Pin pymdown-extensions to 10.21.3 instead of 11.0.1 (Python 3.9 incompatible) - #2249
Conversation
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 0 |
🟢 Coverage ∅ diff coverage
Metric Results Coverage variation Report missing for 8dcac321 Diff coverage ✅ ∅ diff coverage Coverage variation details
Coverable lines Covered lines Coverage Common ancestor commit (8dcac32) Report Missing Report Missing Report Missing Head commit (d85d104) 22269 20594 92.48% Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch:
<coverage of head commit> - <coverage of common ancestor commit>Diff coverage details
Coverable lines Covered lines Diff coverage Pull request (#2249) 0 0 ∅ (not applicable) Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified:
<covered lines added or modified>/<coverable lines added or modified> * 100%1 Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
…patible) The previous security fix (35a0d10) bumped pymdown-extensions straight to 11.0.1, but pymdown-extensions 11.0.0 dropped Python 3.9 support. Our production image (docker/Dockerfile) and Dockerfile.dev are still pinned to python:3.9, so `pip install -r requirements.txt` fails outright with "Requires-Python >=3.10" for every 11.x release. 10.21.3 is the last release before that drop and already contains the fix for the other vulnerability the same commit was addressing (a pymdownx.snippets path-traversal bypass, fixed in 10.21.3+). Verified `pip install --dry-run -r requirements.txt` resolves cleanly under python:3.9-slim-bookworm (matching docker/Dockerfile). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
13542bb to
d85d104
Compare
1 participant
Summary
35a0d101) bumpedpymdown-extensionsstraight to11.0.1to fix a ReDoS vulnerability (CVE-2026-67422). However,pymdown-extensions11.0.0 dropped Python 3.9 support (Requires-Python >=3.10), and our production image (docker/Dockerfile) plusdocker/Dockerfile.devare still pinned topython:3.9. As a result,pip install -r requirements.txtfails outright on any 3.9 environment (this is what broke locally, see theERROR: Ignored the following versions that require a different python versionoutput).10.21.3is the last release before that Python-version drop, and it already contains the fix for the other vulnerability the same commit was addressing (CVE-2026-46338, apymdownx.snippetspath-traversal bypass affecting 10.0.1–10.21.2, fixed in 10.21.3+). Confirmed via the PyPI JSON API that10.21.3'srequires_pythonis>=3.9.Test plan
pip install --dry-run -r requirements.txtresolves cleanly underpython:3.9-slim-bookworm(matchingdocker/Dockerfile) — full dependency set resolves, includingpymdown-extensions-10.21.3.