From edd897c986275b967c38f080f0a18cec737d3074 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 26 Mar 2026 16:57:41 +0000 Subject: [PATCH 1/3] Bump requests from 2.32.5 to 2.33.0 Bumps [requests](https://github.com/psf/requests) from 2.32.5 to 2.33.0. - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](https://github.com/psf/requests/compare/v2.32.5...v2.33.0) --- updated-dependencies: - dependency-name: requests dependency-version: 2.33.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- uv.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/uv.lock b/uv.lock index 2c4eb33..71b3dc8 100644 --- a/uv.lock +++ b/uv.lock @@ -3659,7 +3659,7 @@ wheels = [ [[package]] name = "requests" -version = "2.32.5" +version = "2.33.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "certifi" }, @@ -3667,9 +3667,9 @@ dependencies = [ { name = "idna" }, { name = "urllib3" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/c9/74/b3ff8e6c8446842c3f5c837e9c3dfcfe2018ea6ecef224c710c85ef728f4/requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf", size = 134517, upload-time = "2025-08-18T20:46:02.573Z" } +sdist = { url = "https://files.pythonhosted.org/packages/34/64/8860370b167a9721e8956ae116825caff829224fbca0ca6e7bf8ddef8430/requests-2.33.0.tar.gz", hash = "sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652", size = 134232, upload-time = "2026-03-25T15:10:41.586Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738, upload-time = "2025-08-18T20:46:00.542Z" }, + { url = "https://files.pythonhosted.org/packages/56/5d/c814546c2333ceea4ba42262d8c4d55763003e767fa169adc693bd524478/requests-2.33.0-py3-none-any.whl", hash = "sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b", size = 65017, upload-time = "2026-03-25T15:10:40.382Z" }, ] [[package]] From 6d44b6810fa11431972c3e2599bc966636a21121 Mon Sep 17 00:00:00 2001 From: "aieng-bot[bot]" Date: Mon, 30 Mar 2026 00:50:18 +0000 Subject: [PATCH 2/3] chore: bump pygments to >=2.20.0 to fix CVE-2026-4539 Pins pygments to >=2.20.0 to address a ReDoS vulnerability (CVE-2026-4539) in pygments up to 2.19.2. Co-authored-by: aieng-bot --- pyproject.toml | 1 + uv.lock | 8 +++++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index be3d93b..d2262f8 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -32,6 +32,7 @@ test = [ "ruff>=0.2.0", "nbqa[toolchain]>=1.7.0", "pip-audit>=2.7.1", + "pygments>=2.20.0", # Pinning version to address vulnerability CVE-2026-4539 "aiohttp>=3.13.3", "virtualenv>=20.36.1", ] diff --git a/uv.lock b/uv.lock index 71b3dc8..4a5209e 100644 --- a/uv.lock +++ b/uv.lock @@ -279,6 +279,7 @@ test = [ { name = "nbqa", extra = ["toolchain"] }, { name = "pip-audit" }, { name = "pre-commit" }, + { name = "pygments" }, { name = "pytest" }, { name = "pytest-cov" }, { name = "ruff" }, @@ -317,6 +318,7 @@ test = [ { name = "nbqa", extras = ["toolchain"], specifier = ">=1.7.0" }, { name = "pip-audit", specifier = ">=2.7.1" }, { name = "pre-commit", specifier = ">=4.0.0" }, + { name = "pygments", specifier = ">=2.20.0" }, { name = "pytest", specifier = ">=7.1.1" }, { name = "pytest-cov", specifier = ">=3.0.0" }, { name = "ruff", specifier = ">=0.2.0" }, @@ -3221,11 +3223,11 @@ wheels = [ [[package]] name = "pygments" -version = "2.19.2" +version = "2.20.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/b0/77/a5b8c569bf593b0140bde72ea885a803b82086995367bf2037de0159d924/pygments-2.19.2.tar.gz", hash = "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887", size = 4968631, upload-time = "2025-06-21T13:39:12.283Z" } +sdist = { url = "https://files.pythonhosted.org/packages/c3/b2/bc9c9196916376152d655522fdcebac55e66de6603a76a02bca1b6414f6c/pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f", size = 4955991, upload-time = "2026-03-29T13:29:33.898Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b", size = 1225217, upload-time = "2025-06-21T13:39:07.939Z" }, + { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" }, ] [[package]] From 388891c2ca50821627c7824653ad5265b290fee6 Mon Sep 17 00:00:00 2001 From: "aieng-bot[bot]" Date: Mon, 30 Mar 2026 00:55:17 +0000 Subject: [PATCH 3/3] fix: upgrade pymdown-extensions to >=10.21.2 for pygments 2.20.0 compat pymdownx 10.21.2 fixes compatibility with pygments>=2.20.0 by handling 'filename=None' in the Highlight extension (docs build was failing with AttributeError when rendering source code blocks). Co-authored-by: aieng-bot --- pyproject.toml | 1 + uv.lock | 8 +++++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index d2262f8..8360488 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -40,6 +40,7 @@ docs = [ "jinja2>=3.1.6", # Pinning version to address vulnerability GHSA-cpwx-vrp4-4pq7 "mkdocs>=1.6.0", "mkdocs-material>=9.5.15", + "pymdown-extensions>=10.21.2", # Pinning version for compatibility with pygments>=2.20.0 (CVE-2026-4539 fix) "mkdocstrings>=0.24.1", "mkdocstrings-python>=1.10.0", "ipykernel>=6.29.5", diff --git a/uv.lock b/uv.lock index 4a5209e..64e41a7 100644 --- a/uv.lock +++ b/uv.lock @@ -271,6 +271,7 @@ docs = [ { name = "mkdocs-material" }, { name = "mkdocstrings" }, { name = "mkdocstrings-python" }, + { name = "pymdown-extensions" }, ] test = [ { name = "aiohttp" }, @@ -310,6 +311,7 @@ docs = [ { name = "mkdocs-material", specifier = ">=9.5.15" }, { name = "mkdocstrings", specifier = ">=0.24.1" }, { name = "mkdocstrings-python", specifier = ">=1.10.0" }, + { name = "pymdown-extensions", specifier = ">=10.21.2" }, ] test = [ { name = "aiohttp", specifier = ">=3.13.3" }, @@ -3251,15 +3253,15 @@ wheels = [ [[package]] name = "pymdown-extensions" -version = "10.20.1" +version = "10.21.2" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "markdown" }, { name = "pyyaml" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/1e/6c/9e370934bfa30e889d12e61d0dae009991294f40055c238980066a7fbd83/pymdown_extensions-10.20.1.tar.gz", hash = "sha256:e7e39c865727338d434b55f1dd8da51febcffcaebd6e1a0b9c836243f660740a", size = 852860, upload-time = "2026-01-24T05:56:56.758Z" } +sdist = { url = "https://files.pythonhosted.org/packages/df/08/f1c908c581fd11913da4711ea7ba32c0eee40b0190000996bb863b0c9349/pymdown_extensions-10.21.2.tar.gz", hash = "sha256:c3f55a5b8a1d0edf6699e35dcbea71d978d34ff3fa79f3d807b8a5b3fa90fbdc", size = 853922, upload-time = "2026-03-29T15:01:55.233Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/40/6d/b6ee155462a0156b94312bdd82d2b92ea56e909740045a87ccb98bf52405/pymdown_extensions-10.20.1-py3-none-any.whl", hash = "sha256:24af7feacbca56504b313b7b418c4f5e1317bb5fea60f03d57be7fcc40912aa0", size = 268768, upload-time = "2026-01-24T05:56:54.537Z" }, + { url = "https://files.pythonhosted.org/packages/f7/27/a2fc51a4a122dfd1015e921ae9d22fee3d20b0b8080d9a704578bf9deece/pymdown_extensions-10.21.2-py3-none-any.whl", hash = "sha256:5c0fd2a2bea14eb39af8ff284f1066d898ab2187d81b889b75d46d4348c01638", size = 268901, upload-time = "2026-03-29T15:01:53.244Z" }, ] [[package]]