[dependabot]

Bumps league/commonmark from 2.10.4 to 2.10.6.

Release notes

Sourced from league/commonmark's releases.

2.10.6

Fixed

• Fixed ExternalLinkExtension not treating some links as external when browsers would navigate to an external host, such as https:///example.com, http:example.com, or ///example.com; hosts are now determined the way browsers do (#1169)

2.10.5

Fixed

• Fixed link reference definitions keeping a partially parsed title when the title on the following line is never closed or is followed by other text; the definition now has no title, as the spec requires (#1162)
• Fixed task list items being recognized when the [ ] or [x] marker is directly followed by other content (- [x]done); the GFM spec requires whitespace after the marker (#1164)
• Fixed the content indentation of a list item whose content is a single character after two to four spaces (- a): it was computed as if one space followed the marker, so the next line could be read as part of the item, nesting a following item inside it (#1163)
• Fixed a table inside a block quote or list item absorbing the lines that follow it as table rows when those lines are lazy continuation lines (not prefixed with > or indented); they now end the container as in GitHub's cmark-gfm (#1165)
• Fixed link reference definitions accepting an unescaped ( inside a parenthesized title (#1168)

Changelog

Sourced from league/commonmark's changelog.

[2.10.6] - 2026-10-30

Fixed

• Fixed ExternalLinkExtension not treating some links as external when browsers would navigate to an external host, such as https:///example.com, http:example.com, or ///example.com; hosts are now determined the way browsers do (#1169)

[2.10.5] - 2026-10-30

Fixed

• Fixed link reference definitions keeping a partially parsed title when the title on the following line is never closed or is followed by other text; the definition now has no title, as the spec requires (#1162)
• Fixed task list items being recognized when the [ ] or [x] marker is directly followed by other content (- [x]done); the GFM spec requires whitespace after the marker (#1164)
• Fixed the content indentation of a list item whose content is a single character after two to four spaces (- a): it was computed as if one space followed the marker, so the next line could be read as part of the item, nesting a following item inside it (#1163)
• Fixed a table inside a block quote or list item absorbing the lines that follow it as table rows when those lines are lazy continuation lines (not prefixed with > or indented); they now end the container as in GitHub's cmark-gfm (#1165)
• Fixed link reference definitions accepting an unescaped ( inside a parenthesized title (#1168)

Commits

• cb3d6a5 Prepare to release 2.10.6
• e4e5339 Find external link hosts the way browsers do (#1169)
• 6d6ed04 Prepare to release 2.10.5
• f292c64 Reject an unescaped ( in a parenthesized reference definition title (#1168)
• baa5b10 Do not add lazy continuation lines to a table inside a container (#1165)
• 67ce8b3 Fix the list item padding for single-character content (#1163)
• 5bddd73 Require whitespace after a task list item marker (#1164)
• de6e417 Drop a link reference definition title that fails to parse (#1162)
• 58b3222 Fix intermittent docs deploy failures (#1167)
• b2a68f6 Point security reports to the security policy and drop the personal email (#1...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #553.