Bump pymdown-extensions from 11.0 to 11.0.1 - #3285
Conversation
Bumps [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions) from 11.0 to 11.0.1. - [Release notes](https://github.com/facelessuser/pymdown-extensions/releases) - [Commits](facelessuser/pymdown-extensions@11.0...11.0.1) --- updated-dependencies: - dependency-name: pymdown-extensions dependency-version: 11.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — routine Dependabot patch bump of a docs-only transitive dependency (pymdown-extensions 11.0 → 11.0.1), lockfile-only change.
What was reviewed
- Verified the new sdist/wheel URLs and hashes in
uv.lockmatch pymdown-extensions 11.0.1 on PyPI; upstream 11.0.1 contains only regex-inefficiency (ReDoS) fixes. - Confirmed pymdown-extensions is not a direct dependency — it is pulled in transitively by the mkdocs docs toolchain, so no runtime SDK surface is affected.
- Checked the unrelated
exceptiongrouphunk (itstyping-extensionsmarker dropped):exceptiongrouponly installs on Python < 3.11, where the< 3.13marker is always true, so a newer uv simply simplified it — semantically equivalent resolver churn.
Extended reasoning...
Overview
This is a Dependabot PR touching only uv.lock. It bumps pymdown-extensions from 11.0 to 11.0.1 (updating the sdist and wheel URLs/hashes) and includes one incidental hunk on the exceptiongroup entry where the typing-extensions dependency marker python_full_version < '3.13' was dropped. No source code, pyproject constraints, or CI configuration changed.
Security risks
Minimal. The upstream 11.0.1 release consists solely of regex pattern inefficiency fixes (BetterEm, Tilde, Caret, MagicLink) — i.e., a ReDoS hardening release, so taking the patch is a net security positive. The lockfile pins exact hashes, so supply-chain risk is limited to trusting the recorded hashes, which correspond to the official PyPI release published 2026-07-02. pymdown-extensions is only used by the mkdocs documentation build, not by the shipped mcp package.
Level of scrutiny
Low. This is a lockfile-only patch bump of a docs-toolchain transitive dependency. The one hunk that warranted a closer look was the exceptiongroup marker change: in this lockfile exceptiongroup is only ever a dependency under python_full_version < '3.11' (anyio, pytest, trio), and within that environment the dropped < '3.13' marker is vacuously true, so removing it does not change what gets installed on any Python version. It is a marker-simplification artifact of the uv version Dependabot resolved with, not a behavioral change.
Other factors
The bug hunting system found no issues, and there are no prior reviews or outstanding comments on the PR. The change follows the same pattern as many previously merged Dependabot lockfile bumps in this repo. Nothing here requires human design judgment.
Bumps pymdown-extensions from 11.0 to 11.0.1.
Release notes
Sourced from pymdown-extensions's releases.
Commits
c684985Merge commit from forkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.