GHSA-8rr7-cvq3-gmfh

### Impact `AttributesExtension` ships with the library but must be explicitly registered on the `Environment`; it is not included in `CommonMarkConverter`, `GithubFlavoredMarkdownConverter`, or `GithubFlavoredMarkdownExtension`. **Applications that do not register `AttributesExtension` are not affected by this advisory.** Two paths in the extension re-process every attribute a node has already collected each time another attribute is applied to it. When the attributes carry distinct names, the collected set grows by one on every step and is walked again in full, so a run of *n* attributes costs O(n²). **1. Attribute nodes resolving to a common target (affected from 1.5.0).** `AttributesListener::processDocument()` merges each attribute node into the set accumulated for its target, then filters the result. Both operations traverse that entire set: `AttributesHelper::mergeAttributes()` rebuilds it with `array_merge()`, and `AttributesHelper::filterAttributes()` matches a regular expression against every name in it. A run of attribute nodes sharing one target therefore re-walks a set that grows by a key per node. Two input shapes reach this path: adjacent inline attributes at the start of a block (`{a0="v"}{a1="v"}…`, where quoting the values is what keeps them separate — an unquoted value swallows the `}{` that follows it), and a chain of attribute blocks held at their default target by reference definitions (`{a0=v}` / `[a]: u` / `{a1=v}` / `[a]: u` / …). 256 KB of adjacent inline attributes takes 20.0 seconds to convert, against 0.09 seconds once patched. **2. Consecutive attribute-block lines (affected from 2.0.0).** `AttributesBlockContinueParser::tryContinue()` merges each continuation line into the block's accumulated attributes, again rebuilding the whole set on every line. One distinct attribute per line (`{a0=v}` / `{a1=v}` / …) grows it by a key each time. 256 KB of such lines takes 1.9 seconds to convert while producing **zero bytes of output**, a