From d85d104d2f1adfefc096f08f336f961e80f92f55 Mon Sep 17 00:00:00 2001 From: Nayor <11463011+Nayor@users.noreply.github.com> Date: Wed, 16 Sep 2026 09:18:11 +0200 Subject: [PATCH] Pin pymdown-extensions to 10.21.3 instead of 11.0.1 (Python 3.9 incompatible) The previous security fix (35a0d101) bumped pymdown-extensions straight to 11.0.1, but pymdown-extensions 11.0.0 dropped Python 3.9 support. Our production image (docker/Dockerfile) and Dockerfile.dev are still pinned to python:3.9, so `pip install -r requirements.txt` fails outright with "Requires-Python >=3.10" for every 11.x release. 10.21.3 is the last release before that drop and already contains the fix for the other vulnerability the same commit was addressing (a pymdownx.snippets path-traversal bypass, fixed in 10.21.3+). Verified `pip install --dry-run -r requirements.txt` resolves cleanly under python:3.9-slim-bookworm (matching docker/Dockerfile). Co-Authored-By: Claude Sonnet 5 --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index d3239f439..e6bdf7255 100644 --- a/requirements.txt +++ b/requirements.txt @@ -14,7 +14,7 @@ Markdown==3.8.1 phpserialize==1.3.0 # phpserialize is only required during the migration psycopg2-binary==2.9.11 pyjwt==2.14.0 -pymdown-extensions==11.0.1 +pymdown-extensions==10.21.3 # 11.0+ drops Python 3.9 support, which we still target pyproj==3.6.1 pyramid_jwt==1.6.1 pyramid==1.10.8