Skip to content

build(deps): bump the maven group across 1 directory with 16 updates - #21

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/manager/maven-8e458f281e
Open

build(deps): bump the maven group across 1 directory with 16 updates#21
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/manager/maven-8e458f281e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the maven group with 16 updates in the /manager directory:

Package From To
gradle-wrapper 9.5.1 9.8.0
androidx.compose:compose-bom 2026.05.01 2026.09.00
androidx.compose.material3:material3 1.5.0-alpha22 1.5.0-alpha29
org.commonmark:commonmark 0.28.0 0.30.0
org.commonmark:commonmark-ext-gfm-tables 0.28.0 0.30.0
org.commonmark:commonmark-ext-gfm-strikethrough 0.28.0 0.30.0
org.commonmark:commonmark-ext-autolink 0.28.0 0.30.0
org.commonmark:commonmark-ext-task-list-items 0.28.0 0.30.0
org.commonmark:commonmark-ext-gfm-tables 0.28.0 0.30.0
org.commonmark:commonmark-ext-gfm-strikethrough 0.28.0 0.30.0
org.commonmark:commonmark-ext-autolink 0.28.0 0.30.0
org.commonmark:commonmark-ext-task-list-items 0.28.0 0.30.0
org.lsposed.libcxx:libcxx 29.0.14206865 30.0.16248370
com.squareup.okhttp3:okhttp-bom 5.3.2 5.5.0
com.materialkolor:material-kolor 5.0.0-alpha07 5.0.1
com.google.code.gson:gson 2.13.2 2.14.0
com.android.application 9.2.1 9.4.1
org.jetbrains.kotlin.android 2.4.0 2.4.20
org.jetbrains.kotlin.plugin.compose 2.4.0 2.4.20
org.jetbrains.kotlin.plugin.serialization 2.4.0 2.4.20
org.jetbrains.kotlin.plugin.compose 2.4.0 2.4.20
org.jetbrains.kotlin.plugin.serialization 2.4.0 2.4.20

Updates gradle-wrapper from 9.5.1 to 9.8.0

Release notes

Sourced from gradle-wrapper's releases.

9.8.0

The Gradle team is excited to announce Gradle 9.8.0.

Here are the highlights of this release:

  • Java 27 support
  • Maven mirror settings reuse
  • Linked problem locations in build output

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.0 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.0 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

9.8.0 RC3

The Gradle team is excited to announce Gradle 9.8.0 RC3.

Here are the highlights of this release:

... (truncated)

Commits
  • a927be5 Add the Develocity plugin back to the Android smoke tests (#39273)
  • eaee500 Add the Develocity plugin back to the Android smoke tests
  • 189b672 Route everything still hitting Maven Central through the mirror (#39257)
  • 36b1814 Add back mavenCentral to doc snippets
  • 2740c2d Update Gradle wrapper to version 9.8.0-rc-3 (#39264)
  • 2099383 Update Gradle wrapper to version 9.8.0-rc-3
  • c80202f Route everything still hitting Maven Central through the mirror
  • 3f6a534 Fix when a best practice was introduced (#39253)
  • 9efc9ed Fix when a best practice was introduced
  • 459e143 Route integration test dependencies through the repository mirror (#39239)
  • Additional commits viewable in compare view

Updates androidx.compose:compose-bom from 2026.05.01 to 2026.09.00

Updates androidx.compose.material3:material3 from 1.5.0-alpha22 to 1.5.0-alpha29

Updates org.commonmark:commonmark from 0.28.0 to 0.30.0

Release notes

Sourced from org.commonmark:commonmark's releases.

commonmark-java 0.30.0

Added

  • New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
  • YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

  • Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
  • The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
  • Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

  • Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
    • Inline HTML like "x <!--".repeat(100_000) (#447)
    • Autolink starts like "<".repeat(100_000)
    • Emphasis like "a**b" + "c* ".repeat(100_000)
    • Backticks runs of different lengths
  • Fix stack overflow errors when parsing pathological inputs with repeated syntax:
    • HTML block attributes
    • Autolink email addresses
    • Deeply nested emphasis
  • Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/HEAD/n) + "x" + "](u)".repeat(n)
  • YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)

commonmark-java 0.29.0

Added

  • Support rendering GFM task list items to Markdown (#433)
  • Support rendering YAML front matter to Markdown (#434)
  • Alerts
    • Allow customizing HTML attributes for alert title <p> tag via AttributeProvider (#427)
    • New configuration for AlertsExtension to allow authors to provide custom titles per alert. See the custom titles section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow alerts to be nested within other blocks (including other alerts). See this section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow the set of alert types (including standard GFM types) to be completely overwritten. (#435)

... (truncated)

Changelog

Sourced from org.commonmark:commonmark's changelog.

