Skip to content

deps(deps-dev): bump pymdown-extensions from 11.0.2 to 12.1 - #272

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/pymdown-extensions-12.0.1
Closed

deps(deps-dev): bump pymdown-extensions from 11.0.2 to 12.1#272
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/pymdown-extensions-12.0.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps pymdown-extensions from 11.0.2 to 12.1.

Release notes

Sourced from pymdown-extensions's releases.

12.1

  • NEW: SuperFences: Add optional reset function that can be specified for custom fences.
  • FIX: Tilde, Caret: Fix performance for long invalid delimiters.

12.0.1

  • FIX: BetterEm: fix a case with new logic.

12.0

  • BREAK: BetterEm: Complete rewrite. There may be some subtle differences between legacy behavior and new CommonMark behavior.

    • * and _ emphasis are handled at the same time to provide more natural nesting.
    • More performant.
    • CommonMark compliant.

  • BREAK: Tilde, Caret, Mark: Rewritten and now built upon the latest BetterEm logic.

    • When used with BetterEm, Tilde, Caret, and Mark will be added to the same delimiter processor under the hood and will be parsed at the same time as emphasis, allowing for better nesting logic.
    • More performant. Performance issues reported by (@​lexdotdev).
    • Tilde, Caret, Mark: Allow deletion, insertions, and marking mid-word by default. Set smart_delete, smart_insert, or smart_mark, respectively, to enable previous behavior, which prevented mid-word deletion.
    • Tilde, Caret: Add new option no_space to control whether the Pandoc style requirement of "no unescaped spaces" is enabled for subscript and superscript, respectively. no_space is enabled by default.

  • NEW: Details, Blocks.Details, Blocks.Admonitions: Allow and handle headers specially in titles.

  • NEW: Quotes: Allow and handle headers specially in callout titles.

  • NEW: BracketSpan: New extension that allows for the creation of spans using a Pandoc style bracket notation.

  • NEW: Arithmatex: Remove deprecated inline_mathjax_preview_format, inline_mathjax_format, and inline_generic_format. Use arithmatex_inline_format instead.

  • NEW: Arithmatex: Remove deprecated fence_mathjax_preview_format, fence_mathjax_format, and fence_generic_format. Use arithmatex_fenced_format instead.

  • NEW: Emoji: Remove undocumented and deprecated "old style" custom emoji index logic.

  • NEW: Slugs: Remove deprecated uslugify, uslugify_encoded, uslugify_cased, uslugify_cased_encoded, gfm, and gfm_encoded. Use the documented slugify method with appropriate arguments instead.

Commits
  • 9b896a8 Docs: Update theme
  • 3cb89bb Fix Tilde, Caret performance with long, invalid delimiters
  • d3d1f90 Docs: Update theme
  • 5c4a3af Update version
  • 2341405 Add configurable reset function for custom fences
  • 0e0060d Update changelog
  • 136d324 Add test for a fixed case in previous commit
  • 8087e9b Reduce duplicate code and simplify space accounting in Tilde and Caret
  • b613e7f More grammar fixes
  • ddcbb1d Fix grammar
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Sep 23, 2026

Copy link
Copy Markdown
Contributor Author

Assignees

The following users could not be added as assignees: developmentseed/data-model-developers. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 23, 2026
@emmanuelmathot emmanuelmathot mentioned this pull request Sep 24, 2026
Merged
3 of 4 tasks
@dependabot
deps(deps-dev): bump pymdown-extensions from 11.0.2 to 12.1
e4b7588 
Bumps [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions) from 11.0.2 to 12.1.
- [Release notes](https://github.com/facelessuser/pymdown-extensions/releases)
- [Commits](facelessuser/pymdown-extensions@11.0.2...12.1)

---
updated-dependencies:
- dependency-name: pymdown-extensions
  dependency-version: 12.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot changed the title deps(deps-dev): bump pymdown-extensions from 11.0.2 to 12.0.1 deps(deps-dev): bump pymdown-extensions from 11.0.2 to 12.1 Oct 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/pymdown-extensions-12.0.1 branch from 198088f to e4b7588 Compare October 1, 2026 21:26
@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Security Audit Report

View workflow run

Bandit — Static Security Analysis (Security tab)

12 issue(s) found: 12 low

✅ No issues at or above HIGH severity.

12 low issue(s) below threshold not shown in table.

pip-audit — Dependency Vulnerabilities (Security tab)

Package Version ID Fix Versions Description
urllib3 2.7.0 PYSEC-2026-4177 2.8.0 ## Impact urllib3's streaming API is d
urllib3 2.7.0 PYSEC-2026-4176 2.8.0 ### Impact urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in
urllib3 2.7.0 PYSEC-2026-4175 2.8.0 ## Impact urllib3 supports configuring TLS independently for an HTTPS proxy and the target server. proxy_ssl_context
tornado 6.5.8 GHSA-chx6-46f5-w4vp 6.5.9 An unbounded memory accumulation (decompression bomb) in tornado.curl_httpclient.CurlAsyncHTTPClient — the client-side
tornado 6.5.8 GHSA-c2m8-h5v5-343r 6.5.9 ### Summary StaticFileHandler allows an unauthenticated attacker to read arbitrary files from the server's filesystem by
tornado 6.5.8 GHSA-3hv7-mjh2-fv65 6.5.9 ## Summary HTTPServerRequest.__init__ in tornado/httputil.py parses the URL query string via parse_qs_bytes() wit
virtualenv 21.7.9 PYSEC-2026-4011 21.7.12 download_wheel() runs pip download and hands the result straight to the seeder, with nothing checking the bytes it g
virtualenv 21.7.9 PYSEC-2026-4012 21.7.11 pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write() wrote values verbatim, while `PyEnvCfg._re
virtualenv 21.7.9 PYSEC-2026-4014 21.7.12 BatchActivator.quote() returned its input unchanged, the only activator with no escaping at all. --prompt, the `VIRT
virtualenv 21.7.9 PYSEC-2026-4013 21.7.13 The generated activate (bash/zsh) and activate.fish scripts interpolate a shlex.quote-ed value into a position tha
virtualenv 21.7.9 PYSEC-2026-4011 21.7.12 download_wheel() runs pip download and hands the result straight to the seeder, with nothing checking the bytes it g
virtualenv 21.7.9 PYSEC-2026-4012 21.7.11 ### Summary pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write() wrote values verbatim, while
virtualenv 21.7.9 PYSEC-2026-4013 21.7.13 ### Impact The generated activate (bash/zsh) and activate.fish scripts interpolate a shlex.quote-ed value into a
virtualenv 21.7.9 PYSEC-2026-4014 21.7.12 BatchActivator.quote() returned its input unchanged, the only activator with no escaping at all. --prompt, the `VIRT

14 vulnerability/vulnerabilities found (14 fixable) across 3 package(s).

Result: ❌ Blocking issues found — see details above.

@lhoupert lhoupert mentioned this pull request Oct 7, 2026
Merged
1 task done
emmanuelmathot pushed a commit that referenced this pull request Oct 12, 2026
@lhoupert @claude
chore(deps): group pending Dependabot updates (#308)
68d72fd 
* chore(deps): group pending Dependabot updates

Applies #272, #273, #284, #299, #300, #301 and #307 (except xarray,
whose 2026.9.0 breaks coarsen(...).mean(skipna=True); see
pydata/xarray#11686). Raises the urllib3, tornado and virtualenv
security floors to the patched versions.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* ci(dependabot): group major and security updates

Major bumps, requirement widenings (zarr) and security updates each
arrived as one PR per package; give them their own groups. Skip
xarray 2026.9.0 until pydata/xarray#11686 ships.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* chore(deps): bump multidict to 6.9.1

pip-audit blocks on CVE-2026-104874 in multidict 6.8.0, which fails
the security job. Raise its floor with the other security constraints.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
@dependabot @github

dependabot Bot commented on behalf of github Oct 21, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #320.

@dependabot dependabot Bot closed this Oct 21, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/pymdown-extensions-12.0.1 branch October 21, 2026 09:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants