Skip to content

Bump the pip group across 3 directories with 8 updates - #1554

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/docs/pip-90594635a7
Open

Bump the pip group across 3 directories with 8 updates#1554
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/docs/pip-90594635a7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip group with 1 update in the /docs directory: tornado.
Bumps the pip group with 3 updates in the /emmet-api directory: mkdocs-material, ddtrace and pymongo.
Bumps the pip group with 6 updates in the /emmet-builders/requirements directory:

Package From To
mkdocs-material 8.2.16 9.7.7
pymongo 4.18.2 4.18.3
mkdocs-material 8.2.16 9.7.7
certifi 2024.7.4 2026.10.18
dnspython 2.6.1 2.9.0
filelock 3.20.3 4.2.1
certifi 2024.7.4 2026.10.18
dnspython 2.6.1 2.9.0
pymongo 4.18.2 4.18.3
filelock 3.20.3 4.2.1
mkdocs-material 8.2.16 9.7.7
msgpack 1.2.1 1.2.3

Updates tornado from 6.5.9 to 6.6

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.6.1 releases/v6.6.0 releases/v6.5.10 releases/v6.5.9 releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0

... (truncated)

Commits
  • e2b0f45 Merge pull request #3831 from bdarnell/final-6.6
  • 90c4e3f Version bump for 6.6 final release
  • ec17353 Merge pull request #3828 from bdarnell/downstream-ci-66
  • 15f66b0 ci: Add explicit read permission to CI jobs
  • 4446441 ci: Run the downstream testbed on a wheel built in the same run
  • c2e24d2 Merge pull request #3823 from bdarnell/claude/project-thread-uzh2s8
  • c2d8884 test: Add pre-6.3 security fixes to the corpus
  • de32687 test: Add a regression corpus of past security fixes
  • 7848790 maint: Add pre-tag checks and release instructions
  • f14321e ci: Compare benchmarks with the base branch on every PR
  • Additional commits viewable in compare view

Updates tornado from 6.5.9 to 6.6

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.6.1 releases/v6.6.0 releases/v6.5.10 releases/v6.5.9 releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0

... (truncated)

Commits
  • e2b0f45 Merge pull request #3831 from bdarnell/final-6.6
  • 90c4e3f Version bump for 6.6 final release
  • ec17353 Merge pull request #3828 from bdarnell/downstream-ci-66
  • 15f66b0 ci: Add explicit read permission to CI jobs
  • 4446441 ci: Run the downstream testbed on a wheel built in the same run
  • c2e24d2 Merge pull request #3823 from bdarnell/claude/project-thread-uzh2s8
  • c2d8884 test: Add pre-6.3 security fixes to the corpus
  • de32687 test: Add a regression corpus of past security fixes
  • 7848790 maint: Add pre-tag checks and release instructions
  • f14321e ci: Compare benchmarks with the base branch on every PR
  • Additional commits viewable in compare view

Updates tornado from 6.5.9 to 6.6

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.6.1 releases/v6.6.0 releases/v6.5.10 releases/v6.5.9 releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0

... (truncated)

Commits
  • e2b0f45 Merge pull request #3831 from bdarnell/final-6.6
  • 90c4e3f Version bump for 6.6 final release
  • ec17353 Merge pull request #3828 from bdarnell/downstream-ci-66
  • 15f66b0 ci: Add explicit read permission to CI jobs
  • 4446441 ci: Run the downstream testbed on a wheel built in the same run
  • c2e24d2 Merge pull request #3823 from bdarnell/claude/project-thread-uzh2s8
  • c2d8884 test: Add pre-6.3 security fixes to the corpus
  • de32687 test: Add a regression corpus of past security fixes
  • 7848790 maint: Add pre-tag checks and release instructions
  • f14321e ci: Compare benchmarks with the base branch on every PR
  • Additional commits viewable in compare view

Updates mkdocs-material from 8.2.16 to 9.7.7

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.7

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. After this date, the project will remain available on PyPI and GitHub, but no further maintenance is planned except in exceptional circumstances.

For users looking for a long-term, actively developed successor, we're building Zensical – a next-generation static site generator designed for technical documentation. If you're planning a new documentation project or evaluating your long-term options, we invite you to take a look.

Organizations requiring support beyond this date are welcome to get in touch to discuss available options.

Read the full announcement on our blog

Changes

  • Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

mkdocs-material-9.7.6

[!WARNING]

Material for MkDocs is in maintenance mode

Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs until November 2026.

Read the full announcement on our blog

Changes

  • Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5

[!WARNING]

Material for MkDocs is in maintenance mode

Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs until November 2026.

Read the full announcement on our blog

... (truncated)

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.8.1 (2026-11-07)

  • Updated Docker base image to Alpine 3.24
  • Updated Docker image dependencies to fix vulnerabilities
  • Updated Node build-time dependencies to fix vulnerabilities

mkdocs-material-9.8.0 (2026-10-24)

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

  • Updated Node build-time dependencies to fix vulnerabilities
  • Updated Python dependency minimums and required Python 3.11
  • Removed RSS from recommended dependencies
  • Updated project status and maintenance links
  • Updated CLI notice with end-of-life and migration guidance
  • Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide: https://zensical.org/docs/compatibility/mkdocs/migration/

It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Jinja2: affected <=3.1.5; new minimum 3.1.6 (CVE-2025-27516) GHSA-cpwx-vrp4-4pq7

Markdown: affected <3.8.1; new minimum 3.8.1 (CVE-2025-69534) GHSA-5wmx-573v-2qwq

Pygments: affected <2.20.0; new minimum 2.20.0 (CVE-2026-4539) GHSA-5239-wwwm-4pmq

... (truncated)

Upgrade guide

Sourced from mkdocs-material's upgrade guide.

How to upgrade

Upgrade to the latest version with:

pip install --upgrade --force-reinstall mkdocs-material

Show the currently installed version with:

pip show mkdocs-material

Upgrading from 8.x to 9.x

This major release includes a brand new search implementation that is faster and allows for rich previews, advanced tokenization and better highlighting. It was available as part of Insiders for over a year, and now that the funding goal was hit, makes its way into the community edition.

Changes to mkdocs.yml

content.code.copy

The copy-to-clipboard buttons are now opt-in and can be enabled or disabled per block. If you wish to enable them for all code blocks, add the following lines to mkdocs.yml:

theme:
  features:
    - content.code.copy

content.action.*

A "view source" button can be shown next to the "edit this page" button, both of which must now be explicitly enabled. Add the following lines to mkdocs.yml:

theme:
  features:
    - content.action.edit
    - content.action.view

navigation.footer

... (truncated)

Commits

Updates ddtrace from 4.8.2 to 4.15.6

Release notes

Sourced from ddtrace's releases.

4.15.6

Security Issues

4.15.5

Bug Fixes

  • Code Security (IAST): fixes an issue where taint tracking could abort the Python process when old-style % string formatting handled tainted text containing a lone surrogate character.

4.15.4

Bug Fixes

  • internal: Fixes an issue on macOS where starting a subprocess can deadlock while a hostname lookup is in progress.
  • tracing: Fixes a native memory leak on Linux when DD_TRACE_OTEL_CTX_ENABLED is set to true and a thread exits while an OpenTelemetry thread context is still attached.

4.15.3

Bug Fixes

  • LLM Observability:
    • Resolves an issue where a streamed Bedrock InvokeModelWithResponseStream request that ended in an error or was cancelled part-way produced a span with no output annotation. The text received before the failure is now tagged on the span.
    • Resolves an issue where a streamed Bedrock ConverseStream request that ended in an error or was cancelled part-way produced a span that was not marked as an error, making an interrupted request indistinguishable from a successful one.
    • This fix resolves an issue where cancelled or failed OpenAI streamed requests produced no LLM Observability span at all. These requests now produce an LLM span carrying the input messages, whatever output arrived before the stream ended, and estimated token metrics.
  • internal:
    • Fixes incorrect telemetry being collected when hitting cardinality limits during stats computation.
  • tracing:
    • Fixes an issue where the Python garbage collector stops and memory grows without limit when DD_RUNTIME_METRICS_ENABLED is true.
  • Profiling:
    • A crash that could occur in applications that use signal handlers to recover from crashes has been fixed.

4.15.2

Upgrade Notes

  • tracing: DD_TRACE_OTEL_CTX_ENABLED now defaults to false until a Linux-native memory leak caused by setting it to true is fixed.

Bug Fixes

  • LLM Observability: Fixes an issue where abandoned or disconnected streamed LLM requests can leave spans unfinished, causing memory to grow in long-running web workers.
  • CI Visibility: Fixes an issue where Auto Test Retries do not retry tests that use pytest-timeout thread mode and terminate a pytest-xdist worker.

4.15.1

Bug Fixes

  • LLM Observability
    • Resolves an issue where gen_ai.* attributes were added to APM spans when LLM Observability was disabled. These attributes are now only emitted when LLM Observability is enabled.

4.15.0

Estimated end-of-life date, accurate to within three months: 05-2027

See the support level definitions for more information.

... (truncated)

Commits
  • 83ea398 fix(tracing): prevent quadratic query string obfuscation [backport 4.15] (#20...
  • 4ae3a7f chore: bump version to 4.15.6 (#20863)
  • 479a759 ci: update one-pipeline to 1.6.0 [4.15] (#20842)
  • 8da5bb7 chore: bump version to 4.15.5 (#20833)
  • ace9724 fix(iast): avoid process abort in modulo_aspect on lone surrogates [backpor...
  • b97ac67 upgrade pyproject.toml version (#20715)
  • 27e417f chore(native): bump libdatadog v43.0.1 → v43.0.2 (#20711)
  • 45e21d6 fix(runtime): avoid macOS subprocess fork deadlock [backport 4.15] (#20678)
  • 3c2beeb chore: bump version to 4.15.3 (#20630)
  • 779fd48 fix(runtime-metrics): prevent gc stopping due to deadlock in gc monitor (#20624)
  • Additional commits viewable in compare view

Updates pymongo from 4.17.0 to 4.18.3

Release notes

Sourced from pymongo's releases.

PyMongo 4.18.3

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-3-released/344145

CVE-2026-106435

PyMongo 4.18.2

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732

CVE-2026-96749 CVE-2026-96748 CVE-2026-96747

PyMongo 4.18.1

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-1-released/343338

PyMongo 4.18.0

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-released/343137

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.18.3 (2026/10/08)

Version 4.18.3 is a bug fix release.

  • Hardened BSON regex decoding against malformed documents (PYTHON-6110_).

.. _PYTHON-6110: https://jira.mongodb.org/browse/PYTHON-6110

Issues Resolved ...............

See the PyMongo 4.18.3 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.3 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52955

Changes in Version 4.18.2 (2026/09/24)

Version 4.18.2 is a bug fix release.

  • Hardened the bson buffer size guard against signed integer overflow. (CVE-2026-96749_).
  • Fixed connection string parsing to percent-decode each host individually. (CVE-2026-96748_).
  • Client-side field level encryption now rejects a KMS endpoint ending in .sock. (CVE-2026-96747_).

.. _CVE-2026-96749: https://www.cve.org/CVERecord?id=CVE-2026-96749 .. _CVE-2026-96748: https://www.cve.org/CVERecord?id=CVE-2026-96748 .. _CVE-2026-96747: https://www.cve.org/CVERecord?id=CVE-2026-96747

Issues Resolved ...............

See the PyMongo 4.18.2 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.2 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52896

Changes in Version 4.18.1 (2026/09/10)

Version 4.18.1 is a bug fix release.

  • Use an exact match for the file ID in GridFS delete methods (CVE-2026-88029_).

