* Babel 2.15.0 will require Python 3.8 or newer. (:gh:`1048`)
Features
* CLDR: Upgrade to CLDR 44 (:gh:`1071`) (@akx)
* Dates: Support for the "fall back to short format" logic for time delta formatting (:gh:`1075`) (@akx)
* Message: More versatile .po IO functions (:gh:`1068`) (@akx)
* Numbers: Improved support for alternate spaces when parsing numbers (:gh:`1007`) (@ronnix's first contribution)
Infrastructure
Upgrade GitHub Actions (:gh:1054) (@cclauss's first contribution)
The Unicode license is now included in locale-data and in the documentation (:gh:1074) (@akx)
This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.
The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. GHSA-h75v-3vvj-5mfj
3.1.3
This is a fix release for the 3.1.x feature branch.
Fix for GHSA-h5c8-rqwp-cp95. You are affected if you are using xmlattr and passing user input as attribute keys.
The xmlattr filter does not allow keys with / solidus, >
greater-than sign, or = equals sign, in addition to disallowing spaces.
Regardless of any validation done by Jinja, user input should never be used
as keys to this filter, or must be separately validated first.
:ghsa:h75v-3vvj-5mfj
Version 3.1.3
Released 2024-01-10
Fix compiler error when checking if required blocks in parent templates are
empty. :pr:1858
xmlattr filter does not allow keys with spaces. :ghsa:h5c8-rqwp-cp95
Make error messages stemming from invalid nesting of {% trans %} blocks
more helpful. :pr:1918
All postprocessors are now run on heading content.
Footnote references are now stripped from heading content. Fixes #660.
A more robust striptags is provided to convert headings to plain text.
Unlike, the markupsafe implementation, HTML entities are not unescaped.
The plain text name, rich html, and unescaped raw data-toc-label are
saved to toc_tokens, allowing users to access the full rich text content of
the headings directly from toc_tokens.
The value of data-toc-label is sanitized separate from heading content
before being written to name. This fixes a bug which allowed markup through
in certain circumstances. To access the raw unsanitized data, retrieve the
value from token['data-toc-label'] directly.
An html.unescape call is made just prior to calling slugify so that
slugify only operates on Unicode characters. Note that html.unescape is
not run on name, html, or data-toc-label.
The functions get_name and stashedHTML2text defined in the toc extension
are both deprecated. Instead, third party extensions should use some
combination of the new functions run_postprocessors, render_inner_html and
striptags.
Fixed
Include scripts/*.py in the generated source tarballs (#1430).
Ensure lines after heading in loose list are properly detabbed (#1443).
Give smarty tree processor higher priority than toc (#1440).
Permit carets (^) and square brackets (]) but explicitly exclude
backslashes (\) from abbreviations (#1444).
In attribute lists (attr_list, fenced_code), quoted attribute values are
now allowed to contain curly braces (}) (#1414).
Release 3.5.2
Fixed
Fix type annotations for convertFile - it accepts only bytes-based buffers.
Also remove legacy checks from Python 2 (#1400)
Remove legacy import needed only in Python 2 (#1403)
Fix typo that left the attribute AdmonitionProcessor.content_indent unset
(#1404)
Fix edge-case crash in InlineProcessor with AtomicString (#1406).
Fix edge-case crash in codehilite with an empty code tag (#1405).
Improve and expand type annotations in the code base (#1401).
All postprocessors are now run on heading content.
Footnote references are now stripped from heading content. Fixes #660.
A more robust striptags is provided to convert headings to plain text.
Unlike, the markupsafe implementation, HTML entities are not unescaped.
The plain text name, rich html, and unescaped raw data-toc-label are
saved to toc_tokens, allowing users to access the full rich text content of
the headings directly from toc_tokens.
The value of data-toc-label is sanitized separate from heading content
before being written to name. This fixes a bug which allowed markup through
in certain circumstances. To access the raw unsanitized data, retrieve the
value from token['data-toc-label'] directly.
An html.unescape call is made just prior to calling slugify so that
slugify only operates on Unicode characters. Note that html.unescape is
not run on name, html, or data-toc-label.
The functions get_name and stashedHTML2text defined in the toc extension
are both deprecated. Instead, third party extensions should use some
combination of the new functions run_postprocessors, render_inner_html and
striptags.
Fixed
Include scripts/*.py in the generated source tarballs (#1430).
Ensure lines after heading in loose list are properly detabbed (#1443).
Give smarty tree processor higher priority than toc (#1440).
Permit carets (^) and square brackets (]) but explicitly exclude
backslashes (\) from abbreviations (#1444).
In attribute lists (attr_list, fenced_code), quoted attribute values are
now allowed to contain curly braces (}) (#1414).
[3.5.2] -- 2024-01-10
Fixed
Fix type annotations for convertFile - it accepts only bytes-based buffers.
Also remove legacy checks from Python 2 (#1400)
Remove legacy import needed only in Python 2 (#1403)
Fix typo that left the attribute AdmonitionProcessor.content_indent unset
(#1404)
Fix edge-case crash in InlineProcessor with AtomicString (#1406).
Fix edge-case crash in codehilite with an empty code tag (#1405).
Improve and expand type annotations in the code base (#1401).
This is a fix release for the 2.1.x feature release branch. It fixes bugs but does not otherwise change behavior and should not result in breaking changes.
Fixes a regression in striptags behavior from 2.14. Spaces are now collapsed correctly.
This is a fix release for the 2.1.x feature release branch. It fixes bugs but does not otherwise change behavior and should not result in breaking changes.
Improves performance of the Markup.striptags method for large input.
👌 Add option for footnotes references to always be matched
Usually footnote references are only matched when a footnote definition of the same label has already been found. If always_match_refs=True, any [^...] syntax will be treated as a footnote.
Bumps the llvm-docs-requirements group in /llvm/docs with 21 updates:
7.2.67.3.70.20.10.21.22024.1.292024.5.62.0.03.0.10.7.130.7.162.14.02.15.04.12.24.12.32023.11.172024.7.43.63.73.1.23.1.43.5.13.62.1.32.1.50.4.00.4.123.224.12.17.22.18.02.31.02.32.31.0.51.0.62.0.42.0.51.0.61.0.71.1.91.1.102.1.02.2.2Updates
sphinxfrom 7.2.6 to 7.3.7Release notes
Sourced from sphinx's releases.
Changelog
Sourced from sphinx's changelog.
... (truncated)
Commits
de4ac2fBump to 7.3.7 final4a0c9ddReturn the default value for unsupported theme configuration sections62c3badRe-exportpy_sig_refrom the Python domain3bcc669Defer loading entry-point themes until neededfa4563fBump version630b4fbBump to 7.3.6 final740b964fixup! Elaborate a little more in the warning message forconfig.cache141f3ecElaborate a little more in the warning message forconfig.cacheaf27188Addconfig.cacheto the list of warning typesbe2b083Re-export more names insphinx.domains.python(#12297)Updates
docutilsfrom 0.20.1 to 0.21.2Updates
furofrom 2024.1.29 to 2024.5.6Changelog
Sourced from furo's changelog.
... (truncated)
Commits
b087e93Prepare release: 2024.05.06169c63dUpdate the changelogb7ec84dDrop discussion of Sphinx'sbasictheme2cd4d4aDemote the note about inherited frombasicconfiguration983d6c3Tweak the colours for APIversionmodifiedinformation1ffbf76Add release information to various customisation knobs2c386b9Use the appropriate Sphinx directive instead of weird textec8815aAdd (back?) support for RtD context inference on top of page buttons1b4cf89Bump the npm group with 5 updates (#793)ce8fb10Bump the github-actions group with 3 updates (#792)Updates
myst-parserfrom 2.0.0 to 3.0.1Release notes
Sourced from myst-parser's releases.
... (truncated)
Changelog
Sourced from myst-parser's changelog.
Commits
3d84ff8🚀 Release v3.0.1 (#926)790a926🐛 FIX: allow indented option block (#925)446feba🐛 FIX empty value for final directive option (#924)c9579c4📚 Update live preview (#921)1b44e06🚀 Release v3.0.0 (#920)5ad2d6d🔧 More improvements for directive option parsing (#919)8614eca📚 Update theme version (#918)5416b9f🔧 Update mypy to use sphinx v7.3 (#917)167c902⬆️ Update docutils requirement from >=0.16,<0.21 to >=0.18,<0.22 (#916)c00ef09📚 Fix architecture typo (#855) (#910)Updates
alabasterfrom 0.7.13 to 0.7.16Release notes
Sourced from alabaster's releases.
Changelog
Sourced from alabaster's changelog.
Commits
f3fdc04Bump to 0.7.1639cbbc1Do not display logo_name == 'false'd24c4cbBump to 0.7.1556f12deInclude documentation in the sdist2d8d038Adorn the LICENSE file with a suffixa31816cRemove obscenities (#173)166d6e7Replace © with unicode decimal code entity (#161)b9e8d79Deprecate canonical_url in favor of html_baseurl (#178)848e718Allow an arbitrary string in the logo_name option (#213)6922a16Improve sidebar stylesUpdates
babelfrom 2.14.0 to 2.15.0Release notes
Sourced from babel's releases.
Changelog
Sourced from babel's changelog.
Commits
40b194fPrepare for 2.15.0 release (#1079)c2e6c6eEncode support for the "fall back to short format" logic for time delta forma...1a03526Include Unicode license inlocale-dataand in documentation (#1074)c0fb56eAllow alternative space characters as group separator when parsing numbers (#...fe82fbcUse CLDR 44 and adjust tests to match new data (#1071)e0d1018Improve .po IO (#1068)40e60a1Upgrade GitHub Actions (#1054)2a1709aDrop support for Python 3.7 (EOL since June 2023) (#1048)Updates
beautifulsoup4from 4.12.2 to 4.12.3Updates
certififrom 2023.11.17 to 2024.7.4Commits
bd815382024.07.04 (#295)06a2cbfBump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (#294)13bba02Bump actions/checkout from 4.1.6 to 4.1.7 (#293)e8abcd0Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (#292)124f4ad2024.06.02 (#291)c2196ce--- (#290)fefdeecBump actions/checkout from 4.1.4 to 4.1.5 (#289)3c5fb15Bump actions/download-artifact from 4.1.6 to 4.1.7 (#286)4a9569aBump actions/checkout from 4.1.2 to 4.1.4 (#287)1fc8086Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (#288)Updates
idnafrom 3.6 to 3.7Release notes
Sourced from idna's releases.
Changelog
Sourced from idna's changelog.
Commits
1d365e1Release v3.7c1b3154Merge pull request #172 from kjd/optimize-contextj0394ec7Merge branch 'master' into optimize-contextjcd58a23Merge pull request #152 from elliotwutingfeng/dev5beb28bMore efficient resolution of joiner contexts1b12148Update ossf/scorecard-action to v2.3.1d516b87Update Github actions/checkout to v4c095c75Merge branch 'master' into dev60a0a4cFix typo in GitHub Actions workflow key5918a0eMerge branch 'master' into devUpdates
jinja2from 3.1.2 to 3.1.4Release notes
Sourced from jinja2's releases.
Changelog
Sourced from jinja2's changelog.
Commits
dd4a8b5release version 3.1.40668239Merge pull request from GHSA-h75v-3vvj-5mfjd655030disallow invalid characters in keys to xmlattr filtera7863baadd ghsa linksb5c98e7start version 3.1.4da3a9f0update project files (#1968)0ee5eb4satisfy formatter, linter, and strict mypy20477c6update project files (#5457)e491223update pyyaml dev dependency36f9885fix pr linkUpdates
markdownfrom 3.5.1 to 3.6Release notes
Sourced from markdown's releases.
Changelog
Sourced from markdown's changelog.
Commits
e524b8fBump version to 3.63d8afc6Allow attr_list quoted values to contain curly braces9edba85Refactor abbr escapinge4ab4a6Refactor TOC sanitationa18765cExplicitly omit carot and backslash from abbr421f1e8Give smarty tree processor higher priority than tocc334a3eEnsure lines after heading in loose list are properly detabbedea92856Update the license template so GitHub can detect ita2effd6Disable mkdocstrings show_symbol_type_toc option to work around searching iss...91f9a12Restore Attribute symbol type in mkdocstrings templateUpdates
markupsafefrom 2.1.3 to 2.1.5Release notes
Sourced from markupsafe's releases.
Changelog
Sourced from markupsafe's changelog.
Commits
fbba4acrelease version 2.1.5c5fa23bupdate publish actions60a6512striptags collapses spaces correctly (#418)0b6bee0collapse spaces after stripping tags73e6a48start version 2.1.5d704bf4use pip-compile, dependabot updates (#419)1f82932use pip-compile, dependabot updates25a640frelease version 2.1.4 (#414)b7cd652release version 2.1.43bead8eupdate cibuildwheel for 3.12 wheelsUpdates
mdit-py-pluginsfrom 0.4.0 to 0.4.1Release notes
Sourced from mdit-py-plugins's releases.
Changelog
Sourced from mdit-py-plugins's changelog.
Commits
d11bdaf🚀 Release v0.4.1 (#110)aa1f557🧪 Test against 3.12 (#109)33c27e0👌 Add option for footnotes references to always be matched (#108)7762458🔧 Use ruff-format (#107)950908b[pre-commit.ci] pre-commit autoupdate (#100)This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.
To ignore these dependencies, configure ignore rules in dependabot.yml