[0.30.0] - 2026-08-06

Added

  • New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
  • YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

  • Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
  • The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
  • Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

  • Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
    • Inline HTML like "x <!--".repeat(100_000) (#447)
    • Autolink starts like "<".repeat(100_000)
    • Emphasis like "a**b" + "c* ".repeat(100_000)
    • Backticks runs of different lengths
  • Fix stack overflow errors when parsing pathological inputs with repeated syntax:
    • HTML block attributes
    • Autolink email addresses
    • Deeply nested emphasis
  • Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/main/n) + "x" + "](u)".repeat(n)
  • YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)

[0.29.0] - 2026-06-20

Added

  • Support rendering GFM task list items to Markdown (#433)
  • Support rendering YAML front matter to Markdown (#434)
  • Alerts
    • Allow customizing HTML attributes for alert title <p> tag via AttributeProvider (#427)
    • New configuration for AlertsExtension to allow authors to provide custom titles per alert. See the custom titles section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow alerts to be nested within other blocks (including other alerts). See this section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow the set of alert types (including standard GFM types) to be completely overwritten. (#435)

... (truncated)

Commits
  • 64037cf [maven-release-plugin] prepare release commonmark-parent-0.30.0
  • bd3e066 Fix Javadoc
  • 4aaf754 mvn versions:set -DnewVersion=0.30.0-SNAPSHOT
  • 42b4fb7 Prepare CHANGELOG for version 0.30.0
  • b76e09d Limit how deep inline nodes may nest by default (100)
  • 49f65cb Fix StackOverflowError when parsing deeply nested emphasis
  • 610f84b Fix StackOverflowError when parsing pathological autolink email addresses
  • 9f1d738 Fix StackOverflowError when parsing pathological HTML block attributes
  • e13297e Fix quadratic runtime when parsing pathological backticks
  • 89d1bd3 Fix quadratic runtime when parsing with lots of <
  • Additional commits viewable in compare view

Updates org.commonmark:commonmark-ext-gfm-tables from 0.28.0 to 0.30.0

Release notes

Sourced from org.commonmark:commonmark-ext-gfm-tables's releases.

commonmark-java 0.30.0

Added

  • New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
  • YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

  • Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
  • The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
  • Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

  • Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
    • Inline HTML like "x <!--".repeat(100_000) (#447)
    • Autolink starts like "<".repeat(100_000)
    • Emphasis like "a**b" + "c* ".repeat(100_000)
    • Backticks runs of different lengths
  • Fix stack overflow errors when parsing pathological inputs with repeated syntax:
    • HTML block attributes
    • Autolink email addresses
    • Deeply nested emphasis
  • Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/HEAD/n) + "x" + "](u)".repeat(n)
  • YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)

commonmark-java 0.29.0

Added

  • Support rendering GFM task list items to Markdown (#433)
  • Support rendering YAML front matter to Markdown (#434)
  • Alerts
    • Allow customizing HTML attributes for alert title <p> tag via AttributeProvider (#427)
    • New configuration for AlertsExtension to allow authors to provide custom titles per alert. See the custom titles section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow alerts to be nested within other blocks (including other alerts). See this section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow the set of alert types (including standard GFM types) to be completely overwritten. (#435)

... (truncated)

Changelog

Sourced from org.commonmark:commonmark-ext-gfm-tables's changelog.

[0.30.0] - 2026-08-06

Added

  • New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
  • YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

  • Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
  • The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
  • Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

  • Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
    • Inline HTML like "x <!--".repeat(100_000) (#447)
    • Autolink starts like "<".repeat(100_000)
    • Emphasis like "a**b" + "c* ".repeat(100_000)
    • Backticks runs of different lengths
  • Fix stack overflow errors when parsing pathological inputs with repeated syntax:
    • HTML block attributes
    • Autolink email addresses
    • Deeply nested emphasis
  • Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/main/n) + "x" + "](u)".repeat(n)
  • YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)

[0.29.0] - 2026-06-20

Added

  • Support rendering GFM task list items to Markdown (#433)
  • Support rendering YAML front matter to Markdown (#434)
  • Alerts
    • Allow customizing HTML attributes for alert title <p> tag via AttributeProvider (#427)
    • New configuration for AlertsExtension to allow authors to provide custom titles per alert. See the custom titles section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow alerts to be nested within other blocks (including other alerts). See this section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow the set of alert types (including standard GFM types) to be completely overwritten. (#435)

... (truncated)

Commits
  • 64037cf [maven-release-plugin] prepare release commonmark-parent-0.30.0
  • bd3e066 Fix Javadoc
  • 4aaf754 mvn versions:set -DnewVersion=0.30.0-SNAPSHOT
  • 42b4fb7 Prepare CHANGELOG for version 0.30.0
  • b76e09d Limit how deep inline nodes may nest by default (100)
  • 49f65cb Fix StackOverflowError when parsing deeply nested emphasis
  • 610f84b Fix StackOverflowError when parsing pathological autolink email addresses
  • 9f1d738 Fix StackOverflowError when parsing pathological HTML block attributes
  • e13297e Fix quadratic runtime when parsing pathological backticks
  • 89d1bd3 Fix quadratic runtime when parsing with lots of <
  • Additional commits viewable in compare view

Updates org.commonmark:commonmark-ext-gfm-strikethrough from 0.28.0 to 0.30.0

Release notes

Sourced from org.commonmark:commonmark-ext-gfm-strikethrough's releases.

commonmark-java 0.30.0

Added

  • New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
  • YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

  • Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
  • The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
  • Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

  • Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
    • Inline HTML like "x <!--".repeat(100_000) (#447)
    • Autolink starts like "<".repeat(100_000)
    • Emphasis like "a**b" + "c* ".repeat(100_000)
    • Backticks runs of different lengths
  • Fix stack overflow errors when parsing pathological inputs with repeated syntax:
    • HTML block attributes
    • Autolink email addresses
    • Deeply nested emphasis
  • Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/HEAD/n) + "x" + "](u)".repeat(n)
  • YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)

commonmark-java 0.29.0

Added

  • Support rendering GFM task list items to Markdown (#433)
  • Support rendering YAML front matter to Markdown (#434)
  • Alerts
    • Allow customizing HTML attributes for alert title <p> tag via AttributeProvider (#427)
    • New configuration for AlertsExtension to allow authors to provide custom titles per alert. See the custom titles section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow alerts to be nested within other blocks (including other alerts). See this section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow the set of alert types (including standard GFM types) to be completely overwritten. (#435)

... (truncated)

Changelog

Sourced from org.commonmark:commonmark-ext-gfm-strikethrough's changelog.

[0.30.0] - 2026-08-06

Added

  • New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
  • YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

  • Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
  • The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
  • Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

  • Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
    • Inline HTML like "x <!--".repeat(100_000) (#447)
    • Autolink starts like "<".repeat(100_000)
    • Emphasis like "a**b" + "c* ".repeat(100_000)
    • Backticks runs of different lengths
  • Fix stack overflow errors when parsing pathological inputs with repeated syntax:
    • HTML block attributes
    • Autolink email addresses
    • Deeply nested emphasis
  • Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/main/n) + "x" + "](u)".repeat(n)
  • YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)

[0.29.0] - 2026-06-20

Added

  • Support rendering GFM task list items to Markdown (#433)
  • Support rendering YAML front matter to Markdown (#434)
  • Alerts
    • Allow customizing HTML attributes for alert title <p> tag via AttributeProvider (#427)
    • New configuration for AlertsExtension to allow authors to provide custom titles per alert. See the custom titles section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow alerts to be nested within other blocks (including other alerts). See this section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow the set of alert types (including standard GFM types) to be completely overwritten. (#435)

... (truncated)

Commits
  • 64037cf [maven-release-plugin] prepare release commonmark-parent-0.30.0
  • bd3e066 Fix Javadoc
  • 4aaf754 mvn versions:set -DnewVersion=0.30.0-SNAPSHOT
  • 42b4fb7 Prepare CHANGELOG for version 0.30.0
  • b76e09d Limit how deep inline nodes may nest by default (100)
  • 49f65cb Fix StackOverflowError when parsing deeply nested emphasis
  • 610f84b Fix StackOverflowError when parsing pathological autolink email addresses
  • 9f1d738 Fix StackOverflowError when parsing pathological HTML block attributes
  • e13297e Fix quadratic runtime when parsing pathological backticks
  • 89d1bd3 Fix quadratic runtime when parsing with lots of <
  • Additional commits viewable in compare view