.. _CVE-2026-88029: https://www.cve.org/CVERecord?id=CVE-2026-88029

Changes in Version 4.18.0 (2026/09/03)

... (truncated)

Commits

Updates mkdocs-material from 8.2.16 to 9.7.7

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.7

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. After this date, the project will remain available on PyPI and GitHub, but no further maintenance is planned except in exceptional circumstances.

For users looking for a long-term, actively developed successor, we're building Zensical – a next-generation static site generator designed for technical documentation. If you're planning a new documentation project or evaluating your long-term options, we invite you to take a look.

Organizations requiring support beyond this date are welcome to get in touch to discuss available options.

Read the full announcement on our blog

Changes

  • Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

mkdocs-material-9.7.6

[!WARNING]

Material for MkDocs is in maintenance mode

Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs until November 2026.

Read the full announcement on our blog

Changes

  • Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5

[!WARNING]

Material for MkDocs is in maintenance mode

Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs until November 2026.

Read the full announcement on our blog

... (truncated)

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.8.1 (2026-11-07)

  • Updated Docker base image to Alpine 3.24
  • Updated Docker image dependencies to fix vulnerabilities
  • Updated Node build-time dependencies to fix vulnerabilities

mkdocs-material-9.8.0 (2026-10-24)

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

  • Updated Node build-time dependencies to fix vulnerabilities
  • Updated Python dependency minimums and required Python 3.11
  • Removed RSS from recommended dependencies
  • Updated project status and maintenance links
  • Updated CLI notice with end-of-life and migration guidance
  • Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide: https://zensical.org/docs/compatibility/mkdocs/migration/

It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Jinja2: affected <=3.1.5; new minimum 3.1.6 (CVE-2025-27516) GHSA-cpwx-vrp4-4pq7

Markdown: affected <3.8.1; new minimum 3.8.1 (CVE-2025-69534) GHSA-5wmx-573v-2qwq

Pygments: affected <2.20.0; new minimum 2.20.0 (CVE-2026-4539) GHSA-5239-wwwm-4pmq

... (truncated)

Upgrade guide

Sourced from mkdocs-material's upgrade guide.

How to upgrade

Upgrade to the latest version with:

pip install --upgrade --force-reinstall mkdocs-material

Show the currently installed version with:

pip show mkdocs-material

Upgrading from 8.x to 9.x

This major release includes a brand new search implementation that is faster and allows for rich previews, advanced tokenization and better highlighting. It was available as part of Insiders for over a year, and now that the funding goal was hit, makes its way into the community edition.

Changes to mkdocs.yml

content.code.copy

The copy-to-clipboard buttons are now opt-in and can be enabled or disabled per block. If you wish to enable them for all code blocks, add the following lines to mkdocs.yml:

theme:
  features:
    - content.code.copy

content.action.*

A "view source" button can be shown next to the "edit this page" button, both of which must now be explicitly enabled. Add the following lines to mkdocs.yml:

theme:
  features:
    - content.action.edit
    - content.action.view

navigation.footer

... (truncated)

Commits

Updates pymongo from 4.17.0 to 4.18.3

Release notes

Sourced from pymongo's releases.

PyMongo 4.18.3

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-3-released/344145

CVE-2026-106435

PyMongo 4.18.2

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732

CVE-2026-96749 CVE-2026-96748 CVE-2026-96747

PyMongo 4.18.1

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-1-released/343338

PyMongo 4.18.0

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-released/343137

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.18.3 (2026/10/08)

Version 4.18.3 is a bug fix release.

  • Hardened BSON regex decoding against malformed documents (PYTHON-6110_).

.. _PYTHON-6110: https://jira.mongodb.org/browse/PYTHON-6110

Issues Resolved ...............

See the PyMongo 4.18.3 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.3 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52955

Changes in Version 4.18.2 (2026/09/24)

Version 4.18.2 is a bug fix release.

