chore(deps): bump league/commonmark 2.9.0 → 2.10.0 (GHSA-8rr7-cvq3-gmfh, WR-1256)

CHANGELOG.md

@@ -81,6 +81,10 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
   **Versioning: PATCH** — CI, tests, self-analysis configuration and documentation only. No rule is added, removed or changed; no consumer sees a new or missing error, and nothing here is reachable from `extension.neon`.
 
+### Security
+
+- `league/commonmark` 2.9.0 → 2.10.0 in `composer.lock` (GHSA-8rr7-cvq3-gmfh; the 2.9.1 advisories GHSA-jjv6-8j6v-6j52, GHSA-f8fg-pg57-v4j8 and GHSA-j8pm-gj4c-rq4x close with it). A **runtime** dependency of this package: `illuminate/mail` is in `require` and pulls `league/commonmark ^2.7`, so `composer install --no-dev` installs it. This lock pins only what this repo's own CI and self-analysis tree install — a consumer territory resolves the range through its own lock and must bump there — but the stale pin here was reddening every check on every open PR, because `composer install` audits the lock on every job (WR-1256).
+
 ## [0.8.0] — 2026-08-11
 
 **Release-as-a-whole: candidate MAJOR** — `EnforceActionResultDtoRule` (war-room enforcement queue #136), `ForbidInlineArrayJsonResponseInControllersRule` (queue #137) and `ForbidRawExceptionMessageInResponseRule` (queue #140) all surface new errors in already-clean consumer code, as does the `ForbidEloquentMutationInControllersRule` receiver-scope fix (see their bullets). Per the pre-1.0 caret convention `^0.7` excludes this minor, so tagging auto-adopts nobody — each consumer adopts on its own pin-bump PR. Seeds: kendo PR #1653 (queue #136 + #137), war-room queue #140 (ublgenie/codebook MCP-tool leak sites), tc-api PR #133 (baseline-unmatched finding). _(Section originally dated 2026-07-13 covering only the queue #136/#137 pair; the tag was cut 2026-08-11 at `30c5145` and this section was folded to match the shipped payload.)_