Skip to content

Bump: Bump the python-deps group across 1 directory with 2 updates - #11

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-deps-52c8e2eb17
Open

Bump: Bump the python-deps group across 1 directory with 2 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-deps-52c8e2eb17

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on markdown and weasyprint to permit the latest version.
Updates markdown to 3.11

Changelog

Sourced from markdown's changelog.

title: Changelog toc_depth: 2

Python-Markdown Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to the Python Version Specification. See the Contributing Guide for details.

[3.11.0] - 2026-09-25

Changed

  • Inline processors now resume searching after the previous match, improving performance for repeated inline patterns (#1619).
  • Officially support Python 3.15 and drop support for Python 3.10
  • Walk backtick runs in BacktickInlineProcessor without a regex (#1620).
  • Switch static site generator for documentation from MkDocs to Zensical (#1627, #1635, #1637, and #1638).

Fixed

  • Ensure removing Abbreviations does not raise an error (#1634).
  • Fix an issue with excessive backtracking when matching inline code blocks (#1617).
  • md_in_html now honors tags added to Markdown.block_level_elements after the extension is loaded (#1246).
  • Fix quadratic-time regex backtracking in ReferenceProcessor when a link reference definition has no URL, e.g. a line consisting only of [id]: followed by many trailing spaces (#798).
  • Document attr_list usage for def_list (#1123).

[3.10.3] - 2026-07-30

Fixed

  • Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
  • Add AI Policy to Contributing Guide.
  • Officially document all included extensions as being in maintenance mode.
  • Link the Extension API documentation to the API Reference (#1612).

[3.10.2] - 2026-02-09

Fixed

  • Fix a regression related to comment handling (#1590).

... (truncated)

Commits
  • 0ffbf00 Bump version to 3.11.0
  • 547a934 Show adminitions as rendered examples in contrbuting guide
  • 571f050 Cleanup archived changelog
  • a5176b0 Ensure py-render codeblock title in properly escaped.
  • 819fff9 Document the use of attr_list with def_list.
  • 36cdbd3 Final cleanup for Zensical transition
  • 8a96db5 Add py-render custom code block formater
  • 5d1363c Fix quadratic-time backtracking when a reference link has no URL
  • 0d6afd1 Add Markdown renderer as superfences formatter
  • 175fb5a Ensure removing Abbreviations does not raise an error.
  • Additional commits viewable in compare view

Updates weasyprint to 70.0

Release notes

Sourced from weasyprint's releases.

v70.0

Read about this release on our blog.

This is a security update (CVE-2026-55073, GHSA-r543-q48m-4c9j).

We strongly recommend to upgrade WeasyPrint to the latest version if you: * embed untrusted images, or * rely on the URL fetcher to filter metadata or stylesheets passed as Python parameters.

Security

  • Don’t render EPS images.
  • Always use original URL fetcher when available.

Features

  • #2905: Add initial support of CSS Notes, with financial support from NLnet
  • #2731, #2781: Log an error on unknown render and write_pdf options
  • #2802, #2805: Create immutable releases on GitHub
  • #2809, #2810: Switch to MSYS2 UCRT64 environment for Windows tests and executables
  • #2777, #2814: Support COLR emoji fonts
  • #2667, #2744: Support context paint in SVG markers
  • #1862, #2844: Improve filename detection for attachments
  • #2816, #2827: Set SVG title as alternative text
  • #2718: Provide a 'onedir' Windows executable
  • #2863: Support box-shadow
  • #2755: Support RTL SVG text anchoring
  • #2866: Don’t use f-strings in logs

Bug fixes

  • #2799: Keep HarfBuzz font faces alive during PDF subsetting
  • #2764, #2793: Accept Path as base URL in CSS
  • #2800, #2801: Fix position of raster emojis
  • #2782, #2807: Use POSIX paths in Fontconfig
  • #2766, #2779: Use response bytes when image file path doesn’t exist
  • #2277, #2728: Honor page breaks on floated elements
  • #2789, #2818: Use base URL when solving pending properties
  • #2820: Ignore unresolvable math in image slices
  • #2901, #2825: Transform SVG size into CSS to apply CSS sizing algorithm
  • #2819: Resolve calc() division by zero to infinity
  • #2824: Remove old deprecation warnings
  • #2762, #2780: Set SVG gradient color before path construction
  • #2761: Handle split tables with captions
  • #2215, #2747: Discard broken at-rules
  • #2736, #2738: Apply transformations to SVG opacity groups
  • #2830: Use a stack to draw simple borders
  • #2831: Fix line_height() crash on calc() values
  • #2784, #2832: Set fallback font for Unicode test
  • #2726, #2881: Improve accessibility of PDF forms
  • #2803: Fix inline width after backtracked line breaks
  • #2833: Store root style in anonymous style

... (truncated)

Changelog

Sourced from weasyprint's changelog.

Version 70.0

Released on 2026-09-08.

This is a security update (CVE-2026-55073, GHSA-r543-q48m-4c9j).

We strongly recommend to upgrade WeasyPrint to the latest version if you:

  • embed untrusted images, or
  • rely on the URL fetcher to filter metadata or stylesheets passed as Python parameters.