  • Hardened the bson buffer size guard against signed integer overflow. (CVE-2026-96749_).
  • Fixed connection string parsing to percent-decode each host individually. (CVE-2026-96748_).
  • Client-side field level encryption now rejects a KMS endpoint ending in .sock. (CVE-2026-96747_).

.. _CVE-2026-96749: https://www.cve.org/CVERecord?id=CVE-2026-96749 .. _CVE-2026-96748: https://www.cve.org/CVERecord?id=CVE-2026-96748 .. _CVE-2026-96747: https://www.cve.org/CVERecord?id=CVE-2026-96747

Issues Resolved ...............

See the PyMongo 4.18.2 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.2 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52896

Changes in Version 4.18.1 (2026/09/10)

Version 4.18.1 is a bug fix release.

  • Use an exact match for the file ID in GridFS delete methods (CVE-2026-88029_).

.. _CVE-2026-88029: https://www.cve.org/CVERecord?id=CVE-2026-88029

Changes in Version 4.18.0 (2026/09/03)

... (truncated)

Commits

Updates mkdocs-material from 8.2.16 to 9.7.7

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.7

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. After this date, the project will remain available on PyPI and GitHub, but no further maintenance is planned except in exceptional circumstances.

For users looking for a long-term, actively developed successor, we're building Zensical – a next-generation static site generator designed for technical documentation. If you're planning a new documentation project or evaluating your long-term options, we invite you to take a look.

Organizations requiring support beyond this date are welcome to get in touch to discuss available options.

Read the full announcement on our blog

Changes

  • Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

mkdocs-material-9.7.6

[!WARNING]

Material for MkDocs is in maintenance mode

Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs until November 2026.

Read the full announcement on our blog

Changes

  • Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5

[!WARNING]

Material for MkDocs is in maintenance mode

Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs until November 2026.

Read the full announcement on our blog

... (truncated)

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.8.1 (2026-11-07)

  • Updated Docker base image to Alpine 3.24
  • Updated Docker image dependencies to fix vulnerabilities
  • Updated Node build-time dependencies to fix vulnerabilities

mkdocs-material-9.8.0 (2026-10-24)

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

  • Updated Node build-time dependencies to fix vulnerabilities
  • Updated Python dependency minimums and required Python 3.11
  • Removed RSS from recommended dependencies
  • Updated project status and maintenance links
  • Updated CLI notice with end-of-life and migration guidance
  • Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide: https://zensical.org/docs/compatibility/mkdocs/migration/

It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Jinja2: affected <=3.1.5; new minimum 3.1.6 (CVE-2025-27516) GHSA-cpwx-vrp4-4pq7

Markdown: affected <3.8.1; new minimum 3.8.1 (CVE-2025-69534) GHSA-5wmx-573v-2qwq

Pygments: affected <2.20.0; new minimum 2.20.0 (CVE-2026-4539) GHSA-5239-wwwm-4pmq

... (truncated)

Upgrade guide

Sourced from mkdocs-material's upgrade guide.

How to upgrade

Upgrade to the latest version with:

pip install --upgrade --force-reinstall mkdocs-material

Show the currently installed version with:

pip show mkdocs-material

Upgrading from 8.x to 9.x

This major release includes a brand new search implementation that is faster and allows for rich previews, advanced tokenization and better highlighting. It was available as part of Insiders for over a year, and now that the funding goal was hit, makes its way into the community edition.

Changes to mkdocs.yml

content.code.copy

The copy-to-clipboard buttons are now opt-in and can be enabled or disabled per block. If you wish to enable them for all code blocks, add the following lines to mkdocs.yml:

theme:
  features:
    - content.code.copy

content.action.*

A "view source" button can be shown next to the "edit this page" button, both of which must now be explicitly enabled. Add the following lines to mkdocs.yml:

theme:
  features:
    - content.action.edit
    - content.action.view

navigation.footer

... (truncated)

Commits

Updates mkdocs-material from 8.2.16 to 9.7.7

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.7

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. After this date, the project will remain available on PyPI and GitHub, but no further maintenance is planned except in exceptional circumstances.

For users looking for a long-term, actively developed successor, we're building Zensical – a next-generation static site generator designed for technical documentation. If you're planning a new documentation project or evaluating your long-term options, we invite you to take a look.

Organizations requiring support beyond this date are welcome to get in touch to discuss available options.

Read the full announcement on our blog

Changes

  • Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

mkdocs-material-9.7.6

[!WARNING]

Material for MkDocs is in maintenance mode

Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs until November 2026.

Read the full announcement on our blog

Changes

  • Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5

[!WARNING]

Material for MkDocs is in maintenance mode

Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs until November 2026.

Read the full announcement on our blog

... (truncated)

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.8.1 (2026-11-07)

  • Updated Docker base image to Alpine 3.24
  • Updated Docker image dependencies to fix vulnerabilities
  • Updated Node build-time dependencies to fix vulnerabilities

mkdocs-material-9.8.0 (2026-10-24)

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

  • Updated Node build-time dependencies to fix vulnerabilities
  • Updated Python dependency minimums and required Python 3.11
  • Removed RSS from recommended dependencies
  • Updated project status and maintenance links
  • Updated CLI notice with end-of-life and migration guidance
  • Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide: https://zensical.org/docs/compatibility/mkdocs/migration/

It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Jinja2: affected <=3.1.5; new minimu...

Description has been truncated

@dependabot
Bump the pip group across 3 directories with 8 updates
ef46291 
Bumps the pip group with 1 update in the /docs directory: [tornado](https://github.com/tornadoweb/tornado).
Bumps the pip group with 3 updates in the /emmet-api directory: [mkdocs-material](https://github.com/squidfunk/mkdocs-material), [ddtrace](https://github.com/DataDog/dd-trace-py) and [pymongo](https://github.com/mongodb/mongo-python-driver).
Bumps the pip group with 6 updates in the /emmet-builders/requirements directory:

| Package | From | To |
| --- | --- | --- |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `8.2.16` | `9.7.7` |
| [pymongo](https://github.com/mongodb/mongo-python-driver) | `4.18.2` | `4.18.3` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `8.2.16` | `9.7.7` |
| [certifi](https://github.com/certifi/python-certifi) | `2024.7.4` | `2026.10.18` |
| [dnspython](https://github.com/rthalley/dnspython) | `2.6.1` | `2.9.0` |
| [filelock](https://github.com/tox-dev/filelock) | `3.20.3` | `4.2.1` |
| [certifi](https://github.com/certifi/python-certifi) | `2024.7.4` | `2026.10.18` |
| [dnspython](https://github.com/rthalley/dnspython) | `2.6.1` | `2.9.0` |
| [pymongo](https://github.com/mongodb/mongo-python-driver) | `4.18.2` | `4.18.3` |
| [filelock](https://github.com/tox-dev/filelock) | `3.20.3` | `4.2.1` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `8.2.16` | `9.7.7` |
| [msgpack](https://github.com/msgpack/msgpack-python) | `1.2.1` | `1.2.3` |



Updates `tornado` from 6.5.9 to 6.6
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.9...v6.6.0)

Updates `tornado` from 6.5.9 to 6.6
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.9...v6.6.0)

Updates `tornado` from 6.5.9 to 6.6
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.9...v6.6.0)

Updates `mkdocs-material` from 8.2.16 to 9.7.7
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Upgrade guide](https://github.com/squidfunk/mkdocs-material/blob/master/docs/upgrade.md)
- [Commits](squidfunk/mkdocs-material@8.2.16...9.7.7)

Updates `ddtrace` from 4.8.2 to 4.15.6
- [Release notes](https://github.com/DataDog/dd-trace-py/releases)
- [Changelog](https://github.com/DataDog/dd-trace-py/blob/main/CHANGELOG.md)
- [Commits](DataDog/dd-trace-py@v4.8.2...v4.15.6)

Updates `pymongo` from 4.17.0 to 4.18.3
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.3/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.17.0...4.18.3)

Updates `mkdocs-material` from 8.2.16 to 9.7.7
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Upgrade guide](https://github.com/squidfunk/mkdocs-material/blob/master/docs/upgrade.md)
- [Commits](squidfunk/mkdocs-material@8.2.16...9.7.7)

Updates `pymongo` from 4.17.0 to 4.18.3
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.3/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.17.0...4.18.3)

Updates `mkdocs-material` from 8.2.16 to 9.7.7
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Upgrade guide](https://github.com/squidfunk/mkdocs-material/blob/master/docs/upgrade.md)
- [Commits](squidfunk/mkdocs-material@8.2.16...9.7.7)

Updates `mkdocs-material` from 8.2.16 to 9.7.7
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Upgrade guide](https://github.com/squidfunk/mkdocs-material/blob/master/docs/upgrade.md)
- [Commits](squidfunk/mkdocs-material@8.2.16...9.7.7)

Updates `pymongo` from 4.18.2 to 4.18.3
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.3/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.17.0...4.18.3)

Updates `mkdocs-material` from 8.2.16 to 9.7.7
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Upgrade guide](https://github.com/squidfunk/mkdocs-material/blob/master/docs/upgrade.md)
- [Commits](squidfunk/mkdocs-material@8.2.16...9.7.7)

Updates `certifi` from 2024.7.4 to 2026.10.18
- [Commits](certifi/python-certifi@2024.07.04...2026.10.18)

Updates `dnspython` from 2.6.1 to 2.9.0
- [Release notes](https://github.com/rthalley/dnspython/releases)
- [Changelog](https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst)
- [Commits](rthalley/dnspython@v2.6.1...v2.9.0)

Updates `filelock` from 3.20.3 to 4.2.1
- [Release notes](https://github.com/tox-dev/filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.20.3...4.2.1)

Updates `certifi` from 2024.7.4 to 2026.10.18
- [Commits](certifi/python-certifi@2024.07.04...2026.10.18)

Updates `dnspython` from 2.6.1 to 2.9.0
- [Release notes](https://github.com/rthalley/dnspython/releases)
- [Changelog](https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst)
- [Commits](rthalley/dnspython@v2.6.1...v2.9.0)

Updates `pymongo` from 4.18.2 to 4.18.3
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.3/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.17.0...4.18.3)

Updates `filelock` from 3.20.3 to 4.2.1
- [Release notes](https://github.com/tox-dev/filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.20.3...4.2.1)

Updates `mkdocs-material` from 8.2.16 to 9.7.7
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Upgrade guide](https://github.com/squidfunk/mkdocs-material/blob/master/docs/upgrade.md)
- [Commits](squidfunk/mkdocs-material@8.2.16...9.7.7)

Updates `msgpack` from 1.2.1 to 1.2.3
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.2.1...v1.2.3)

---
updated-dependencies:
- dependency-name: tornado
  dependency-version: '6.6'
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: tornado
  dependency-version: '6.6'
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: tornado
  dependency-version: '6.6'
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: ddtrace
  dependency-version: 4.15.6
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pymongo
  dependency-version: 4.18.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pymongo
  dependency-version: 4.18.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pymongo
  dependency-version: 4.18.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: certifi
  dependency-version: 2026.10.18
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: dnspython
  dependency-version: 2.9.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: filelock
  dependency-version: 4.2.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: certifi
  dependency-version: 2026.10.18
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: dnspython
  dependency-version: 2.9.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pymongo
  dependency-version: 4.18.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: filelock
  dependency-version: 4.2.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: msgpack
  dependency-version: 1.2.3
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Nov 10, 2026
@codecov-commenter

codecov-commenter commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.52%. Comparing base (941129c) to head (ef46291).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #1554   +/-   ##
=======================================
  Coverage   85.52%   85.52%           
=======================================
  Files         258      258           
  Lines       18600    18600           
=======================================
  Hits        15907    15907           
  Misses       2693     2693

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@codecov-commenter