chore(deps): update requirements-saltbox-docs by renovate[bot] · Pull Request #426 · saltyorg/docs

renovate · 2026-10-21T16:47:42Z

This PR contains the following updates:

Package	Change	Age	Confidence
mkdocs-glightbox (changelog)	`==0.5.2` → `==0.5.3`
mkdocs-material (changelog)	`==9.7.7` → `==9.8.0`
selectolax (changelog)	`==1.0.0` → `==1.0.2`

Release Notes

blueswen/mkdocs-glightbox (mkdocs-glightbox)

`v0.5.3`: mkdocs-glightbox-0.5.3

Compare Source

Supported selectolax 1.0.1 (#75)

squidfunk/mkdocs-material (mkdocs-material)

`v9.8.0`: mkdocs-material-9.8.0

Compare Source

[!WARNING]

Material for MkDocs reaches end of life on May 5, 2027. Critical fixes and security updates continue until that date.

We're continuing our work with Zensical, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.

You can evaluate Zensical alongside MkDocs using your existing mkdocs.yml. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The classic theme variant preserves the appearance of Material for MkDocs. See the migration guide for the steps and current compatibility details.

Upcoming changes on November 5

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

Updated Node build-time dependencies to fix vulnerabilities
Updated Python dependency minimums and required Python 3.11
Removed RSS from recommended dependencies
Updated project status and maintenance links
Updated CLI notice with end-of-life and migration guidance
Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide. It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Dependency	Affected versions	New minimum	Advisory
Jinja2	`<=3.1.5`	`3.1.6`	CVE-2025-27516
Markdown	`<3.8.1`	`3.8.1`	CVE-2025-69534
Pygments	`<2.20.0`	`2.20.0`	CVE-2026-4539
PyMdown Extensions	`<=11.0.0`	`11.0.1`	CVE-2026-67422
Requests	`<2.33.0`	`2.33.0`	CVE-2026-25645
Pillow	`<13.0.0`	`13.0.0`	CVE-2026-96636
CairoSVG	`<=2.9.0`	`2.9.1`	CVE-2026-107378
GitPython	`<=3.2.0`	`3.2.1`	CVE-2026-114145

Pillow and CairoSVG apply to the imaging extra; GitPython applies to the git extra.

rushter/selectolax (selectolax)

`v1.0.2`

Compare Source

Bugfix release for 1.0.1.

Fix insert_child(), insert_before(), insert_after() and replace_with() move nodes.
Add the move parameter to insert_child(), insert_before(), insert_after() and
replace_with(). Pass move=True to move the node instead of copying it: the node is
removed from its current position and placed in the new one. A node taken from another
parser is copied into the target document and removed from the document it came from.
The default is move=False, which keeps the copying behaviour.

`v1.0.1`

Compare Source

Add the scripting option to LexborHTMLParser, which parses <noscript> the way a browser
with scripting enabled does: its content becomes raw text, so a <noscript> in <head> no
longer pushes the head elements after it into <body>. The default is unchanged.
Add template_fragments() for reaching the content of <template> elements
which are ignored by HTML5 compliant parsers.
Do not replace <-undef> it not longer possible to get it.
The internal <html> wrapper of an HTML fragment is no longer reported as the parent of
the fragment's top-level nodes.
create_tag() no longer returns None for the tags whose start tag the HTML parser drops
(html, head, body, caption, col, colgroup, frame, frameset, tbody, td,
tfoot, th, thead, tr).
Fix inner_html covering only the first top-level node of an HTML fragment.
Improve the speed of comment extraction
Improve the speed of len(attrs) by counting the attribute list directly
Fix encoding initialization when encoding=True.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-10-21T16:49:27Z