Security:

  • Don’t render EPS images.
  • Always use original URL fetcher when available.

Features:

  • [#2905](https://github.com/Kozea/WeasyPrint/issues/2905) <https://github.com/Kozea/WeasyPrint/pull/2905>_: Add initial support of CSS Notes, with financial support from NLnet
  • [#2731](https://github.com/Kozea/WeasyPrint/issues/2731) <https://github.com/Kozea/WeasyPrint/issues/2731>, [#2781](https://github.com/Kozea/WeasyPrint/issues/2781) <https://github.com/Kozea/WeasyPrint/pull/2781>: Log an error on unknown render and write_pdf options
  • [#2802](https://github.com/Kozea/WeasyPrint/issues/2802) <https://github.com/Kozea/WeasyPrint/issues/2802>, [#2805](https://github.com/Kozea/WeasyPrint/issues/2805) <https://github.com/Kozea/WeasyPrint/pull/2805>: Create immutable releases on GitHub
  • [#2809](https://github.com/Kozea/WeasyPrint/issues/2809) <https://github.com/Kozea/WeasyPrint/issues/2809>, [#2810](https://github.com/Kozea/WeasyPrint/issues/2810) <https://github.com/Kozea/WeasyPrint/pull/2810>: Switch to MSYS2 UCRT64 environment for Windows tests and executables
  • [#2777](https://github.com/Kozea/WeasyPrint/issues/2777) <https://github.com/Kozea/WeasyPrint/issues/2777>, [#2814](https://github.com/Kozea/WeasyPrint/issues/2814) <https://github.com/Kozea/WeasyPrint/pull/2814>: Support COLR emoji fonts
  • [#2667](https://github.com/Kozea/WeasyPrint/issues/2667) <https://github.com/Kozea/WeasyPrint/issues/2667>, [#2744](https://github.com/Kozea/WeasyPrint/issues/2744) <https://github.com/Kozea/WeasyPrint/pull/2744>: Support context paint in SVG markers
  • [#1862](https://github.com/Kozea/WeasyPrint/issues/1862) <https://github.com/Kozea/WeasyPrint/issues/1862>, [#2844](https://github.com/Kozea/WeasyPrint/issues/2844) <https://github.com/Kozea/WeasyPrint/pull/2844>: Improve filename detection for attachments
  • [#2816](https://github.com/Kozea/WeasyPrint/issues/2816) <https://github.com/Kozea/WeasyPrint/issues/2816>, [#2827](https://github.com/Kozea/WeasyPrint/issues/2827) <https://github.com/Kozea/WeasyPrint/pull/2827>: Set SVG title as alternative text
  • [#2718](https://github.com/Kozea/WeasyPrint/issues/2718) <https://github.com/Kozea/WeasyPrint/issues/2718>_: Provide a 'onedir' Windows executable
  • [#2863](https://github.com/Kozea/WeasyPrint/issues/2863) <https://github.com/Kozea/WeasyPrint/pull/2863>_: Support box-shadow
  • [#2755](https://github.com/Kozea/WeasyPrint/issues/2755) <https://github.com/Kozea/WeasyPrint/pull/2755>_: Support RTL SVG text anchoring
  • [#2866](https://github.com/Kozea/WeasyPrint/issues/2866) <https://github.com/Kozea/WeasyPrint/issues/2866>_: Don’t use f-strings in logs

... (truncated)

Commits
  • 4d3b7b6 Version 70.0
  • 289e278 Always use original URL fetcher when available
  • aeb3be7 Merge remote-tracking branch 'security/main'
  • 4835724 Merge pull request #2915 from havelaer/fix-nested-svg-viewport-restore
  • 0331051 Restore nested SVG viewport size on the SVG object, not the drawing function
  • e4b8b45 Add harfbuzz-vector requirement for Fedora
  • 371e4de Merge pull request #2905 from Kozea/notes
  • 590bf63 Merge pull request #2913 from Kozea/fast-svg-paths
  • f6570c3 Use a faster regex-based parser for SVG paths
  • bc05162 Use faster deque for SVG vertices
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump: Bump the python-deps group across 1 directory with 2 updates
e6d206c 
Updates the requirements on [markdown](https://github.com/Python-Markdown/markdown) and [weasyprint](https://github.com/Kozea/WeasyPrint) to permit the latest version.

Updates `markdown` to 3.11
- [Release notes](https://github.com/Python-Markdown/markdown/releases)
- [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md)
- [Commits](Python-Markdown/markdown@3.10.3...3.11.0)

Updates `weasyprint` to 70.0
- [Release notes](https://github.com/Kozea/WeasyPrint/releases)
- [Changelog](https://github.com/Kozea/WeasyPrint/blob/main/docs/changelog.rst)
- [Commits](Kozea/WeasyPrint@v69.0...v70.0)

---
updated-dependencies:
- dependency-name: markdown
  dependency-version: '3.11'
  dependency-type: direct:production
  dependency-group: python-deps
- dependency-name: weasyprint
  dependency-version: '70.0'
  dependency-type: direct:production
  dependency-group: python-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants