From 5de4d6b121a4368d2e9ca28156d3346f2ebaa6e7 Mon Sep 17 00:00:00 2001 From: Florian Weingarten Date: Tue, 8 Sep 2026 11:00:21 -0400 Subject: [PATCH] fix: bump mkdocs-material to 9.7.7 to fix DOM XSS Material for MkDocs before 9.7.7 has a DOM-based XSS in the search.suggest feature via the q URL parameter (GHSA-xvg9-69gf-fjrf, CVE-2026-73295). Bumps the minimum version and updates the lockfile. Co-Authored-By: Claude Sonnet 5 --- pyproject.toml | 2 +- uv.lock | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index e835859..8a6d8c4 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -36,7 +36,7 @@ docs = [ "mike>=2.1.4", "mkdocs-github-admonitions-plugin>=0.1.1", "mkdocs-include-markdown-plugin>=7.2.2", - "mkdocs-material>=9.7.6", + "mkdocs-material>=9.7.7", "mkdocs>=1.6.1", "mkdocstrings[python]>=1.0.3", ] diff --git a/uv.lock b/uv.lock index bea2245..6f7027d 100644 --- a/uv.lock +++ b/uv.lock @@ -220,7 +220,7 @@ name = "exceptiongroup" version = "1.3.1" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "typing-extensions" }, + { name = "typing-extensions", marker = "python_full_version < '3.13'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" } wheels = [ @@ -707,7 +707,7 @@ wheels = [ [[package]] name = "mkdocs-material" -version = "9.7.6" +version = "9.7.7" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "babel" }, @@ -722,9 +722,9 @@ dependencies = [ { name = "pymdown-extensions" }, { name = "requests" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/45/29/6d2bcf41ae40802c4beda2432396fff97b8456fb496371d1bc7aad6512ec/mkdocs_material-9.7.6.tar.gz", hash = "sha256:00bdde50574f776d328b1862fe65daeaf581ec309bd150f7bff345a098c64a69", size = 4097959, upload-time = "2026-03-19T15:41:58.161Z" } +sdist = { url = "https://files.pythonhosted.org/packages/f1/cd/c05d3a530ba7934f144fb45f7203cd236adc25c7bdcc34673d202f4b0278/mkdocs_material-9.7.7.tar.gz", hash = "sha256:c0649c065b1b0512d60aad8c10f947f8e455284475239b364b610f2deb4d0855", size = 4097923, upload-time = "2026-07-17T16:21:33.156Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/2c/01/bc663630c510822c95c47a66af9fa7a443c295b47d5f041e5e6ae62ef659/mkdocs_material-9.7.6-py3-none-any.whl", hash = "sha256:71b84353921b8ea1ba84fe11c50912cc512da8fe0881038fcc9a0761c0e635ba", size = 9305470, upload-time = "2026-03-19T15:41:55.217Z" }, + { url = "https://files.pythonhosted.org/packages/ad/21/17c1bc9e6f47c972ad66fb2ac2568f99f90f1207eeb6fc3b34d094dba7b5/mkdocs_material-9.7.7-py3-none-any.whl", hash = "sha256:8ea9bb1737a5b524a5f9dcf2e1b4ebda8274ae3008aa7845720a97083bef708f", size = 9305438, upload-time = "2026-07-17T16:21:30.017Z" }, ] [[package]] @@ -1504,7 +1504,7 @@ docs = [ { name = "mkdocs", specifier = ">=1.6.1" }, { name = "mkdocs-github-admonitions-plugin", specifier = ">=0.1.1" }, { name = "mkdocs-include-markdown-plugin", specifier = ">=7.2.2" }, - { name = "mkdocs-material", specifier = ">=9.7.6" }, + { name = "mkdocs-material", specifier = ">=9.7.7" }, { name = "mkdocstrings", extras = ["python"], specifier = ">=1.0.3" }, ]