekable streamed uploads when PHP exposes CURLOPT_SEEKFUNCTION

Changed

Adjusted guzzlehttp/promises version constraint to ^3.0.2

Adjusted guzzlehttp/psr7 version constraint to ^3.1

Classify stream handler transport failures using PHP 8.6+ structured stream error codes

Hide URI credentials, queries, and fragments in automatic exception messages

Match no_proxy rules against IPv4 hosts written in the shorthand a transport reads as an address

Hold the cURL easy handle out of the reuse pool until a silent retry has been dispatched

Treat a deferred resolved with a pending retry promise as progress when waiting on cURL transfers

8.0.3 - 2026-08-24

Changed

Adjusted guzzlehttp/psr7 version constraint to ^3.0.1

8.0.2 - 2026-08-05

Changed

Adjusted guzzlehttp/promises version constraint to ^3.0.1

Fixed

Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked

Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows

Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms

Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

8.0.1 - 2026-07-26

Security

... (truncated)

Commits

9393947 Release 8.2.0 (#3932)
cf54074 Merge branch '8.1' into 8.2
7ffed98 Update CHANGELOG.md
316a505 Allow connection caps with persistent sharing on libcurl 8.22+ (#3866)
6a7728d Merge remote-tracking branch 'origin/8.1' into 8.2
7b7b04a Adjust versions (#3931)
2cdae51 Bump versions (#3930)
2c2660b Merge remote-tracking branch 'origin/8.0' into 8.1
b690be7 Release 8.0.3
3ffe68d Adjusted guzzlehttp/psr7 version constraint to ^3.0.1 (#3929)
Additional commits viewable in compare view

Updates league/commonmark from 2.8.2 to 2.10.3

Release notes

Sourced from league/commonmark's releases.

2.10.3

Fixed

Fixed footnote links and backlinks pointing at the wrong anchor when footnote/footnote_id_prefix or footnote/ref_id_prefix contains an uppercase character; the configured prefix is now emitted verbatim in the href as it already was in the matching id (#524)

Fixed inline raw HTML tags being escaped when the tag name or an attribute name contains an uppercase letter, such as <svg viewBox="..."> or <Warning> (#1096)

2.10.2

This is a security release to address a denial of service vulnerability in the Table extension and a raw HTML filtering bypass in the DisallowedRawHtml extension.

Changed

Improved performance of parsing table delimiter rows and splitting table rows into cells by scanning bytes directly instead of stepping a Cursor (roughly 4x faster for delimiter rows and 6x for cell splitting, and more on multibyte rows)

Fixed

Fixed DisallowedRawHtmlRenderer not blocking raw HTML that ends with a disallowed tag name, such as a line containing only <script (GHSA-97jj-33gv-5xf9)

Fixed quadratic-time parsing of long paragraphs when the Table extension is enabled (GHSA-3q6v-r5mr-hxv8)

Fixed table detection to match the GFM spec and reference implementation:

Header rows no longer require a | character

Header rows must now have the same number of cells as the delimiter row (previously, fewer cells were accepted)

Full Changelog: thephpleague/commonmark@2.10.1...2.10.2

2.10.1

What's Changed

fix: accept unordered_list_markers config in InlinesOnlyExtension by @dualfroz in thephpleague/commonmark#1151

New Contributors

@dualfroz made their first contribution in thephpleague/commonmark#1151

Full Changelog: thephpleague/commonmark@2.10.0...2.10.1

2.10.0

This is a security release to address a denial of service vulnerability in the AttributesExtension.

Added

Added a new table_of_contents/max_placeholder_entries option to limit how many table of contents entries a document may render across all of its placeholders (#1134)

Added Cursor::matchInPlace(), which matches a regular expression at the cursor's position within the line using PCRE's native offset semantics instead of copying the remainder (#1145)

\G anchors at the cursor, ^ anchors at the start of the line, and lookbehinds and \b see the characters actually preceding the cursor; this keeps scanning loops linear and enables left-context assertions that match() cannot express

Added RegexHelper::PARTIAL_LINK_TITLE_UNANCHORED and RegexHelper::PARTIAL_LINK_DESTINATION_BRACES, unanchored fragments so each call site can supply its own anchor

Added a default_attributes configuration format which pairs the node attribute map with a new strict_callables option: ['default_attributes' => ['attributes' => [...], 'strict_callables' => true]]. With strict_callables enabled, only closures and invokable objects are treated as callbacks, so strings and arrays are always used as literal attribute values. Callbacks written as string or array callables can be wrapped with Closure::fromCallable(). The original format - passing the node map directly - is still accepted, and defaults strict_callables to false.

Added a new slug_normalizer/reserved option which treats the given slugs as already-used, so colliding headings receive an incremental numeric suffix just like duplicate headings do (#1080)

Changed

Changed the TableOfContents extension to render the table of contents once and share it across all placeholders instead of cloning it into each one (#1134)

A custom renderer registered for the TableOfContents node is no longer called once per placeholder, so it must return the same markup each time it is called for a given document (#1134)

The first placeholder receives the table of contents itself, so a document still contains a TableOfContents node for listeners which locate and reposition it (#1143)

$environment->getConfiguration()->get('default_attributes') now returns the normalized structure with attributes and strict_callables keys instead of the node map; read default_attributes/attributes to get the map. Configuration written in either format continues to work unchanged.

Deprecated

... (truncated)

Changelog

Sourced from league/commonmark's changelog.

[2.10.3] - 2026-09-21

Fixed

Fixed footnote links and backlinks pointing at the wrong anchor when footnote/footnote_id_prefix or footnote/ref_id_prefix contains an uppercase character; the configured prefix is now emitted verbatim in the href as it already was in the matching id (#524)

Fixed inline raw HTML tags being escaped when the tag name or an attribute name contains an uppercase letter, such as <svg viewBox="..."> or <Warning> (#1096)

[2.10.2] - 2026-09-21

This is a security release to address a denial of service vulnerability in the Table extension and a raw HTML filtering bypass in the DisallowedRawHtml extension.

Changed

Improved performance of parsing table delimiter rows and splitting table rows into cells by scanning bytes directly instead of stepping a Cursor (roughly 4x faster for delimiter rows and 6x for cell splitting, and more on multibyte rows)

Fixed

Fixed DisallowedRawHtmlRenderer not blocking raw HTML that ends with a disallowed tag name, such as a line containing only <script (GHSA-97jj-33gv-5xf9)

Fixed quadratic-time parsing of long paragraphs when the Table extension is enabled (GHSA-3q6v-r5mr-hxv8)

Fixed table detection to match the GFM spec and reference implementation:

Header rows no longer require a | character

Header rows must now have the same number of cells as the delimiter row (previously, fewer cells were accepted)

[2.10.1] - 2026-09-07

Fixed

Accept unordered_list_markers config in InlinesOnlyExtension (#1015, #1151)

[2.10.0] - 2026-08-11

This is a security release to address a denial of service vulnerability in the AttributesExtension.

Added

Added a new table_of_contents/max_placeholder_entries option to limit how many table of contents entries a document may render across all of its placeholders (#1134)

Added Cursor::matchInPlace(), which matches a regular expression at the cursor's position within the line using PCRE's native offset semantics instead of copying the remainder (#1145)

\G anchors at the cursor, ^ anchors at the start of the line, and lookbehinds and \b see the characters actually preceding the cursor; this keeps scanning loops linear and enables left-context assertions that match() cannot express

Added RegexHelper::PARTIAL_LINK_TITLE_UNANCHORED and RegexHelper::PARTIAL_LINK_DESTINATION_BRACES, unanchored fragments so each call site can supply its own anchor

Added a default_attributes configuration format which pairs the node attribute map with a new strict_callables option: ['default_attributes' => ['attributes' => [...], 'strict_callables' => true]]. With strict_callables enabled, only closures and invokable objects are treated as callbacks, so strings and arrays are always used as literal attribute values. Callbacks written as string or array callables can be wrapped with Closure::fromCallable(). The original format - passing the node map directly - is still accepted, and defaults strict_callables to false.

Added a new slug_normalizer/reserved option which treats the given slugs as already-used, so colliding headings receive an incremental numeric suffix just like duplicate headings do (#1080)

Changed

Changed the TableOfContents extension to render the table of contents once and share it across all placeholders instead of cloning it into each one (#1134)

A custom renderer registered for the TableOfContents node is no longer called once per placeholder, so it must return the same markup each time it is called for a given document (#1134)

The first placeholder receives the table of contents itself, so a document still contains a TableOfContents node for listeners which locate and reposition it (#1143)

$environment->getConfiguration()->get('default_attributes') now returns the normalized structure with attributes and strict_callables keys instead of the node map; read default_attributes/attributes to get the map. Configuration written in either format continues to work unchanged.

Deprecated

Deprecated RegexHelper::PARTIAL_LINK_TITLE and RegexHelper::REGEX_LINK_DESTINATION_BRACES; use the unanchored variants with an explicit anchor instead

Deprecated the default_attributes strict_callables option, which will be removed in 3.0 when only closures and invokable objects will ever be treated as callbacks.

Fixed

Fixed default_attributes values which happen to match the name of a PHP function - such as 'class' => 'link', 'header', 'key', 'range', or 'current' - being invoked as callbacks, producing errors like link() expects exactly 2 arguments, 1 given. Enable strict_callables to treat strings and arrays as literal attribute values (#1123)

Fixed the DefaultAttributesExtension re-testing every configured value with is_callable() once per matching node, which asked the autoloader whether the first element of each array value named a real class every single time

... (truncated)

Commits

6efbd9c Prepare to release 2.10.3
19b3037 case insensitive for HTML attributes (#1096)
053ebd3 Keep the configured footnote id prefixes out of the href lowercasing (#1153)
692e90b Prepare to release 2.10.2
411afcc Escape disallowed raw HTML tags that end the rendered output
b99b2b6 Scan table delimiter and cell rows as bytes
fc7e537 Match GFM table header detection
5f63680 Fix quadratic-time table start detection on long paragraphs
be378ba Document that allowed_domains only checks the Markdown URL (#1154)
276b7ab docs: clarify priority ordering behavior (#1152)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the composer group with 3 updates in the / directory: [laravel/framework](https://github.com/laravel/framework), [guzzlehttp/guzzle](https://github.com/guzzle/guzzle) and [league/commonmark](https://github.com/thephpleague/commonmark). Updates `laravel/framework` from 13.16.1 to 13.30.0 - [Release notes](https://github.com/laravel/framework/releases) - [Changelog](https://github.com/laravel/framework/blob/13.x/CHANGELOG.md) - [Commits](laravel/framework@v13.16.1...v13.30.0) Updates `guzzlehttp/guzzle` from 7.15.1 to 8.2.0 - [Release notes](https://github.com/guzzle/guzzle/releases) - [Changelog](https://github.com/guzzle/guzzle/blob/8.2/CHANGELOG.md) - [Commits](guzzle/guzzle@7.15.1...8.2.0) Updates `league/commonmark` from 2.8.2 to 2.10.3 - [Release notes](https://github.com/thephpleague/commonmark/releases) - [Changelog](https://github.com/thephpleague/commonmark/blob/2.10/CHANGELOG.md) - [Commits](thephpleague/commonmark@2.8.2...2.10.3) --- updated-dependencies: - dependency-name: laravel/framework dependency-version: 13.30.0 dependency-type: direct:production dependency-group: composer - dependency-name: guzzlehttp/guzzle dependency-version: 8.2.0 dependency-type: indirect dependency-group: composer - dependency-name: league/commonmark dependency-version: 2.10.3 dependency-type: indirect dependency-group: composer ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Sep 29, 2026

Navigation Menu

Repository navigation

build(deps): bump the composer group across 1 directory with 3 updates - #1

build(deps): bump the composer group across 1 directory with 3 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-30998dce12

dependabot Bot commented on behalf of github Sep 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 29, 2026

v13.30.0

v13.29.0

v13.27.0

v13.30.0 - 2026-09-01

v13.29.0 - 2026-08-25

v13.27.0 - 2026-08-25

8.2.0

Changed

8.1.0

Added

Changed

8.0.3

Changed

8.0.2

Changed

Fixed

8.0.1

Security

8.0.0

Added

8.2.0 - 2026-09-06

Changed

8.1.0 - 2026-08-24

Added

Changed

8.0.3 - 2026-08-24

Changed

8.0.2 - 2026-08-05

Changed

Fixed

8.0.1 - 2026-07-26

Security

2.10.3

Fixed

2.10.2

Changed

Fixed

2.10.1

What's Changed

New Contributors

2.10.0

Added

Changed

Deprecated

[2.10.3] - 2026-09-21

Fixed

[2.10.2] - 2026-09-21

Changed

Fixed

[2.10.1] - 2026-09-07

Fixed

[2.10.0] - 2026-08-11

Added

Changed

Deprecated

Fixed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants