Bump org.commonmark:commonmark from 0.29.0 to 0.30.1

[dependabot]

Bumps org.commonmark:commonmark from 0.29.0 to 0.30.1.

Release notes

Sourced from org.commonmark:commonmark's releases.

commonmark-java 0.30.1

Changed

• Improve MarkdownRenderer performance by appending unescaped spans in bulk (#456)

Fixed

• Fix parsing code spans after an unclosed backtick string; a regression that was introduced in the previous version (0.30.0) (#459)

commonmark-java 0.30.0

Added

• New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
• YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

• Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
• The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
• Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

• Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
  • Inline HTML like "x <!--".repeat(100_000) (#447)
  • Autolink starts like "<".repeat(100_000)
  • Emphasis like "a**b" + "c* ".repeat(100_000)
  • Backticks runs of different lengths
• Fix stack overflow errors when parsing pathological inputs with repeated syntax:
  • HTML block attributes
  • Autolink email addresses
  • Deeply nested emphasis
• Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/HEAD/n) + "x" + "](u)".repeat(n)
• YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)

Changelog

Sourced from org.commonmark:commonmark's changelog.

[0.30.1] - 2026-10-11

Changed

• Improve MarkdownRenderer performance by appending unescaped spans in bulk (#456)

Fixed

• Fix parsing code spans after an unclosed backtick string; a regression that was introduced in the previous version (0.30.0) (#459)

[0.30.0] - 2026-08-06

Added

• New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
• YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

• Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
• The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
• Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

• Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
  • Inline HTML like "x <!--".repeat(100_000) (#447)
  • Autolink starts like "<".repeat(100_000)
  • Emphasis like "a**b" + "c* ".repeat(100_000)
  • Backticks runs of different lengths
• Fix stack overflow errors when parsing pathological inputs with repeated syntax:
  • HTML block attributes
  • Autolink email addresses
  • Deeply nested emphasis
• Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/main/n) + "x" + "](u)".repeat(n)
• YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)

Commits

• a01f1c9 [maven-release-plugin] prepare release commonmark-parent-0.30.1
• 048eda8 Pin to mvn 3.9.16 to (hopefully) fix release workflow
• 6cf8c71 Prepare CHANGELOG for version 0.30.1
• c3bd521 Merge pull request #459 from TanbirRamim/code-span-after-unclosed-backticks
• 73d76d0 Merge pull request #456 from tballison/markdown-writer-bulk-spans
• 3b3292c Fix code spans after an unclosed backtick string
• 5d529c6 MarkdownWriter: extract append(String, CharMatcher)
• e7daa8a MarkdownWriter: append unescaped spans in bulk
• b89e72f Merge pull request #451 from commonmark/text-blocks
• 8b73380 Don't run Java 11 on CI (but still supported)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)