[dependabot]

Bumps the minor-updates group with 4 updates in the / directory: mkdocs-material, mkdocs-git-revision-date-localized-plugin, pytz and platformdirs.

Updates mkdocs-material from 9.7.7 to 9.8.0

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.8.0

[!WARNING]

Material for MkDocs reaches end of life on May 5, 2027. Critical fixes and security updates continue until that date.

We're continuing our work with Zensical, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.

You can evaluate Zensical alongside MkDocs using your existing mkdocs.yml. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The classic theme variant preserves the appearance of Material for MkDocs. See the migration guide for the steps and current compatibility details.

Upcoming changes on November 5

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

• Updated Node build-time dependencies to fix vulnerabilities
• Updated Python dependency minimums and required Python 3.11
• Removed RSS from recommended dependencies
• Updated project status and maintenance links
• Updated CLI notice with end-of-life and migration guidance
• Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide. It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Dependency	Affected versions	New minimum	Advisory
Jinja2	<=3.1.5	3.1.6	CVE-2025-27516
Markdown	<3.8.1	3.8.1	CVE-2025-69534
Pygments	<2.20.0	2.20.0	CVE-2026-4539
PyMdown Extensions	<=11.0.0	11.0.1	CVE-2026-67422
Requests	<2.33.0	2.33.0	CVE-2026-25645
Pillow	<13.0.0	13.0.0	CVE-2026-96636
CairoSVG	<=2.9.0	2.9.1	CVE-2026-107378
GitPython	<=3.2.0	3.2.1	CVE-2026-114145

Pillow and CairoSVG apply to the imaging extra; GitPython applies to the git extra.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.8.0 (2026-10-24)

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

• Updated Node build-time dependencies to fix vulnerabilities
• Updated Python dependency minimums and required Python 3.11
• Removed RSS from recommended dependencies
• Updated project status and maintenance links
• Updated CLI notice with end-of-life and migration guidance
• Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide: https://zensical.org/docs/compatibility/mkdocs/migration/

It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Jinja2: affected <=3.1.5; new minimum 3.1.6 (CVE-2025-27516) GHSA-cpwx-vrp4-4pq7

Markdown: affected <3.8.1; new minimum 3.8.1 (CVE-2025-69534) GHSA-5wmx-573v-2qwq

Pygments: affected <2.20.0; new minimum 2.20.0 (CVE-2026-4539) GHSA-5239-wwwm-4pmq

PyMdown Extensions: affected <=11.0.0; new minimum 11.0.1 (CVE-2026-67422) GHSA-gm37-52c6-37mw

Requests: affected <2.33.0; new minimum 2.33.0 (CVE-2026-25645) GHSA-gc5v-m9x4-r6x2

... (truncated)

Commits

• 0f72ad6 Merge pull request #8615 from squidfunk/fix/security
• 85a048d Documentation
• 10c572e Prepare 9.8.0 release
• dd8a7ef Cleaned up unused assets
• 8771cef Updated README
• 7c9a1cc Updated changelog
• 3ce9310 Removed redirects from recommended dependencies
• 0b77e8f Updated CLI notice with end-of-life and migration guidance
• 66e4f9c Updated project status and maintenance links
• 1ed13d2 Removed RSS from recommended dependencies
• Additional commits viewable in compare view

Updates mkdocs-git-revision-date-localized-plugin from 1.5.4 to 1.6.2

Release notes

Sourced from mkdocs-git-revision-date-localized-plugin's releases.

v1.6.2

Fixes

• mkdocs serve now picks up commits made while it runs, including amended commits and changes to the ignored commits file. With --dirty, the initial build is also faster (#215, #236).
• Generated pages get one stable timestamp per build, so both dates match and strict builds no longer warn about them (#231, #232 by @​akashchamp, #237).

Performance

• When enable_creation_date is off, the plugin no longer looks up creation commits. This roughly halves build time on large sites (#238).

v1.6.1

Security

• Require GitPython >= 3.2.1, which fixes a remote code execution issue in submodule cloning (GHSA for GitPython "validates a submodule's .git path only after cloning into it").

Maintenance

• Python 3.10 is end-of-life and no longer tested. It can still be installed, but it is no longer supported.

v1.6.0

Highlights

Faster builds

Every page asked git which tag pointed at its commit, and asked again for the site-wide revision commit — the same answer, recomputed for each page. Those lookups are now cached.

The bigger your site, the more you save: on a 1000 page site this removes roughly 18 seconds of build time.

custom_format keeps your own words

If your format had any text around the date directives, that text came out scrambled:

custom_format: "Updated on %d %B %Y"

before:   Up23AMt723 on 23 January 2022
now:      Updated on 23 January 2022

Any format that was made up purely of % directives (including the %d. %B %Y default) was unaffected and still renders exactly as before. Unrecognised directives such as %Q are now left alone instead of being quietly reinterpreted as a different date field.

Creation date commit hash and tag now work

page.meta.git_creation_date_localized_hash and page.meta.git_creation_date_localized_tag were documented but always came back empty. If you use them in a theme override to link back to the commit or release that introduced a page, they now contain what you expect.

Shallow clone warnings reach more setups

The warning that tells you your dates will be wrong because CI only fetched part of the history was silently skipped whenever your .git was not in the directory you ran mkdocs from — a repository inside docs/, or a temporary checkout made by plugins such as monorepo. It now fires there too.

... (truncated)

Commits

• a33e3c0 Bump version to 1.6.2
• bf1f5b0 Merge pull request #238 from timvink/perf/skip-creation-lookups
• 6706d87 Start each benchmark and test build like mkdocs build does
• 275a549 Add build benchmark script for creation date lookups
• cdd3385 Skip creation commit lookups when creation dates are disabled
• 2b8237e Add failing test for creation commit lookups with creation dates disabled
• a14fd9a Merge pull request #236 from timvink/fix/serve-stale-commit-cache
• 6e8aca2 Address Fable review of the serve cache invalidation
• 78469fb Address codex review of the serve cache invalidation
• 72686cf Add failing tests for codex review findings on serve cache
• Additional commits viewable in compare view

Updates pytz from 2026.1.post1 to 2026.6

Commits

• e3c6fe2 Bump version numbers to 2026.6/2026f
• 23e2e67 IANA 2026f
• e6f3078 Squashed 'tz/' changes from 039ef27cc5..d8acf4bc22
• 21be17f Add Python 3.14 to test suite
• fddd01c Bump version numbers to 2026.5 (2026e)
• d79605f Squashed 'tz/' changes from d633fe7ed3..db07415c7d
• 8f05ab3 IANA 2026e
• 1ac6e51 Bump version numbers to 2026.4 (2026d)
• 1672798 IANA 2026d
• 0b5995b Squashed 'tz/' changes from 71f28b9ab3..bac9223f4b
• Additional commits viewable in compare view

Updates platformdirs from 4.13.5 to 4.14.3

Release notes

Sourced from platformdirs's releases.

4.14.3

Bug fixes

• Preserve trailing whitespace in absolute XDG directory values instead of resolving a different directory (#679) by @​mikegit123git and @​gaborbernat.

New Contributors

• @​mikegit123git made their first contribution in tox-dev/platformdirs#679

PyPI release

Full Changelog

4.14.2

Bug fixes

• Deduplicate equivalent XDG directory spellings across string and path iterators and file searches (#677) by @​AlvaroBalbin and @​gaborbernat.

New Contributors

• @​AlvaroBalbin made their first contribution in tox-dev/platformdirs#677

PyPI release

Full Changelog

4.14.0

Features

• Accept a keyword-only ensure_exists in the module-level media directory functions, such as user_documents_path, to create a directory set through XDG_*_DIR or user-dirs.dirs (#656) by @​darrenhuai and @​gaborbernat.

Bug fixes

• Return the media and fonts directories under root's home for root with use_site_for_root, ignoring the invoking user's XDG_*_DIR, user-dirs.dirs and XDG_DATA_HOME, and create no inherited media directory under ensure_exists (#661) by @​gaborbernat.
• Raise ValueError from site_data_dir and site_config_dir under multipath=True when appname or version contains os.pathsep, rather than returning a string that splits into a directory outside the site base (#662) by @​gaborbernat.
• Parse an unquoted user-dirs.dirs value with a long run of blanks in linear time, rather than in time quadratic in the run's length on every Unix media directory lookup (#663) by @​gaborbernat.
• Treat a relative HOME as unset on Unix, macOS and iOS, taking the home from the password database or raising RuntimeError, rather than resolving user directories against the working directory (#664) by @​gaborbernat.
• Refuse a symlink as XDG_RUNTIME_DIR in user_runtime_dir when the value ends with / or /., which made the check follow the link (#665) by @​gaborbernat.
• Redirect user_*_dir calls with use_site_for_root=True when the effective uid is 0, so a setuid-root process gets the site directories, and name and check the runtime directory by the effective uid (#666) by @​gaborbernat.
• Apply the XDG_RUNTIME_DIR check of the Unix user_runtime_dir to the macOS one, so it no longer uses a directory that is a symlink, owned by another user or not mode 0700 (#667) by @​gaborbernat.
• Reject an XDG_RUNTIME_DIR below a parent that another user can replace, such as their own entry in /tmp, instead of creating the runtime directory through it (#668) by @​gaborbernat.
• Stop accepting a Unix runtime directory that another user creates between the owner check and its use: ensure_exists and place_runtime_file create it before checking it, and find_runtime_file checks it again after a hit (#669) by @​gaborbernat.

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-14-5:

---

4.14.5 (2026-11-04)

---

.. _release-4-14-5-fixed:

Fixed

• Resolve the temporary :func:~platformdirs.user_runtime_dir fallback to /runtime-<uid> instead of //runtime-<uid> when the temporary directory is / (:pr:687) by :user:darrenhuai and :user:gaborbernat.

.. _release-4-14-4:

---

4.14.4 (2026-11-04)

---

.. _release-4-14-3:

---

4.14.3 (2026-11-01)

---

.. _release-4-14-3-fixed:

Fixed

• Preserve trailing whitespace in absolute XDG directory values instead of resolving a different directory (:pr:679) by :user:mikegit123git and :user:gaborbernat.

.. _release-4-14-2:

---

4.14.2 (2026-10-31)

---

.. _release-4-14-2-fixed:

... (truncated)

Commits

• 099c969 release 4.14.3
• 7fbe87d 🐛 fix(xdg): preserve whitespace in paths (#679)
• 1d34ad1 release 4.14.2
• 3b870de 🐛 fix(xdg): deduplicate directory spellings (#677)
• 17c6932 release 4.14.1
• d7abc29 fix: restore Pyodide imports without an effective user ID (#676)
• c40ff0b release 4.14.0
• 18620ed 🐛 fix(unix): check XDG_RUNTIME_DIR parents (#668)
• 3a5e7d0 🐛 fix(api): raise when a media dir is a file (#672)
• 790ff18 🐛 fix(unix): decide root redirect by effective uid (#666)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

📝 Documentation Preview Ready!

Item	Details
Status	✅ Deployed Successfully
Preview Link	View Documentation
Source Branch	dependabot/pip/minor-updates-5c4648d997
Version Alias	pr/167

Note

The Edit buttons on this preview link directly to your branch. Changes made there will update this preview after a few minutes.