dependabot[bot] opened a new pull request, #4234: URL: https://github.com/apache/iceberg-python/pull/4234
Bumps [mkdocs-material](https://github.com/squidfunk/mkdocs-material) from 9.7.7 to 9.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/squidfunk/mkdocs-material/releases";>mkdocs-material's releases</a>.</em></p> <blockquote> <h2>mkdocs-material-9.8.0</h2> <blockquote> <p>[!WARNING]</p> <p><strong>Material for MkDocs reaches end of life on May 5, 2027.</strong> Critical fixes and security updates continue until that date.</p> <p>We're continuing our work with <a href="https://zensical.org/";>Zensical</a>, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.</p> <p>You can evaluate Zensical alongside MkDocs using your existing <code>mkdocs.yml</code>. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The <code>classic</code> theme variant preserves the appearance of Material for MkDocs. See the <a href="https://zensical.org/docs/compatibility/mkdocs/migration/";>migration guide</a> for the steps and current compatibility details.</p> <p><a href="https://zensical.org/upcoming-changes/";>Upcoming changes on November 5</a></p> </blockquote> <p><strong>This is primarily a security release.</strong> It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.</p> <p><strong>Python 3.11 or newer is now required.</strong> Python 3.8–3.10 are no longer supported.</p> <ul> <li>Updated Node build-time dependencies to fix vulnerabilities</li> <li>Updated Python dependency minimums and required Python 3.11</li> <li>Removed RSS from recommended dependencies</li> <li>Updated project status and maintenance links</li> <li>Updated CLI notice with end-of-life and migration guidance</li> <li>Removed redirects from recommended dependencies</li> </ul> <p>Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional <code>git</code> and <code>imaging</code> extras, including GitPython 3.2.1 or newer for the <code>git</code> extra.</p> <p>Recent releases of <code>mkdocs-rss-plugin</code> and <code>mkdocs-redirects</code> depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the <code>recommended</code> extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.</p> <p>The CLI notice now gives the May 5, 2027 end-of-life date and links to the <a href="https://zensical.org/docs/compatibility/mkdocs/migration/";>Zensical migration guide</a>. It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.</p> <p>Selected Python security advisories addressed by the new minimums:</p> <table> <thead> <tr> <th>Dependency</th> <th>Affected versions</th> <th>New minimum</th> <th>Advisory</th> </tr> </thead> <tbody> <tr> <td>Jinja2</td> <td><code><=3.1.5</code></td> <td><code>3.1.6</code></td> <td><a href="https://github.com/advisories/GHSA-cpwx-vrp4-4pq7";>CVE-2025-27516</a></td> </tr> <tr> <td>Markdown</td> <td><code><3.8.1</code></td> <td><code>3.8.1</code></td> <td><a href="https://github.com/advisories/GHSA-5wmx-573v-2qwq";>CVE-2025-69534</a></td> </tr> <tr> <td>Pygments</td> <td><code><2.20.0</code></td> <td><code>2.20.0</code></td> <td><a href="https://github.com/advisories/GHSA-5239-wwwm-4pmq";>CVE-2026-4539</a></td> </tr> <tr> <td>PyMdown Extensions</td> <td><code><=11.0.0</code></td> <td><code>11.0.1</code></td> <td><a href="https://github.com/advisories/GHSA-gm37-52c6-37mw";>CVE-2026-67422</a></td> </tr> <tr> <td>Requests</td> <td><code><2.33.0</code></td> <td><code>2.33.0</code></td> <td><a href="https://github.com/advisories/GHSA-gc5v-m9x4-r6x2";>CVE-2026-25645</a></td> </tr> <tr> <td>Pillow</td> <td><code><13.0.0</code></td> <td><code>13.0.0</code></td> <td><a href="https://github.com/advisories/GHSA-p8hx-v2p6-rp84";>CVE-2026-96636</a></td> </tr> <tr> <td>CairoSVG</td> <td><code><=2.9.0</code></td> <td><code>2.9.1</code></td> <td><a href="https://github.com/advisories/GHSA-c3jg-qh8m-j3h2";>CVE-2026-107378</a></td> </tr> <tr> <td>GitPython</td> <td><code><=3.2.0</code></td> <td><code>3.2.1</code></td> <td><a href="https://github.com/advisories/GHSA-83vg-56qc-22m7";>CVE-2026-114145</a></td> </tr> </tbody> </table> <p>Pillow and CairoSVG apply to the <code>imaging</code> extra; GitPython applies to the <code>git</code> extra.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG";>mkdocs-material's changelog</a>.</em></p> <blockquote> <p>mkdocs-material-9.8.0 (2026-10-24)</p> <p>This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.</p> <p>Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.</p> <ul> <li>Updated Node build-time dependencies to fix vulnerabilities</li> <li>Updated Python dependency minimums and required Python 3.11</li> <li>Removed RSS from recommended dependencies</li> <li>Updated project status and maintenance links</li> <li>Updated CLI notice with end-of-life and migration guidance</li> <li>Removed redirects from recommended dependencies</li> </ul> <p>Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.</p> <p>Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.</p> <p>The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide: <a href="https://zensical.org/docs/compatibility/mkdocs/migration/";>https://zensical.org/docs/compatibility/mkdocs/migration/</a></p> <p>It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.</p> <p>Selected Python security advisories addressed by the new minimums:</p> <p>Jinja2: affected <=3.1.5; new minimum 3.1.6 (CVE-2025-27516) <a href="https://github.com/advisories/GHSA-cpwx-vrp4-4pq7";>https://github.com/advisories/GHSA-cpwx-vrp4-4pq7</a></p> <p>Markdown: affected <3.8.1; new minimum 3.8.1 (CVE-2025-69534) <a href="https://github.com/advisories/GHSA-5wmx-573v-2qwq";>https://github.com/advisories/GHSA-5wmx-573v-2qwq</a></p> <p>Pygments: affected <2.20.0; new minimum 2.20.0 (CVE-2026-4539) <a href="https://github.com/advisories/GHSA-5239-wwwm-4pmq";>https://github.com/advisories/GHSA-5239-wwwm-4pmq</a></p> <p>PyMdown Extensions: affected <=11.0.0; new minimum 11.0.1 (CVE-2026-67422) <a href="https://github.com/advisories/GHSA-gm37-52c6-37mw";>https://github.com/advisories/GHSA-gm37-52c6-37mw</a></p> <p>Requests: affected <2.33.0; new minimum 2.33.0 (CVE-2026-25645) <a href="https://github.com/advisories/GHSA-gc5v-m9x4-r6x2";>https://github.com/advisories/GHSA-gc5v-m9x4-r6x2</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/0f72ad68d1bee212f909f3b82e0189e221b06374";><code>0f72ad6</code></a> Merge pull request <a href="https://redirect.github.com/squidfunk/mkdocs-material/issues/8615";>#8615</a> from squidfunk/fix/security</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/85a048db32339ebad55b67b905f2ffb3f15b8fa0";><code>85a048d</code></a> Documentation</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/10c572eb70d1aef456a11f1fe2b0663388d70876";><code>10c572e</code></a> Prepare 9.8.0 release</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/dd8a7ef00afd76d3c413b5b1eab3ca7685b3350e";><code>dd8a7ef</code></a> Cleaned up unused assets</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/8771cef607ca69727b4ce4b1a1e2b27375260325";><code>8771cef</code></a> Updated README</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/7c9a1ccee2c0305b7f26579b744e5a5d3b100495";><code>7c9a1cc</code></a> Updated changelog</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/3ce93104a3efbc95a9aa3a6a8815296bf8127b24";><code>3ce9310</code></a> Removed redirects from recommended dependencies</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/0b77e8f999b19502b927779c78d763fcf60bbfb8";><code>0b77e8f</code></a> Updated CLI notice with end-of-life and migration guidance</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/66e4f9c7d83ade9d565e9c712f4a49896101bc41";><code>66e4f9c</code></a> Updated project status and maintenance links</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/1ed13d25e2da6c790c26df8ec3c079df827b3a8d";><code>1ed13d2</code></a> Removed RSS from recommended dependencies</li> <li>Additional commits viewable in <a href="https://github.com/squidfunk/mkdocs-material/compare/9.7.7...9.8.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
