Markdown Laravel Package

Product Decisions This Supports

• Security patch adoption / dependency hygiene: 4.0.2 is a patch release that raises the minimum league/commonmark version to 2.10.2, closing known advisories (quadratic-time and other DoS vectors, an on* attribute filter bypass in AttributesExtension, and a DisallowedRawHtml bypass). This directly informs a "upgrade now vs. schedule" decision for any product that renders untrusted or user-submitted Markdown (comments, docs, chat, CMS bodies, AI-generated content).
• Risk triage for content-rendering surfaces: If your product accepts third-party Markdown, the DisallowedRawHtml and on* filter bypasses are the decision-relevant items — they map to stored-XSS-adjacent exposure and content-sanitisation guarantees, not just performance.
• Build vs. buy: Confirms the value of delegating Markdown parsing/rendering to a maintained wrapper rather than hand-rolling a renderer — the upstream CommonMark library absorbs the CVE churn and this package tracks it with a one-line constraint bump.
• Toolchain roadmap: PHPUnit 13 support signals the package is tracking current Laravel/PHP test-matrix expectations, which matters if your CI is being upgraded in the same window.
• Non-decision: Rendering output is unchanged, so this is not a feature, UX, or contract change — no product-facing behaviour work, no docs rewrite, no customer communication.

When to Consider This Package

Adopt when:

• You are on Laravel and need Markdown → HTML rendering (blade directives, model attributes, or a renderer service) and want the league/commonmark ecosystem without wiring it up yourself.
• You render user-supplied or semi-trusted Markdown and want a package that pins to patched upstream versions — 4.0.2 demonstrates active security tracking.
• You want an upgrade path with no output changes: 4.0.2 is a drop-in patch from 4.0.1, so validating it is a test-suite run, not a regression project.
• Your CI is moving to PHPUnit 13 / newer PHP and you want the test-support surface to keep pace.

Look elsewhere or pause when:

• You need extensions, custom node renderers, or a strict sanitisation policy beyond what league/commonmark + this wrapper expose — go direct to the upstream library and own the config explicitly.
• You are pinned below the league/commonmark 2.10.2 floor for other reasons; the constraint will block the upgrade, and you need a coordinated bump across all consumers of CommonMark in the app.
• You need a documented security policy / disclosure process with SLAs — a single-maintainer package is a supply-chain consideration to weigh, even when patches land promptly.
• Your Markdown needs are trivial (a single Str::markdown-style call); Laravel's built-in helper may already cover it without an extra dependency.

How to Pitch It (Stakeholders)

To executives: A routine but security-relevant patch. Version 4.0.2 raises the minimum version of the underlying Markdown parser to one that fixes several published vulnerabilities — including filter bypasses that matter for any surface where users can submit Markdown. There is no change to rendered output, no new features, and no breaking changes, so the cost is a dependency bump and a CI run. Recommendation: include it in the next maintenance release rather than a dedicated one; it is low-effort risk reduction, not a project.

To engineering: Upgrade leMaur/markdown to 4.0.2 and confirm league/commonmark resolves to ≥ 2.10.2 — check for any other package in the tree pinning an older CommonMark. Run the existing rendering test suite; expected diff is zero because output is unchanged. Note PHPUnit 13 support if your test matrix is moving. Flag the AttributesExtension on* filter bypass and DisallowedRawHtml bypass to whoever owns content sanitisation, since those are the items with a plausible user-facing impact if left unpatched.