Bump pymdown-extensions from 11.0 to 11.0.1 - #3285
Conversation
Sorry, something went wrong.
Bumps [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions) from 11.0 to 11.0.1. - [Release notes](https://github.com/facelessuser/pymdown-extensions/releases) - [Commits](facelessuser/pymdown-extensions@11.0...11.0.1) --- updated-dependencies: - dependency-name: pymdown-extensions dependency-version: 11.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
There was a problem hiding this comment.
LGTM — routine Dependabot patch bump of a docs-only transitive dependency (pymdown-extensions 11.0 → 11.0.1), lockfile-only change.
What was reviewed
- Verified the new sdist/wheel URLs and hashes in uv.lock match pymdown-extensions 11.0.1 on PyPI; upstream 11.0.1 contains only regex-inefficiency (ReDoS) fixes.
- Confirmed pymdown-extensions is not a direct dependency — it is pulled in transitively by the mkdocs docs toolchain, so no runtime SDK surface is affected.
- Checked the unrelated exceptiongroup hunk (its typing-extensions marker dropped): exceptiongroup only installs on Python < 3.11, where the < 3.13 marker is always true, so a newer uv simply simplified it — semantically equivalent resolver churn.
Overview
This is a Dependabot PR touching only uv.lock. It bumps pymdown-extensions from 11.0 to 11.0.1 (updating the sdist and wheel URLs/hashes) and includes one incidental hunk on the exceptiongroup entry where the typing-extensions dependency marker python_full_version < '3.13' was dropped. No source code, pyproject constraints, or CI configuration changed.
Security risks
Minimal. The upstream 11.0.1 release consists solely of regex pattern inefficiency fixes (BetterEm, Tilde, Caret, MagicLink) — i.e., a ReDoS hardening release, so taking the patch is a net security positive. The lockfile pins exact hashes, so supply-chain risk is limited to trusting the recorded hashes, which correspond to the official PyPI release published 2026-07-02. pymdown-extensions is only used by the mkdocs documentation build, not by the shipped mcp package.
Level of scrutiny
Low. This is a lockfile-only patch bump of a docs-toolchain transitive dependency. The one hunk that warranted a closer look was the exceptiongroup marker change: in this lockfile exceptiongroup is only ever a dependency under python_full_version < '3.11' (anyio, pytest, trio), and within that environment the dropped < '3.13' marker is vacuously true, so removing it does not change what gets installed on any Python version. It is a marker-simplification artifact of the uv version Dependabot resolved with, not a behavioral change.
Other factors
The bug hunting system found no issues, and there are no prior reviews or outstanding comments on the PR. The change follows the same pattern as many previously merged Dependabot lockfile bumps in this repo. Nothing here requires human design judgment.
Sorry, something went wrong.
Reviewers
At least 1 approving review is required to merge this pull request.
Bumps pymdown-extensions from 11.0 to 11.0.1.
Release notesSourced from pymdown-extensions's releases.
CommitsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
You can disable automated security fix PRs for this repo from the Security Alerts page.