[stable-8] Bump league/commonmark from 2.8.0 to 2.8.2

[dependabot]

Bumps league/commonmark from 2.8.0 to 2.8.2.

Release notes

Sourced from league/commonmark's releases.

2.8.2

This is a security release to address an issue where the allowed_domains setting for the Embed extension can be bypassed, resulting in a possible SSRF and XSS vulnerabilities.

Fixed

• Fixed DomainFilteringAdapter hostname boundary bypass where domains like youtube.com.evil could match an allowlist entry for youtube.com (GHSA-hh8v-hgvp-g3f5)

Full Changelog: thephpleague/commonmark@2.8.1...2.8.2

2.8.1

What's Changed

This is a security release to address an issue where DisallowedRawHtml can be bypassed, resulting in a possible cross-site scripting (XSS) vulnerability.

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML tags with trailing ASCII whitespace (GHSA-4v6x-c7xx-hw9f)
• Fixed PHP 8.5 deprecation (#1107)

New Contributors

• @​Kocal made their first contribution in thephpleague/commonmark#1106
• @​freost made their first contribution in thephpleague/commonmark#1107

Full Changelog: thephpleague/commonmark@2.8.0...2.8.1

Changelog

Sourced from league/commonmark's changelog.

[2.8.2] - 2026-03-19

This is a security release to address an issue where the allowed_domains setting for the Embed extension can be bypassed, resulting in a possible SSRF and XSS vulnerabilities.

Fixed

• Fixed DomainFilteringAdapter hostname boundary bypass where domains like youtube.com.evil could match an allowlist entry for youtube.com (GHSA-hh8v-hgvp-g3f5)

[2.8.1] - 2026-03-05

This is a security release to address an issue where DisallowedRawHtml can be bypassed, resulting in a possible cross-site scripting (XSS) vulnerability.

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML tags with trailing ASCII whitespace (GHSA-4v6x-c7xx-hw9f)
• Fixed PHP 8.5 deprecation (#1107)

Commits

• 59fb075 Fix DomainFilteringAdapter hostname boundary bypass
• 74b4487 Document dangers of enabling an unsafe php.ini setting
• 84b1ca4 Almost forgot this entry
• bcf54f5 Merge commit from fork
• 7a68ed1 Prepare to release 2.8.1
• 5c0c4c8 Fix DisallowedRawHtml bypass via newline/tab in tag names
• f6e7443 Add regression test
• 0719b67 Merge pull request #1107 from freost/fix-php85-deprecation-error
• 63ff2e0 Fix PHP 8.5 deprecation
• 8608e9c Merge pull request #1106 from Kocal/patch-1
• Additional commits viewable in compare view

[dartcafe]

@dependabot recreate