Skip to content

Bump Pygments to 2.20.0 in docs lock file - #10882

Open
luigi617 wants to merge 1 commit into
v2from
deps/docs-bump-pygments
Open

luigi617 wants to merge 1 commit into
v2from
deps/docs-bump-pygments

Conversation

@luigi617

@luigi617 luigi617 commented Nov 11, 2026 •

Copy link
Copy Markdown
Contributor

Bumps Pygments 2.19.2 → 2.20.0 in requirements-docs-lock.txt to fix Dependabot alert #49 (GHSA-5239-wwwm-4pmq, ReDoS in GUID matching).

The lock file was regenerated with pip-compile on Python 3.9 using the command in its header, with --upgrade-package so only this package changes. Pygments 2.20.0 still supports Python 3.9.

Testing (end-to-end)

Built the full HTML docs (make html, Python 3.9, Sphinx 6.2.0) on both v2 (Jinja2 3.0.3, Pygments 2.19.2) and this branch (Pygments 2.20.0), then compared the two output trees with diff -rq:

  • Both builds produced 61,660 files, and every page matches byte for byte. The only file that differs is .buildinfo, where the config: hash changes because html_theme_path in conf.py is an absolute path and each build ran from a different checkout.
  • Both builds logged the same 1,482 warnings. These are existing RST warnings in the generated service reference pages.
  • Pygments ran across the whole site: 20,031 pages contain syntax-highlighted code blocks, and _static/pygments.css is identical.

This PR was generated by AI tools, and reviewed by @luigi617.

@luigi617
luigi617 requested a review from a team as a code owner November 11, 2026 17:02

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants