The first stable release in over six years. Requires PHP 7.1+.
Breaking Changes
- PHP 7.1 minimum -- dropped support for PHP 5.3, 5.4, 5.5, 5.6, and 7.0.
- List separation by marker type -- lists using different markers (
*,+,-, or switching between.and)for ordered lists) are now treated as separate lists, matching the CommonMark spec. - Lazy blockquotes -- consecutive blockquotes separated by a blank line are no longer merged into one, per CommonMark.
- Sparse HTML blocks -- blank lines inside block-level HTML are now wrapped in
<p>tags instead of being preserved as-is. - Empty ATX headings --
#and##on their own now produce<h1></h1>and<h2></h2>instead of being treated as paragraphs. - Extensions accessing block internals may need to update: the element structure uses
elementinstead oftextin some places (e.g.$Block['element']['element']['text']instead of$Block['element']['text']['text']).
Security
- Regex patterns throughout the parser now use possessive quantifiers (
*+,++) to prevent catastrophic backtracking (ReDoS). This addresses denial-of-service vectors where malformed emphasis markers or other adversarial input could cause memory exhaustion or hangs. - Safe mode now sanitizes nested elements correctly via recursive AST traversal. Previously, sanitization only applied at the top level.
- Extensions can mark self-produced HTML as trusted using
allowRawHtmlInSafeModeso it isn't escaped in safe mode, while untrusted input remains escaped.
PHP Compatibility
- Fixed implicit nullable parameter deprecations for PHP 8.4+.
- Updated PHPUnit dependency and test infrastructure for modern PHP.
- CI moved from Travis CI to GitHub Actions.
CommonMark Compliance
- Setext headings now handle leading/trailing spaces correctly.
- ATX heading closing
#sequences are trimmed properly (e.g.# # of levels # #renders as<h1># of levels #</h1>). - Ordered lists support
)as a marker in addition to.. - Ordered lists starting with a number other than 1 no longer interrupt paragraphs.
- One-column tables are now supported.
- Fenced code blocks require the closing fence to have at least as many backticks/tildes as the opening fence.
- HTML comments follow the CommonMark spec more closely.
- Email autolinks validate against the CommonMark email definition.
- Escaped tilde characters (
\~\~) are no longer treated as strikethrough.
New Features
- Strict mode (
setStrictMode(true)) -- requires a space after#in ATX headings (CommonMark-compliant behavior).
Bug Fixes
- Fixed "Uninitialized string offset" errors on certain inputs.
- Fixed adjacent blockquotes being incorrectly merged.
- Fixed line-break standardization when using the
line()method directly. - Fixed table header validation (headers containing newlines are no longer accepted).
- Fixed spaces in fenced code block class names.