This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.
The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. GHSA-h75v-3vvj-5mfj
The xmlattr filter does not allow keys with / solidus, >
greater-than sign, or = equals sign, in addition to disallowing spaces.
Regardless of any validation done by Jinja, user input should never be used
as keys to this filter, or must be separately validated first.
:ghsa:h75v-3vvj-5mfj
Depend on mkdocstrings 0.25 which adds support for parameter once when logging messages (2bc156b by Timothée Mazzucotelli).
Code Refactoring
Set handler's name (a71ab12 by Timothée Mazzucotelli).
Update *.html top-level templates to extend the *.html.jinja base templates (a8c540e by Timothée Mazzucotelli). Issue-151
Update *.html base templates to extend their *.html.jinja counterpart, while overriding the logs block to issue a logging message (info) stating that extending *.html templates is deprecated (e6f1b9c by Timothée Mazzucotelli). Issue-151
Add *.html.jinja top-level (overridable) templates, extending their base counterpart (7c14924 by Timothée Mazzucotelli). Issue-151
Add *.html.jinja base templates, which are copies of *.html templates, with an additional logs block, and using the updated get_template filter (eced9a5 by Timothée Mazzucotelli). Issue-151
Update get_template filter to support both *.html and *.html.jinja templates, logging a message (info) when *.html templates are overridden by users (3546fd7 by Timothée Mazzucotelli). Issue-151
Log a warning when base templates are overridden (26e3d66 by Timothée Mazzucotelli). Issue-151
Depend on mkdocstrings 0.25 which adds support for parameter once when logging messages (2bc156b by Timothée Mazzucotelli).
Code Refactoring
Set handler's name (a71ab12 by Timothée Mazzucotelli).
Update *.html top-level templates to extend the *.html.jinja base templates (a8c540e by Timothée Mazzucotelli). Issue-151
Update *.html base templates to extend their *.html.jinja counterpart, while overriding the logs block to issue a logging message (info) stating that extending *.html templates is deprecated (e6f1b9c by Timothée Mazzucotelli). Issue-151
Add *.html.jinja top-level (overridable) templates, extending their base counterpart (7c14924 by Timothée Mazzucotelli). Issue-151
Add *.html.jinja base templates, which are copies of *.html templates, with an additional logs block, and using the updated get_template filter (eced9a5 by Timothée Mazzucotelli). Issue-151
Update get_template filter to support both *.html and *.html.jinja templates, logging a message (info) when *.html templates are overridden by users (3546fd7 by Timothée Mazzucotelli). Issue-151
Log a warning when base templates are overridden (26e3d66 by Timothée Mazzucotelli). Issue-151
It's not hanging, it'll finish eventually. It's just an example of catastrophic backtracking.
The error printed when Ctrl+C is pressed does show a bug, though, which is now fixed.
Version: 2024.5.10
Updated for Python 3.13.
<time.h> now needs to be included explicitly because Python.h no longer includes it.
Version: 2024.4.28
Git issue 527: `VERBOSE`/`X` flag breaks `\N` escapes
Version: 2024.4.16
Git issue 525: segfault when fuzzy matching empty list
Version: 2023.12.25
Cannot get release notification action in main.yml to work. Commenting it out for now.
Version: 2023.12.24
Fixed invalid main.yml.
Version: 2023.12.23
The escape function no longer escapes \x00. It's not necessary.
Inline flags can now be turned off and apply to what follows.
Added \R to match line endings.
Version: 2023.10.3
Updated to Unicode 15.1.0.
Version: 2023.8.8
Git issue 508: Regex doesn't build using CPython main (3.13.0a0)
Removed usage of _PyBytes_Join and did a little tidying of the code that makes the result string.
Version: 2023.6.3
Git issue 498: Conditional negative lookahead inside positive lookahead fails to match
... (truncated)
Commits
8eabb42 Git issue 530: hangs with fuzzy and optionals
To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed _get_connection to
a new public API, get_connection_with_tls_context. Existing custom
HTTPAdapters will need to migrate their code to use this new API.
get_connection is considered deprecated in all versions of Requests>=2.32.0.
A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. (#6710)
v2.32.1
2.32.1 (2024-05-20)
Bugfixes
Add missing test certs to the sdist distributed on PyPI.
verify=True now reuses a global SSLContext which should improve
request time variance between first and subsequent requests. It should
also minimize certificate load time on Windows systems when using a Python
version built with OpenSSL 3.x. (#6667)
Requests now supports optional use of character detection
(chardet or charset_normalizer) when repackaged or vendored.
This enables pip and other projects to minimize their vendoring
surface area. The Response.text() and apparent_encoding APIs
will default to utf-8 if neither library is present. (#6702)
Bugfixes
Fixed bug in length detection where emoji length was incorrectly
calculated in the request content-length. (#6589)
Fixed deserialization bug in JSONDecodeError. (#6629)
Fixed bug where an extra leading / (path separator) could lead
urllib3 to unnecessarily reparse the request URI. (#6644)
To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed _get_connection to
a new public API, get_connection_with_tls_context. Existing custom
HTTPAdapters will need to migrate their code to use this new API.
get_connection is considered deprecated in all versions of Requests>=2.32.0.
A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. (#6710)
2.32.1 (2024-05-20)
Bugfixes
Add missing test certs to the sdist distributed on PyPI.
verify=True now reuses a global SSLContext which should improve
request time variance between first and subsequent requests. It should
also minimize certificate load time on Windows systems when using a Python
version built with OpenSSL 3.x. (#6667)
Requests now supports optional use of character detection
(chardet or charset_normalizer) when repackaged or vendored.
This enables pip and other projects to minimize their vendoring
surface area. The Response.text() and apparent_encoding APIs
will default to utf-8 if neither library is present. (#6702)
Bugfixes
Fixed bug in length detection where emoji length was incorrectly
calculated in the request content-length. (#6589)
Fixed deserialization bug in JSONDecodeError. (#6629)
Fixed bug where an extra leading / (path separator) could lead
urllib3 to unnecessarily reparse the request URI. (#6644)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the dependencies group with 9 updates in the /.config directory:
2.19.1
2.21.0
0.44.0
0.45.1
3.1.3
3.1.4
1.8.1
1.8.3
9.5.21
9.5.24
1.10.0
1.10.2
4.2.1
4.2.2
2024.4.28
2024.5.15
2.31.0
2.32.2
Updates
pipdeptree
from 2.19.1 to 2.21.0Release notes
Sourced from pipdeptree's releases.
Commits
3c41d39
[pre-commit.ci] pre-commit autoupdate (#367)0f558b3
Implement --python auto for environment detection (#366)5cc7ba2
[pre-commit.ci] pre-commit autoupdate (#365)e88356f
Mimic pip when handling --user-only in a virtual environment (#364)1476bf7
[pre-commit.ci] pre-commit autoupdate (#363)4c832b5
Remove publish job from the check workflow (#361)a1bf845
[pre-commit.ci] pre-commit autoupdate (#360)Updates
griffe
from 0.44.0 to 0.45.1Release notes
Sourced from griffe's releases.
Changelog
Sourced from griffe's changelog.
Commits
88e7e71
chore: Prepare release 0.45.156f5363
fix: Fix loading of importable modules thanks to their__path__
attribute587346e
chore: Prepare release 0.45.0eeb497f
refactor: Improve stats code and performance721ce7d
docs: Fix example in SetMembersMixin docstringbc0f74b
fix: Pass down modules collection when inspecting776063d
feat: Implement-x
,--force-inspection
CLI option3266f22
feat: Implementforce_inspection
option in the loader API02b2d7c
tests: Moveclear_sys_modules
helper in a helper moduled0b7a1d
refactor: Recurse immediately into non-discoverable submodules (no path on di...Updates
jinja2
from 3.1.3 to 3.1.4Release notes
Sourced from jinja2's releases.
Changelog
Sourced from jinja2's changelog.
Commits
dd4a8b5
release version 3.1.40668239
Merge pull request from GHSA-h75v-3vvj-5mfjd655030
disallow invalid characters in keys to xmlattr filtera7863ba
add ghsa linksb5c98e7
start version 3.1.4da3a9f0
update project files (#1968)0ee5eb4
satisfy formatter, linter, and strict mypy20477c6
update project files (#5457)e491223
update pyyaml dev dependency36f9885
fix pr linkUpdates
markdown-exec
from 1.8.1 to 1.8.3Release notes
Sourced from markdown-exec's releases.
Changelog
Sourced from markdown-exec's changelog.
Commits
97de061
chore: Prepare release 1.8.3ba0c35e
fix: Don't leak future annotations in user code0a485b4
chore: Prepare release 1.8.2db25ee7
fix: Give__name__
to executed Python "modules", and populatesys.modules
...20b7570
ci: Fix installing project with extrasUpdates
mkdocs-material
from 9.5.21 to 9.5.24Release notes
Sourced from mkdocs-material's releases.
Changelog
Sourced from mkdocs-material's changelog.
... (truncated)
Commits
a5cc069
Prepare 9.5.24 release72caddf
Updated dependencies407335d
Fixed title rendering in version selectorf494840
Documented for scope settingbb6c698
Prepare 9.5.23 release3a27c80
Documentationcc398dd
Added support for displaying version aliases485fa76
Fixed edge case with anchor links when using instant navigationd68db58
Updated Cairo and pngquant installation instructions for Windows (#7163)5872958
Documentation (#7178)Updates
mkdocstrings-python
from 1.10.0 to 1.10.2Release notes
Sourced from mkdocstrings-python's releases.
Changelog
Sourced from mkdocstrings-python's changelog.
Commits
0b8a3a9
chore: Prepare release 1.10.25668abb
fix: Actually make use of custom .html.jinja templatesf7705ce
chore: Prepare release 1.10.16885009
ci: Remove unused type ignore comment5253358
docs: CorrectPrintOK
doctest examples583b8fe
docs: Document Jinja templatese7f997b
docs: Enable parameter headingscfdccd3
docs: Load Python-Markdown objects inventorya5f2723
docs: Document handler'supdate_env
methoda71ab12
refactor: Set handler's nameUpdates
platformdirs
from 4.2.1 to 4.2.2Release notes
Sourced from platformdirs's releases.
Commits
5ec69d8
Fix android detection when python4android is present (#277)dbf360f
[pre-commit.ci] pre-commit autoupdate (#280)b318012
[pre-commit.ci] pre-commit autoupdate (#279)120a441
[pre-commit.ci] pre-commit autoupdate (#278)Updates
regex
from 2024.4.28 to 2024.5.15Changelog
Sourced from regex's changelog.
... (truncated)
Commits
8eabb42
Git issue 530: hangs with fuzzy and optionalsbe139ff
Updated for Python 3.13.Updates
requests
from 2.31.0 to 2.32.2Release notes
Sourced from requests's releases.
... (truncated)
Changelog
Sourced from requests's changelog.
... (truncated)
Commits
88dce9d
v2.32.2c98e4d1
Merge pull request #6710 from nateprewitt/api_rename92075b3
Add deprecation warningaa1461b
Move _get_connection to get_connection_with_tls_context970e8ce
v2.32.1d6ebc4a
v2.32.09a40d12
Avoid reloading root certificates to improve concurrent performance (#6667)0c030f7
Merge pull request #6702 from nateprewitt/no_char_detection555b870
Allow character detection dependencies to be optional in post-packaging stepsd6dded3
Merge pull request #6700 from franekmagiera/update-redirect-to-invalid-uri-testDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show