Updates org.commonmark:commonmark-ext-autolink from 0.28.0 to 0.30.0

Release notes

Sourced from org.commonmark:commonmark-ext-autolink's releases.

commonmark-java 0.30.0

Added

  • New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
  • YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

  • Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
  • The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
  • Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

  • Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
    • Inline HTML like "x <!--".repeat(100_000) (#447)
    • Autolink starts like "<".repeat(100_000)
    • Emphasis like "a**b" + "c* ".repeat(100_000)
    • Backticks runs of different lengths
  • Fix stack overflow errors when parsing pathological inputs with repeated syntax:
    • HTML block attributes
    • Autolink email addresses
    • Deeply nested emphasis
  • Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/HEAD/n) + "x" + "](u)".repeat(n)
  • YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)

commonmark-java 0.29.0

Added

  • Support rendering GFM task list items to Markdown (#433)
  • Support rendering YAML front matter to Markdown (#434)
  • Alerts
    • Allow customizing HTML attributes for alert title <p> tag via AttributeProvider (#427)
    • New configuration for AlertsExtension to allow authors to provide custom titles per alert. See the custom titles section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow alerts to be nested within other blocks (including other alerts). See this section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow the set of alert types (including standard GFM types) to be completely overwritten. (#435)

... (truncated)

Changelog

Sourced from org.commonmark:commonmark-ext-autolink's changelog.

[0.30.0] - 2026-08-06

Added

  • New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
  • YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

  • Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
  • The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
  • Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

  • Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
    • Inline HTML like "x <!--".repeat(100_000) (#447)
    • Autolink starts like "<".repeat(100_000)
    • Emphasis like "a**b" + "c* ".repeat(100_000)
    • Backticks runs of different lengths
  • Fix stack overflow errors when parsing pathological inputs with repeated syntax:
    • HTML block attributes
    • Autolink email addresses
    • Deeply nested emphasis
  • Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/main/n) + "x" + "](u)".repeat(n)
  • YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)

[0.29.0] - 2026-06-20

Added

  • Support rendering GFM task list items to Markdown (#433)
  • Support rendering YAML front matter to Markdown (#434)
  • Alerts
    • Allow customizing HTML attributes for alert title <p> tag via AttributeProvider (#427)
    • New configuration for AlertsExtension to allow authors to provide custom titles per alert. See the custom titles section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow alerts to be nested within other blocks (including other alerts). See this section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow the set of alert types (including standard GFM types) to be completely overwritten. (#435)

... (truncated)

Commits
  • 64037cf [maven-release-plugin] prepare release commonmark-parent-0.30.0
  • bd3e066 Fix Javadoc
  • 4aaf754 mvn versions:set -DnewVersion=0.30.0-SNAPSHOT
  • 42b4fb7 Prepare CHANGELOG for version 0.30.0
  • b76e09d Limit how deep inline nodes may nest by default (100)
  • 49f65cb Fix StackOverflowError when parsing deeply nested emphasis
  • 610f84b Fix StackOverflowError when parsing pathological autolink email addresses
  • 9f1d738 Fix StackOverflowError when parsing pathological HTML block attributes
  • e13297e Fix quadratic runtime when parsing pathological backticks
  • 89d1bd3 Fix quadratic runtime when parsing with lots of <
  • Additional commits viewable in compare view

Updates org.commonmark:commonmark-ext-task-list-items from 0.28.0 to 0.30.0

Release notes

Sourced from org.commonmark:commonmark-ext-task-list-items's releases.

commonmark-java 0.30.0

Added

  • New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
  • YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

  • Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
  • The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
  • Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

  • Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
    • Inline HTML like "x <!--".repeat(100_000) (#447)
    • Autolink starts like "<".repeat(100_000)
    • Emphasis like "a**b" + "c* ".repeat(100_000)
    • Backticks runs of different lengths
  • Fix stack overflow errors when parsing pathological inputs with repeated syntax:
    • HTML block attributes
    • Autolink email addresses
    • Deeply nested emphasis
  • Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/HEAD/n) + "x" + "](u)".repeat(n)
  • YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)

commonmark-java 0.29.0

Added

  • Support rendering GFM task list items to Markdown (#433)
  • Support rendering YAML front matter to Markdown (#434)
  • Alerts
    • Allow customizing HTML attributes for alert title <p> tag via AttributeProvider (#427)
    • New configuration for AlertsExtension to allow authors to provide custom titles per alert. See the custom titles section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow alerts to be nested within other blocks (including other alerts). See this section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow the set of alert types (including standard GFM types) to be completely overwritten. (#435)

... (truncated)

Changelog

Sourced from org.commonmark:commonmark-ext-task-list-items's changelog.

[0.30.0] - 2026-08-06

Added

  • New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
  • YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

  • Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
  • The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
  • Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

  • Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
    • Inline HTML like "x <!--".repeat(100_000) (#447)
    • Autolink starts like "<".repeat(100_000)
    • Emphasis like "a**b" + "c* ".repeat(100_000)
    • Backticks runs of different lengths
  • Fix stack overflow errors when parsing pathological inputs with repeated syntax:
    • HTML block attributes
    • Autolink email addresses
    • Deeply nested emphasis
  • Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/main/n) + "x" + "](u)".repeat(n)
  • YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)

[0.29.0] - 2026-06-20

Added

  • Support rendering GFM task list items to Markdown (#433)
  • Support rendering YAML front matter to Markdown (#434)
  • Alerts
    • Allow customizing HTML attributes for alert title <p> tag via AttributeProvider (#427)
    • New configuration for AlertsExtension to allow authors to provide custom titles per alert. See the custom titles section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow alerts to be nested within other blocks (including other alerts). See this section of the alerts README for more information. (#430)
    • New configuration for AlertsExtension to allow the set of alert types (including standard GFM types) to be completely overwritten. (#435)

... (truncated)

Commits
  • 64037cf [maven-release-plugin] prepare release commonmark-parent-0.30.0
  • bd3e066 Fix Javadoc
  • 4aaf754 mvn versions:set -DnewVersion=0.30.0-SNAPSHOT
  • 42b4fb7 Prepare CHANGELOG for version 0.30.0
  • b76e09d Limit how deep inline nodes may nest by default (100)
  • 49f65cb Fix StackOverflowError when parsing deeply nested emphasis
  • 610f84b Fix StackOverflowError when parsing pathological autoli...

    Description has been truncated

@dependabot
build(deps): bump the maven group across 1 directory with 16 updates
80d72e0 
Bumps the maven group with 16 updates in the /manager directory:

| Package | From | To |
| --- | --- | --- |
| [gradle-wrapper](https://github.com/gradle/gradle) | `9.5.1` | `9.8.0` |
| androidx.compose:compose-bom | `2026.05.01` | `2026.09.00` |
| androidx.compose.material3:material3 | `1.5.0-alpha22` | `1.5.0-alpha29` |
| [org.commonmark:commonmark](https://github.com/commonmark/commonmark-java) | `0.28.0` | `0.30.0` |
| [org.commonmark:commonmark-ext-gfm-tables](https://github.com/commonmark/commonmark-java) | `0.28.0` | `0.30.0` |
| [org.commonmark:commonmark-ext-gfm-strikethrough](https://github.com/commonmark/commonmark-java) | `0.28.0` | `0.30.0` |
| [org.commonmark:commonmark-ext-autolink](https://github.com/commonmark/commonmark-java) | `0.28.0` | `0.30.0` |
| [org.commonmark:commonmark-ext-task-list-items](https://github.com/commonmark/commonmark-java) | `0.28.0` | `0.30.0` |
| [org.commonmark:commonmark-ext-gfm-tables](https://github.com/commonmark/commonmark-java) | `0.28.0` | `0.30.0` |
| [org.commonmark:commonmark-ext-gfm-strikethrough](https://github.com/commonmark/commonmark-java) | `0.28.0` | `0.30.0` |
| [org.commonmark:commonmark-ext-autolink](https://github.com/commonmark/commonmark-java) | `0.28.0` | `0.30.0` |
| [org.commonmark:commonmark-ext-task-list-items](https://github.com/commonmark/commonmark-java) | `0.28.0` | `0.30.0` |
| [org.lsposed.libcxx:libcxx](https://github.com/LSPosed/prefab-libcxx) | `29.0.14206865` | `30.0.16248370` |
| [com.squareup.okhttp3:okhttp-bom](https://github.com/lysine-dev/okhttp) | `5.3.2` | `5.5.0` |
| [com.materialkolor:material-kolor](https://github.com/jordond/materialkolor) | `5.0.0-alpha07` | `5.0.1` |
| [com.google.code.gson:gson](https://github.com/google/gson) | `2.13.2` | `2.14.0` |
| com.android.application | `9.2.1` | `9.4.1` |
| [org.jetbrains.kotlin.android](https://github.com/JetBrains/kotlin) | `2.4.0` | `2.4.20` |
| [org.jetbrains.kotlin.plugin.compose](https://github.com/JetBrains/kotlin) | `2.4.0` | `2.4.20` |
| [org.jetbrains.kotlin.plugin.serialization](https://github.com/JetBrains/kotlin) | `2.4.0` | `2.4.20` |
| [org.jetbrains.kotlin.plugin.compose](https://github.com/JetBrains/kotlin) | `2.4.0` | `2.4.20` |
| [org.jetbrains.kotlin.plugin.serialization](https://github.com/JetBrains/kotlin) | `2.4.0` | `2.4.20` |



Updates `gradle-wrapper` from 9.5.1 to 9.8.0
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v9.5.1...v9.8.0)

Updates `androidx.compose:compose-bom` from 2026.05.01 to 2026.09.00

Updates `androidx.compose.material3:material3` from 1.5.0-alpha22 to 1.5.0-alpha29

Updates `org.commonmark:commonmark` from 0.28.0 to 0.30.0
- [Release notes](https://github.com/commonmark/commonmark-java/releases)
- [Changelog](https://github.com/commonmark/commonmark-java/blob/main/CHANGELOG.md)
- [Commits](commonmark/commonmark-java@commonmark-parent-0.28.0...commonmark-parent-0.30.0)

Updates `org.commonmark:commonmark-ext-gfm-tables` from 0.28.0 to 0.30.0
- [Release notes](https://github.com/commonmark/commonmark-java/releases)
- [Changelog](https://github.com/commonmark/commonmark-java/blob/main/CHANGELOG.md)
- [Commits](commonmark/commonmark-java@commonmark-parent-0.28.0...commonmark-parent-0.30.0)

Updates `org.commonmark:commonmark-ext-gfm-strikethrough` from 0.28.0 to 0.30.0
- [Release notes](https://github.com/commonmark/commonmark-java/releases)
- [Changelog](https://github.com/commonmark/commonmark-java/blob/main/CHANGELOG.md)
- [Commits](commonmark/commonmark-java@commonmark-parent-0.28.0...commonmark-parent-0.30.0)

Updates `org.commonmark:commonmark-ext-autolink` from 0.28.0 to 0.30.0
- [Release notes](https://github.com/commonmark/commonmark-java/releases)
- [Changelog](https://github.com/commonmark/commonmark-java/blob/main/CHANGELOG.md)
- [Commits](commonmark/commonmark-java@commonmark-parent-0.28.0...commonmark-parent-0.30.0)

Updates `org.commonmark:commonmark-ext-task-list-items` from 0.28.0 to 0.30.0
- [Release notes](https://github.com/commonmark/commonmark-java/releases)
- [Changelog](https://github.com/commonmark/commonmark-java/blob/main/CHANGELOG.md)
- [Commits](commonmark/commonmark-java@commonmark-parent-0.28.0...commonmark-parent-0.30.0)

Updates `org.commonmark:commonmark-ext-gfm-tables` from 0.28.0 to 0.30.0
- [Release notes](https://github.com/commonmark/commonmark-java/releases)
- [Changelog](https://github.com/commonmark/commonmark-java/blob/main/CHANGELOG.md)
- [Commits](commonmark/commonmark-java@commonmark-parent-0.28.0...commonmark-parent-0.30.0)

Updates `org.commonmark:commonmark-ext-gfm-strikethrough` from 0.28.0 to 0.30.0
- [Release notes](https://github.com/commonmark/commonmark-java/releases)
- [Changelog](https://github.com/commonmark/commonmark-java/blob/main/CHANGELOG.md)
- [Commits](commonmark/commonmark-java@commonmark-parent-0.28.0...commonmark-parent-0.30.0)

Updates `org.commonmark:commonmark-ext-autolink` from 0.28.0 to 0.30.0
- [Release notes](https://github.com/commonmark/commonmark-java/releases)
- [Changelog](https://github.com/commonmark/commonmark-java/blob/main/CHANGELOG.md)
- [Commits](commonmark/commonmark-java@commonmark-parent-0.28.0...commonmark-parent-0.30.0)

Updates `org.commonmark:commonmark-ext-task-list-items` from 0.28.0 to 0.30.0
- [Release notes](https://github.com/commonmark/commonmark-java/releases)
- [Changelog](https://github.com/commonmark/commonmark-java/blob/main/CHANGELOG.md)
- [Commits](commonmark/commonmark-java@commonmark-parent-0.28.0...commonmark-parent-0.30.0)

Updates `org.lsposed.libcxx:libcxx` from 29.0.14206865 to 30.0.16248370
- [Commits](https://github.com/LSPosed/prefab-libcxx/commits)

Updates `com.squareup.okhttp3:okhttp-bom` from 5.3.2 to 5.5.0
- [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-5.3.2...parent-5.5.0)

Updates `com.materialkolor:material-kolor` from 5.0.0-alpha07 to 5.0.1
- [Release notes](https://github.com/jordond/materialkolor/releases)
- [Commits](jordond/MaterialKolor@5.0.0-alpha07...5.0.1)

Updates `com.google.code.gson:gson` from 2.13.2 to 2.14.0
- [Release notes](https://github.com/google/gson/releases)
- [Changelog](https://github.com/google/gson/blob/main/CHANGELOG.md)
- [Commits](google/gson@gson-parent-2.13.2...gson-parent-2.14.0)

Updates `com.android.application` from 9.2.1 to 9.4.1

Updates `org.jetbrains.kotlin.android` from 2.4.0 to 2.4.20
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.0...v2.4.20)

Updates `org.jetbrains.kotlin.plugin.compose` from 2.4.0 to 2.4.20
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.0...v2.4.20)

Updates `org.jetbrains.kotlin.plugin.serialization` from 2.4.0 to 2.4.20
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.0...v2.4.20)

Updates `org.jetbrains.kotlin.plugin.compose` from 2.4.0 to 2.4.20
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.0...v2.4.20)

Updates `org.jetbrains.kotlin.plugin.serialization` from 2.4.0 to 2.4.20
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.0...v2.4.20)

---
updated-dependencies:
- dependency-name: gradle-wrapper
  dependency-version: 9.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven
- dependency-name: androidx.compose:compose-bom
  dependency-version: 2026.09.00
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: androidx.compose.material3:material3
  dependency-version: 1.5.0-alpha29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven
- dependency-name: org.commonmark:commonmark
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven
- dependency-name: org.commonmark:commonmark-ext-gfm-tables
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven
- dependency-name: org.commonmark:commonmark-ext-gfm-strikethrough
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven
- dependency-name: org.commonmark:commonmark-ext-autolink
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven
- dependency-name: org.commonmark:commonmark-ext-task-list-items
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven
- dependency-name: org.commonmark:commonmark-ext-gfm-tables
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven
- dependency-name: org.commonmark:commonmark-ext-gfm-strikethrough
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven
- dependency-name: org.commonmark:commonmark-ext-autolink
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven
- dependency-name: org.commonmark:commonmark-ext-task-list-items
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven
- dependency-name: org.lsposed.libcxx:libcxx
  dependency-version: 30.0.16248370
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: maven
- dependency-name: com.squareup.okhttp3:okhttp-bom
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven
- dependency-name: com.materialkolor:material-kolor
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven
- dependency-name: com.google.code.gson:gson
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven
- dependency-name: com.android.application
  dependency-version: 9.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven
- dependency-name: org.jetbrains.kotlin.android
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven
- dependency-name: org.jetbrains.kotlin.plugin.compose
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven
- dependency-name: org.jetbrains.kotlin.plugin.serialization
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven
- dependency-name: org.jetbrains.kotlin.plugin.compose
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven
- dependency-name: org.jetbrains.kotlin.plugin.serialization
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Sep 30, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants