Skip to content

Update dependencies - #94

Draft
ngcpp-dependency-manager[bot] wants to merge 1 commit into
mainfrom
auto/bump-renovate-deps
Draft

ngcpp-dependency-manager[bot] wants to merge 1 commit into
mainfrom
auto/bump-renovate-deps

Conversation

@ngcpp-dependency-manager

@ngcpp-dependency-manager ngcpp-dependency-manager Bot commented Sep 28, 2026 •

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Confidence
BlankSpruce/gersemi-pre-commit repository patch 0.29.1 → 0.29.2 age confidence
actions/setup-python action minor v7.0.0 → v7.1.0 age confidence
astral-sh/ruff-pre-commit repository minor v0.16.8 → v0.17.2 age confidence
bazel minor 9.2.0 → 9.3.1 age confidence
clang-format pre-commit-python patch ==23.1.1 → ==23.1.3 age confidence
fmt bazel_dep minor 12.1.0 → 12.2.0.bcr.1 age confidence
google_benchmark bazel_dep minor 1.9.5 → 1.10.0 age confidence
keith/pre-commit-buildifier repository minor 10.0.1 → 10.1.0 age confidence
markdown (changelog) minor ==3.10.3 → ==3.11.2 age confidence
meson (source) pre-commit-python patch ==1.12.0 → ==1.12.1 age confidence
mkdocs-git-revision-date-localized-plugin patch ==1.6.0 → ==1.6.1 age confidence
mkdocs-material (changelog) minor ==9.7.7 → ==9.8.0 age confidence
pymdown-extensions minor ==12.0.1 → ==12.3 age confidence
python uses-with minor 3.14 → 3.15 age confidence
rules_cc bazel_dep patch 0.2.25 → 0.2.27 age confidence
rules_python bazel_dep minor 2.3.3 → 2.4.5 age confidence

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.


Release Notes

BlankSpruce/gersemi-pre-commit

v0.29.2

Compare Source

actions/setup-python

v7.1.0

Compare Source

What's Changed
Enhancements
Dependency Upgrade
New Contributors

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

astral-sh/ruff-pre-commit

v0.17.2

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.17.2

v0.17.1

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.17.1

v0.17.0

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.17.0

v0.16.10

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.16.10

v0.16.9

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.16.9

bazelbuild/bazel (bazel)

v9.3.1

Compare Source


Release Notes:

v9.3.0

Compare Source


Release Notes:

ssciwr/clang-format-wheel (clang-format)

v23.1.3

Compare Source

v23.1.2

Compare Source

fmtlib/fmt (fmt)

v12.2.0

Compare Source

google/benchmark (google_benchmark)

v1.10.0

What's Changed

New Contributors

Full Changelog: google/benchmark@v1.9.5...v1.10.0

keith/pre-commit-buildifier

v10.1.0

Compare Source

What's Changed

Full Changelog: keith/pre-commit-buildifier@10.0.1...10.1.0

Python-Markdown/markdown (markdown)

v3.11.2

Compare Source

Fixed
  • Sanitize attribute names in the fenced_code and legacy_attrs extensions so an
    attribute name cannot break out of its tag and inject markup (#​1663).
  • For backwards compatibility, revert the enforcement of CommonMark style
    punctuation rules (#​1657).

v3.11.1

Compare Source

Fixed
  • Update serializer to be non-recursive (#​1644).
  • Improve ancestor handling in the inline Treeprocessor (#​1646).
  • Keep a raw HTML comment inside an inline HTML element that closes in the
    same paragraph, instead of splitting the paragraph around it (#​1643).
  • Fix issue where inline HTML attributes were rejected if they had < or > in the attribute (#​1647).
  • Fix issue where an unterminated end tag (</foo) could cause all remaining content to be dropped (#​1651).
  • Complete rework of emphasis handling to improve nested emphasis handling better (#​1632).

v3.11

Compare Source

mesonbuild/meson (meson)

v1.12.1

Compare Source

timvink/mkdocs-git-revision-date-localized-plugin (mkdocs-git-revision-date-localized-plugin)

v1.6.1

Compare Source

Security

  • Require GitPython >= 3.2.1, which fixes a remote code execution issue in submodule cloning (GHSA for GitPython "validates a submodule's .git path only after cloning into it").

Maintenance

  • Python 3.10 is end-of-life and no longer tested. It can still be installed, but it is no longer supported.
squidfunk/mkdocs-material (mkdocs-material)

v9.8.0: mkdocs-material-9.8.0

Compare Source

[!WARNING]

Material for MkDocs reaches end of life on May 5, 2027. Critical fixes and security updates continue until that date.

We're continuing our work with Zensical, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.

You can evaluate Zensical alongside MkDocs using your existing mkdocs.yml. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The classic theme variant preserves the appearance of Material for MkDocs. See the migration guide for the steps and current compatibility details.

Upcoming changes on November 5

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

  • Updated Node build-time dependencies to fix vulnerabilities
  • Updated Python dependency minimums and required Python 3.11
  • Removed RSS from recommended dependencies
  • Updated project status and maintenance links
  • Updated CLI notice with end-of-life and migration guidance
  • Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide. It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Dependency Affected versions New minimum Advisory
Jinja2 <=3.1.5 3.1.6 CVE-2025-27516
Markdown <3.8.1 3.8.1 CVE-2025-69534
Pygments <2.20.0 2.20.0 CVE-2026-4539
PyMdown Extensions <=11.0.0 11.0.1 CVE-2026-67422
Requests <2.33.0 2.33.0 CVE-2026-25645
Pillow <13.0.0 13.0.0 CVE-2026-96636
CairoSVG <=2.9.0 2.9.1 CVE-2026-107378
GitPython <=3.2.0 3.2.1 CVE-2026-114145

Pillow and CairoSVG apply to the imaging extra; GitPython applies to the git extra.

facelessuser/pymdown-extensions (pymdown-extensions)

v12.3

Compare Source

12.3

  • NEW: BetterEm: Expose a way to disable CommonMark punctuation rules in BetterEm if desired via a new
    punctuation option.

v12.2

Compare Source

12.2

  • NEW: Add official support for Python 3.15.
  • NEW: Tilde, Caret: For backwards compatibility, disable CommonMark punctuation rules by default. If subscript or
    superscript is disabled in the respective extension, CommonMark rules will be honored again. A new punctuation
    rule has been added to force CommonMark rules. When done, people will need to be aware of punctuation when subscript
    or superscript is enabled and escape any that violates CommonMark rules.
  • NEW: Highlight: Highlight now allows in the auto_title_map specifying the title as a simple string or a
    dictionary containing the title and the title mode: either text or html, with text being the default. This
    allows a title to be specified and treated as HTML when the mode is html.
  • NEW: SuperFences: Add new title_mode option for Pygments fenced blocks that allows a user to specify a title
    to be treated as HTML via title_mode="html".

v12.1

Compare Source

12.1

  • NEW: SuperFences: Add optional reset function that can be specified for custom fences.
  • FIX: Tilde, Caret: Fix performance for long invalid delimiters.
actions/python-versions (python)

v3.15.1: 3.15.1

Compare Source

Python 3.15.1

v3.15.0: 3.15.0

Compare Source

Python 3.15.0

bazelbuild/rules_cc (rules_cc)

v0.2.27

Compare Source

Using bzlmod with Bazel 6 or later:

  1. [Bazel 6] Add common --enable_bzlmod to .bazelrc.

  2. Add to your MODULE.bazel file:

bazel_dep(name = "rules_cc", version = "0.2.27")

Using WORKSPACE:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_cc",
    sha256 = "6bcf1b46d9e629cbe4c96d7bfc56f61034c2193b7b16001201282ea50bef5d91",
    strip_prefix = "rules_cc-0.2.27",
    url = "https://github.com/bazelbuild/rules_cc/releases/download/0.2.27/rules_cc-0.2.27.tar.gz",
)

load("@rules_cc//cc:extensions.bzl", "compatibility_proxy_repo")

compatibility_proxy_repo()

Full Changelog: bazelbuild/rules_cc@0.2.26...0.2.27

v0.2.26

Compare Source

Using bzlmod

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@ngcpp-dependency-manager
ngcpp-dependency-manager Bot force-pushed the auto/bump-renovate-deps branch 2 times, most recently from 17af327 to f66ffb6 Compare October 19, 2026 03:54

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants