chore(deps): Bump pymdown-extensions from 10.9 to 10.12#322
Conversation
Bumps [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions) from 10.9 to 10.12. - [Release notes](https://github.com/facelessuser/pymdown-extensions/releases) - [Commits](facelessuser/pymdown-extensions@10.9...10.12) --- updated-dependencies: - dependency-name: pymdown-extensions dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
Up to standards ✅
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This PR updates pymdown-extensions from 10.9 to 10.12; however, version 10.12 is affected by a Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2025-68142). To resolve this security risk, the dependency should be bumped to at least version 10.16.1. Additionally, there are no verification results ensuring that the documentation build remains stable, particularly for extensions like 'Details' and 'Tabbed' which are marked as legacy in this release.
About this PR
- The PR lacks any verification or test results confirming that the dependency bump does not break the documentation build, particularly since version 10.12 introduces legacy warnings for commonly used extensions like 'Details' and 'Tabbed'.
Test suggestions
- Verify that the documentation site builds successfully with the updated extensions.
- Verify that existing 'Details' and 'Tabbed' markdown components still render correctly despite being marked as legacy in this version.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that the documentation site builds successfully with the updated extensions.
2. Verify that existing 'Details' and 'Tabbed' markdown components still render correctly despite being marked as legacy in this version.
🗒️ Improve review quality by adding custom instructions
|
|
||
| # Markdown extensions | ||
| pymdown-extensions==10.9 | ||
| pymdown-extensions==10.12 |
There was a problem hiding this comment.
🔴 HIGH RISK
Suggestion: This version of pymdown-extensions is vulnerable to a Regular Expression Denial of Service (ReDoS) attack (CVE-2025-68142) found in the figure caption extension. Since you are already updating this dependency, you should bump it directly to version 10.16.1 to ensure the environment is secure.
This might be a simple fix:
| pymdown-extensions==10.12 | |
| pymdown-extensions==10.16.1 |
1 participant
Bumps pymdown-extensions from 10.9 to 10.12.
Release notes
Sourced from pymdown-extensions's releases.
Commits
20be2fcUpdate caption docs to use image example2c7f8c0Add catpion extension (#2492)b647b8dInclude white and black3a89709Fix more sass stuff in doc stylee8ec7bfUpdate JS Doc deps and fix some links0973681Docs: Update JS deps659b4d9Add new strict option in the emoji extension (#2488)a994065Fix SuperFence pattern should require options to be separated by a space (#2480)96e19e6Remove more duplicate words3f6fbbbTypos: remove various duplicated wordsYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)