From b570879fb2e16b90eb780dd177dcffd1eee5401d Mon Sep 17 00:00:00 2001
From: Demian <demian@backtocode.nl>
Date: Sat, 8 Aug 2026 13:28:51 +0200
Subject: [PATCH] =?UTF-8?q?chore(deps):=20league/commonmark=202.8.3=20->?=
 =?UTF-8?q?=202.9.0=20=E2=80=94=20clear=20composer=20audit?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Six advisories (2 CVEs + DoS PKSAs, all <2.9.0) published 2026-08-06 fail
the Audit dependencies step, which runs before format/test and kills every
CI leg repo-wide on an unchanged lock. Transitive dev dependency; 2.9.0
require set is identical to 2.8.3. Lock-only bump (version + zipball ref),
verified against packagist metadata.
---
 composer.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/composer.lock b/composer.lock
index bd8d948..7938f91 100644
--- a/composer.lock
+++ b/composer.lock
@@ -1217,16 +1217,16 @@
         },
         {
             "name": "league/commonmark",
-            "version": "2.8.3",
+            "version": "2.9.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/thephpleague/commonmark.git",
-                "reference": "1902f60f984235023acbe03db6ad614a37b3c3e7"
+                "reference": "5703d83ba3da3b2e356a5fedc848ed6d8ffb6529"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/1902f60f984235023acbe03db6ad614a37b3c3e7",
-                "reference": "1902f60f984235023acbe03db6ad614a37b3c3e7",
+                "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/5703d83ba3da3b2e356a5fedc848ed6d8ffb6529",
+                "reference": "5703d83ba3da3b2e356a5fedc848ed6d8ffb6529",
                 "shasum": ""
             },
             "require": {