chore(deps): Bump markdown from 3.6 to 3.7#306
Conversation
Bumps [markdown](https://github.com/Python-Markdown/markdown) from 3.6 to 3.7. - [Release notes](https://github.com/Python-Markdown/markdown/releases) - [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md) - [Commits](Python-Markdown/markdown@3.6...3.7) --- updated-dependencies: - dependency-name: markdown dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Up to standards ✅
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
While the PR successfully updates the markdown dependency as intended, version 3.7 contains significant regressions in core extensions (toc, attr_list) and a known security vulnerability (CVE-2025-69534). Although Codacy results indicate the PR is 'up to standards', the specific findings on this version suggest it should not be merged. A direct upgrade to 3.8.1 is required to ensure stability and security.
About this PR
- Updating to version 3.7 is discouraged due to a combination of functional regressions and a security vulnerability. Please target version 3.8.1 instead.
Test suggestions
- Verify the dependency version update in the requirements file.
- Verify markdown rendering functionality remains stable after the upgrade, specifically checking for regressions in the
abbrextension refactor. - Execute regression tests specifically for
tocandattr_listextensions to ensure compatibility with the new version.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify markdown rendering functionality remains stable after the upgrade, specifically checking for regressions in the `abbr` extension refactor.
2. Execute regression tests specifically for `toc` and `attr_list` extensions to ensure compatibility with the new version.
🗒️ Improve review quality by adding custom instructions
| @@ -1,5 +1,5 @@ | |||
| mkdocs==1.6.0 | |||
| markdown==3.6 | |||
| markdown==3.7 | |||
There was a problem hiding this comment.
🟡 MEDIUM RISK
The update to markdown==3.7 introduces functional regressions in the toc and attr_list extensions. Additionally, it is flagged for a security vulnerability (CVE-2025-69534) that allows for Denial of Service attacks via malformed HTML sequences.
To resolve both the rendering issues and the security risk, please upgrade directly to version 3.8.1.
| markdown==3.7 | |
| markdown==3.8.1 |
1 participant
Bumps markdown from 3.6 to 3.7.
Release notes
Sourced from markdown's releases.
Changelog
Sourced from markdown's changelog.
Commits
da03cd6Bump version to 3.7bd836a1Update griffe_extensions to support Griffe v 1.0.33359faAbbr Extension: Definition Sorting and Glossary storageec8c305RefactorabbrExtension993b57bFixed links to source code on GitHub from the documentationDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)