This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.
The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. GHSA-h75v-3vvj-5mfj
The xmlattr filter does not allow keys with / solidus, >
greater-than sign, or = equals sign, in addition to disallowing spaces.
Regardless of any validation done by Jinja, user input should never be used
as keys to this filter, or must be separately validated first.
:ghsa:h75v-3vvj-5mfj
Depend on mkdocstrings 0.25 which adds support for parameter once when logging messages (2bc156b by Timothée Mazzucotelli).
Code Refactoring
Set handler's name (a71ab12 by Timothée Mazzucotelli).
Update *.html top-level templates to extend the *.html.jinja base templates (a8c540e by Timothée Mazzucotelli). Issue-151
Update *.html base templates to extend their *.html.jinja counterpart, while overriding the logs block to issue a logging message (info) stating that extending *.html templates is deprecated (e6f1b9c by Timothée Mazzucotelli). Issue-151
Add *.html.jinja top-level (overridable) templates, extending their base counterpart (7c14924 by Timothée Mazzucotelli). Issue-151
Add *.html.jinja base templates, which are copies of *.html templates, with an additional logs block, and using the updated get_template filter (eced9a5 by Timothée Mazzucotelli). Issue-151
Update get_template filter to support both *.html and *.html.jinja templates, logging a message (info) when *.html templates are overridden by users (3546fd7 by Timothée Mazzucotelli). Issue-151
Log a warning when base templates are overridden (26e3d66 by Timothée Mazzucotelli). Issue-151
Depend on mkdocstrings 0.25 which adds support for parameter once when logging messages (2bc156b by Timothée Mazzucotelli).
Code Refactoring
Set handler's name (a71ab12 by Timothée Mazzucotelli).
Update *.html top-level templates to extend the *.html.jinja base templates (a8c540e by Timothée Mazzucotelli). Issue-151
Update *.html base templates to extend their *.html.jinja counterpart, while overriding the logs block to issue a logging message (info) stating that extending *.html templates is deprecated (e6f1b9c by Timothée Mazzucotelli). Issue-151
Add *.html.jinja top-level (overridable) templates, extending their base counterpart (7c14924 by Timothée Mazzucotelli). Issue-151
Add *.html.jinja base templates, which are copies of *.html templates, with an additional logs block, and using the updated get_template filter (eced9a5 by Timothée Mazzucotelli). Issue-151
Update get_template filter to support both *.html and *.html.jinja templates, logging a message (info) when *.html templates are overridden by users (3546fd7 by Timothée Mazzucotelli). Issue-151
Log a warning when base templates are overridden (26e3d66 by Timothée Mazzucotelli). Issue-151
It's not hanging, it'll finish eventually. It's just an example of catastrophic backtracking.
The error printed when Ctrl+C is pressed does show a bug, though, which is now fixed.
Version: 2024.5.10
Updated for Python 3.13.
<time.h> now needs to be included explicitly because Python.h no longer includes it.
Version: 2024.4.28
Git issue 527: `VERBOSE`/`X` flag breaks `\N` escapes
Version: 2024.4.16
Git issue 525: segfault when fuzzy matching empty list
Version: 2023.12.25
Cannot get release notification action in main.yml to work. Commenting it out for now.
Version: 2023.12.24
Fixed invalid main.yml.
Version: 2023.12.23
The escape function no longer escapes \x00. It's not necessary.
Inline flags can now be turned off and apply to what follows.
Added \R to match line endings.
Version: 2023.10.3
Updated to Unicode 15.1.0.
Version: 2023.8.8
Git issue 508: Regex doesn't build using CPython main (3.13.0a0)
Removed usage of _PyBytes_Join and did a little tidying of the code that makes the result string.
Version: 2023.6.3
Git issue 498: Conditional negative lookahead inside positive lookahead fails to match
... (truncated)
Commits
8eabb42 Git issue 530: hangs with fuzzy and optionals
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the dependencies group with 7 updates in the /.config directory:
0.44.0
0.45.1
3.1.3
3.1.4
9.5.21
9.5.23
1.10.0
1.10.2
2.19.1
2.20.0
4.2.1
4.2.2
2024.4.28
2024.5.15
Updates
griffe
from 0.44.0 to 0.45.1Release notes
Sourced from griffe's releases.
Changelog
Sourced from griffe's changelog.
Commits
88e7e71
chore: Prepare release 0.45.156f5363
fix: Fix loading of importable modules thanks to their__path__
attribute587346e
chore: Prepare release 0.45.0eeb497f
refactor: Improve stats code and performance721ce7d
docs: Fix example in SetMembersMixin docstringbc0f74b
fix: Pass down modules collection when inspecting776063d
feat: Implement-x
,--force-inspection
CLI option3266f22
feat: Implementforce_inspection
option in the loader API02b2d7c
tests: Moveclear_sys_modules
helper in a helper moduled0b7a1d
refactor: Recurse immediately into non-discoverable submodules (no path on di...Updates
jinja2
from 3.1.3 to 3.1.4Release notes
Sourced from jinja2's releases.
Changelog
Sourced from jinja2's changelog.
Commits
dd4a8b5
release version 3.1.40668239
Merge pull request from GHSA-h75v-3vvj-5mfjd655030
disallow invalid characters in keys to xmlattr filtera7863ba
add ghsa linksb5c98e7
start version 3.1.4da3a9f0
update project files (#1968)0ee5eb4
satisfy formatter, linter, and strict mypy20477c6
update project files (#5457)e491223
update pyyaml dev dependency36f9885
fix pr linkUpdates
mkdocs-material
from 9.5.21 to 9.5.23Release notes
Sourced from mkdocs-material's releases.
Changelog
Sourced from mkdocs-material's changelog.
... (truncated)
Commits
bb6c698
Prepare 9.5.23 release3a27c80
Documentationcc398dd
Added support for displaying version aliases485fa76
Fixed edge case with anchor links when using instant navigationd68db58
Updated Cairo and pngquant installation instructions for Windows (#7163)5872958
Documentation (#7178)aa48be3
Updated dependenciesb2b6571
Prepare 9.5.22 release78fd41a
Updated dependenciesceacfe5
Fixed stay on same page for version selector (9.5.5 regression)Updates
mkdocstrings-python
from 1.10.0 to 1.10.2Release notes
Sourced from mkdocstrings-python's releases.
Changelog
Sourced from mkdocstrings-python's changelog.
Commits
0b8a3a9
chore: Prepare release 1.10.25668abb
fix: Actually make use of custom .html.jinja templatesf7705ce
chore: Prepare release 1.10.16885009
ci: Remove unused type ignore comment5253358
docs: CorrectPrintOK
doctest examples583b8fe
docs: Document Jinja templatese7f997b
docs: Enable parameter headingscfdccd3
docs: Load Python-Markdown objects inventorya5f2723
docs: Document handler'supdate_env
methoda71ab12
refactor: Set handler's nameUpdates
pipdeptree
from 2.19.1 to 2.20.0Release notes
Sourced from pipdeptree's releases.
Commits
e88356f
Mimic pip when handling --user-only in a virtual environment (#364)1476bf7
[pre-commit.ci] pre-commit autoupdate (#363)4c832b5
Remove publish job from the check workflow (#361)a1bf845
[pre-commit.ci] pre-commit autoupdate (#360)Updates
platformdirs
from 4.2.1 to 4.2.2Release notes
Sourced from platformdirs's releases.
Commits
5ec69d8
Fix android detection when python4android is present (#277)dbf360f
[pre-commit.ci] pre-commit autoupdate (#280)b318012
[pre-commit.ci] pre-commit autoupdate (#279)120a441
[pre-commit.ci] pre-commit autoupdate (#278)Updates
regex
from 2024.4.28 to 2024.5.15Changelog
Sourced from regex's changelog.
... (truncated)
Commits
8eabb42
Git issue 530: hangs with fuzzy and optionalsbe139ff
Updated for Python 3.13.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show