dependabot[bot] opened a new pull request, #25658: URL: https://github.com/apache/camel/pull/25658
Bumps [org.commonmark:commonmark](https://github.com/commonmark/commonmark-java) from 0.29.0 to 0.30.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/commonmark/commonmark-java/releases";>org.commonmark:commonmark's releases</a>.</em></p> <blockquote> <h2>commonmark-java 0.30.0</h2> <h3>Added</h3> <ul> <li>New option <code>lineSeparator</code> for <code>MarkdownRenderer.Builder</code> to change the default line separator from <code>\n</code> (e.g. to <code>\r\n</code>) (<a href="https://redirect.github.com/commonmark/commonmark-java/issues/442";>#442</a>)</li> <li>YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (<a href="https://redirect.github.com/commonmark/commonmark-java/issues/391";>#391</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Tables extension: Limit max number of parsed table cells by default (1 million cells), see option <code>maxCells</code> in <code>TablesExtension.Builder</code>. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.</li> <li>The default for <code>maxOpenBlockParsers</code> for <code>Parser.Builder</code> is now 100; configure the option to remove the limit.</li> <li>Limit how deeply inline nodes may nest by default (100), see option <code>maxInlineNesting</code> in <code>Parser.Builder</code>; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. <code>*</code> or the ins extension's <code>+</code>) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.</li> </ul> <h3>Fixed</h3> <ul> <li>Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished): <ul> <li>Inline HTML like <code>"x <!--".repeat(100_000)</code> (<a href="https://redirect.github.com/commonmark/commonmark-java/issues/447";>#447</a>)</li> <li>Autolink starts like <code>"<".repeat(100_000)</code></li> <li>Emphasis like <code>"a**b" + "c* ".repeat(100_000)</code></li> <li>Backticks runs of different lengths</li> </ul> </li> <li>Fix stack overflow errors when parsing pathological inputs with repeated syntax: <ul> <li>HTML block attributes</li> <li>Autolink email addresses</li> <li>Deeply nested emphasis</li> </ul> </li> <li>Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see <code>maxInlineNesting</code> above). This can happen with emphasis, e.g. <code>"*".repeat(n) + "x" + "*".repeat(n)</code> or <code>"*a ".repeat(n) + " b*".repeat(n)</code>, as well as with images, e.g. <code>"".repeat(n)</code></li> <li>YAML front matter extension: Fix inefficient string concatenation for literal-block values (<code>|</code>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/commonmark/commonmark-java/blob/main/CHANGELOG.md";>org.commonmark:commonmark's changelog</a>.</em></p> <blockquote> <h2>[0.30.0] - 2026-08-06</h2> <h3>Added</h3> <ul> <li>New option <code>lineSeparator</code> for <code>MarkdownRenderer.Builder</code> to change the default line separator from <code>\n</code> (e.g. to <code>\r\n</code>) (<a href="https://redirect.github.com/commonmark/commonmark-java/issues/442";>#442</a>)</li> <li>YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (<a href="https://redirect.github.com/commonmark/commonmark-java/issues/391";>#391</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Tables extension: Limit max number of parsed table cells by default (1 million cells), see option <code>maxCells</code> in <code>TablesExtension.Builder</code>. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.</li> <li>The default for <code>maxOpenBlockParsers</code> for <code>Parser.Builder</code> is now 100; configure the option to remove the limit.</li> <li>Limit how deeply inline nodes may nest by default (100), see option <code>maxInlineNesting</code> in <code>Parser.Builder</code>; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. <code>*</code> or the ins extension's <code>+</code>) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.</li> </ul> <h3>Fixed</h3> <ul> <li>Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished): <ul> <li>Inline HTML like <code>"x <!--".repeat(100_000)</code> (<a href="https://redirect.github.com/commonmark/commonmark-java/issues/447";>#447</a>)</li> <li>Autolink starts like <code>"<".repeat(100_000)</code></li> <li>Emphasis like <code>"a**b" + "c* ".repeat(100_000)</code></li> <li>Backticks runs of different lengths</li> </ul> </li> <li>Fix stack overflow errors when parsing pathological inputs with repeated syntax: <ul> <li>HTML block attributes</li> <li>Autolink email addresses</li> <li>Deeply nested emphasis</li> </ul> </li> <li>Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see <code>maxInlineNesting</code> above). This can happen with emphasis, e.g. <code>"*".repeat(n) + "x" + "*".repeat(n)</code> or <code>"*a ".repeat(n) + " b*".repeat(n)</code>, as well as with images, e.g. <code>"".repeat(n)</code></li> <li>YAML front matter extension: Fix inefficient string concatenation for literal-block values (<code>|</code>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/commonmark/commonmark-java/commit/64037cf982f2b12a4a2fa1c5a75c6d3f4ab979bf";><code>64037cf</code></a> [maven-release-plugin] prepare release commonmark-parent-0.30.0</li> <li><a href="https://github.com/commonmark/commonmark-java/commit/bd3e06669fd168874721267e7e5f5bd1d3433466";><code>bd3e066</code></a> Fix Javadoc</li> <li><a href="https://github.com/commonmark/commonmark-java/commit/4aaf754cc90b4a5a62647a8fc621185c934f8bbf";><code>4aaf754</code></a> mvn versions:set -DnewVersion=0.30.0-SNAPSHOT</li> <li><a href="https://github.com/commonmark/commonmark-java/commit/42b4fb7adfe288ef13e9e27ab20aff7e91b0ab9d";><code>42b4fb7</code></a> Prepare CHANGELOG for version 0.30.0</li> <li><a href="https://github.com/commonmark/commonmark-java/commit/b76e09d7a8362abb5f04e1d6b91dbd6da279a6fc";><code>b76e09d</code></a> Limit how deep inline nodes may nest by default (100)</li> <li><a href="https://github.com/commonmark/commonmark-java/commit/49f65cb5cbec93cff713179990307145198e7061";><code>49f65cb</code></a> Fix StackOverflowError when parsing deeply nested emphasis</li> <li><a href="https://github.com/commonmark/commonmark-java/commit/610f84b83e68c381e8f784ae4d044c80e1948b67";><code>610f84b</code></a> Fix StackOverflowError when parsing pathological autolink email addresses</li> <li><a href="https://github.com/commonmark/commonmark-java/commit/9f1d73897a56cbd74c39347af351a473e70297e1";><code>9f1d738</code></a> Fix StackOverflowError when parsing pathological HTML block attributes</li> <li><a href="https://github.com/commonmark/commonmark-java/commit/e13297e849995fdd582a85841067bff1d9c35ee5";><code>e13297e</code></a> Fix quadratic runtime when parsing pathological backticks</li> <li><a href="https://github.com/commonmark/commonmark-java/commit/89d1bd3fa1524e8217ed61db5e8116c82434470f";><code>89d1bd3</code></a> Fix quadratic runtime when parsing with lots of <code><</code></li> <li>Additional commits viewable in <a href="https://github.com/commonmark/commonmark-java/compare/commonmark-parent-0.29.0...commonmark-parent-0.30.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
