From 7b56ec2945ce0d04b6793a202db187f3c911ee91 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 19:06:31 +0000 Subject: [PATCH 1/2] chore(deps): Update pymdown-extensions requirement Updates the requirements on [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions) to permit the latest version. - [Release notes](https://github.com/facelessuser/pymdown-extensions/releases) - [Commits](https://github.com/facelessuser/pymdown-extensions/compare/11.0.1...11.0.2) --- updated-dependencies: - dependency-name: pymdown-extensions dependency-version: 11.0.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- requirements-docs.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements-docs.txt b/requirements-docs.txt index f24e3a5..99e89c9 100644 --- a/requirements-docs.txt +++ b/requirements-docs.txt @@ -2,6 +2,6 @@ mkdocs>=1.6.1 mkdocs-material>=9.7.7 mkdocs-minify-plugin>=0.8 mkdocs-llmstxt>=0.5,<1.0 -pymdown-extensions>=11.0.1 +pymdown-extensions>=11.0.2 mkdocstrings[python]>=1.0.6 griffe>=2.2.0 From 3fa028b820069a630de70d1546f5fffe67152283 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Wed, 2 Sep 2026 10:33:44 -0700 Subject: [PATCH 2/2] test: compare the pymdown floor by version, not by literal pin test_docs_floor_excludes_vulnerable_pymdown_extensions asserted the exact string "pymdown-extensions>=11.0.1", so raising the floor to 11.0.2 failed it. A higher floor is strictly safer, so the test was failing on an improvement and would have failed on every future bump. Parse the pinned version and compare it against the 11.0.1 advisory boundary instead. Uses only the stdlib, since this file polices dependency floors and should not itself lean on an undeclared import. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_012yyHFd4YA35oNUjhrztJSb --- tests/unit/test_dependency_security_floors.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/tests/unit/test_dependency_security_floors.py b/tests/unit/test_dependency_security_floors.py index 6eae3ee..5623fbb 100644 --- a/tests/unit/test_dependency_security_floors.py +++ b/tests/unit/test_dependency_security_floors.py @@ -26,8 +26,14 @@ def test_a2a_sdk_extra_cannot_resolve_vulnerable_aiohttp() -> None: def test_docs_floor_excludes_vulnerable_pymdown_extensions() -> None: + # Compare parsed versions rather than the literal pin, so that raising the + # floor (which is always safer) does not fail this test. 11.0.1 is the first + # release without the advisory; anything at or above it is acceptable. requirements = Path("requirements-docs.txt").read_text(encoding="utf-8").splitlines() - assert "pymdown-extensions>=11.0.1" in requirements + pins = [line for line in requirements if line.startswith("pymdown-extensions>=")] + assert len(pins) == 1, f"expected exactly one pymdown-extensions floor, got {pins}" + floor = tuple(int(part) for part in pins[0].split(">=", 1)[1].strip().split(".")) + assert floor >= (11, 0, 1) def test_governance_tooling_cannot_downgrade_runtime_dependencies() -> None: