Skip to content

deps(deps-dev): bump mkdocs-material from 9.7.6 to 9.7.7 - #259

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/mkdocs-material-9.7.7
Closed

deps(deps-dev): bump mkdocs-material from 9.7.6 to 9.7.7#259
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/mkdocs-material-9.7.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor

Bumps mkdocs-material from 9.7.6 to 9.7.7.

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.7

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. After this date, the project will remain available on PyPI and GitHub, but no further maintenance is planned except in exceptional circumstances.

For users looking for a long-term, actively developed successor, we're building Zensical – a next-generation static site generator designed for technical documentation. If you're planning a new documentation project or evaluating your long-term options, we invite you to take a look.

Organizations requiring support beyond this date are welcome to get in touch to discuss available options.

Read the full announcement on our blog

Changes

  • Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.7.7 (2026-07-17)

  • Fixed DOM-based XSS vulnerability in search suggestions

mkdocs-material-9.7.6 (2026-03-19)

  • Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5 (2026-03-10)

  • Limited version range of mkdocs to <2
  • Updated MkDocs 2.0 incompatibility warning (clarify relation with MkDocs)

mkdocs-material-9.7.4 (2026-03-03)

  • Hardened social cards plugin by switching to sandboxed environment
  • Updated MkDocs 2.0 incompatibility warning

mkdocs-material-9.7.3 (2026-02-24)

  • Fixed #8567: Print MkDocs 2.0 incompatibility warning to stderr

mkdocs-material-9.7.2 (2026-02-18)

  • Opened up version ranges of optional dependencies for forward-compatibility
  • Added warning to 'mkdocs build' about impending MkDocs 2.0 incompatibility

mkdocs-material-9.7.1 (2025-12-18)

  • Updated requests to 2.30+ to mitigate CVE in urllib
  • Fixed privacy plugin not picking up protocol-relative URLs
  • Fixed #8542: false positives and negatives captured in privacy plugin

mkdocs-material-9.7.0 (2025-11-11)

⚠️ Material for MkDocs is now in maintenance mode

This is the last release of Material for MkDocs that will receive new features. Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs for 12 months at least.

Read the full announcement on our blog: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/

This release includes all features that were previously exclusive to the Insiders edition. These features are now freely available to everyone.

Note on deprecated plugins: The projects and typeset plugins are included in this release, but must be considered deprecated. Both plugins proved

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

Assignees

The following users could not be added as assignees: developmentseed/data-model-developers. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

Security Audit Report

View workflow run

Bandit — Static Security Analysis (Security tab)

12 issue(s) found: 12 low

✅ No issues at or above HIGH severity.

12 low issue(s) below threshold not shown in table.

pip-audit — Dependency Vulnerabilities (Security tab)

Package Version ID Fix Versions Description
tornado 6.5.7 GHSA-wwv5-g3v4-889x 6.5.8 ## Summary The CVE-2026-35536 fix added a validation loop that rejects [\x00-\x20\x3b\x7f], but only for the hardcoded
tornado 6.5.7 GHSA-8423-8fgw-73vq 6.5.8 ## Description ### Summary parse_multipart_form_data (httputil.py:34) calls data.split(b"--"+boundary+b"\r\n") **b
tornado 6.5.7 CVE-2026-82397 6.5.8 ## Summary Tornado parses application/x-www-form-urlencoded bodies with urllib.parse.parse_qs and does not pass `ma

3 vulnerability/vulnerabilities found (3 fixable) across 1 package(s).

Result: ❌ Blocking issues found — see details above.

@lhoupert lhoupert mentioned this pull request Sep 10, 2026
Merged
1 task done
lhoupert added a commit that referenced this pull request Sep 10, 2026
@lhoupert @claude
deps: bump Python dependencies and pinned GitHub Actions (#264)
86202d7 
* deps: bump all Python dependencies to latest

Refresh the whole `uv.lock` with `uv lock --upgrade`, superseding the open
Dependabot PRs #260, #259, #255, #252, #241, #234, #228 and #227. pyright
1.1.414 narrows the `MISSING` sentinel more precisely than 1.1.410 did, so two
call sites gain the same `reportArgumentType` ignore the neighbouring line
already carries.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JEbpfA8CPcBQJzMpVJBViF

* ci(deps): bump pinned GitHub Actions

Supersedes Dependabot PR #225. Same SHAs it proposed, with the two stale
`# v6` comments on `actions/setup-python` corrected to `# v7.0.0`.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JEbpfA8CPcBQJzMpVJBViF

---------

Co-authored-by: Claude Opus 5 <[email protected]>
@lhoupert

lhoupert commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Superseded by #264, which refreshed the whole uv.lock (uv lock --upgrade) and bumped the pinned GitHub Actions. Verified on main before closing: this bump's target is already met or exceeded there. Closing as requested in #264.

@lhoupert lhoupert closed this Sep 14, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/uv/mkdocs-material-9.7.7 branch September 14, 2026 09:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lhoupert