Is league/commonmark safe to use?

league/commonmark has no known vulnerabilities on the latest version (2.8.2). DepScope rates its health at 62/100 (moderate risk).

What is the latest version of league/commonmark?

The latest version of league/commonmark is 2.8.2, released 2026-03-19.

Does league/commonmark have known vulnerabilities?

No known vulnerabilities on the latest version of league/commonmark.

Is league/commonmark deprecated?

No, league/commonmark is actively maintained. Latest release: 2.8.2 (2026-03-19).

What are alternatives to league/commonmark?

DepScope has no curated alternatives for league/commonmark at this time.

What license does league/commonmark use?

league/commonmark is licensed under BSD-3-Clause.

league/commonmark

composerv2.8.2

Highly-extensible PHP Markdown parser which fully supports the CommonMark spec and GitHub-Flavored Markdown (GFM)

License BSD-3-Clausepermissive139 versions1 maintainers6 deps

thephpleague/commonmark

/ 100

Health

safe to use

league/[email protected] is safe to use (health: 62/100)

Health breakdown0 – 100

20/25

maintenance

0/20

popularity

25/25

security

15/15

maturity

2/15

community

Vulnerabilities

none known

OSS Scorecard

OpenSSF security posture score

4.4/10

weak

Maintainer trust

Active maintainers (3m)

1

Contributors (12m)

10

Primary author dominance

71%

GitHub stars

2,944

single active maintainer 3m

Health History

Dependency Tree

License Audit

Dependencies (6)

php ext-mbstring league/config psr/event-dispatcher symfony/deprecation-contracts symfony/polyfill-php80

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/composer/league/commonmark

Last updated · 2026-03-19T13:16:38+00:00