Bump the llvm-docs-requirements group in /llvm/docs with 25 updates

[dependabot]

Bumps the llvm-docs-requirements group in /llvm/docs with 25 updates:

Package	From	To
alabaster	0.7.13	0.7.16
babel	2.14.0	2.17.0
beautifulsoup4	4.12.2	4.13.3
certifi	2023.11.17	2025.1.31
charset-normalizer	3.3.2	3.4.1
docutils	0.20.1	0.21.2
furo	2024.1.29	2024.8.6
idna	3.6	3.10
jinja2	3.1.2	3.1.6
markdown	3.5.1	3.7
markupsafe	2.1.3	3.0.2
mdit-py-plugins	0.4.0	0.4.2
myst-parser	2.0.0	3.0.1
packaging	23.2	24.2
pygments	2.17.2	2.19.1
requests	2.31.0	2.32.3
soupsieve	2.5	2.6
sphinx	7.2.6	7.4.7
sphinx-automodapi	0.17.0	0.18.0
sphinxcontrib-applehelp	1.0.8	2.0.0
sphinxcontrib-devhelp	1.0.5	2.0.0
sphinxcontrib-htmlhelp	2.0.4	2.1.0
sphinxcontrib-qthelp	1.0.6	2.0.0
sphinxcontrib-serializinghtml	1.1.9	2.0.0
urllib3	2.1.0	2.3.0

Updates alabaster from 0.7.13 to 0.7.16

Release notes

Sourced from alabaster's releases.

Alabaster 0.7.16

Changelog: https://alabaster.readthedocs.io/en/latest/changelog.html

Alabaster 0.7.15

Changelog: https://alabaster.readthedocs.io/en/latest/changelog.html

Alabaster 0.7.14

Changelog: https://alabaster.readthedocs.io/en/latest/changelog.html

Changelog

Sourced from alabaster's changelog.

:git_tag:0.7.16 -- 2024-01-10

• 🐛215 Do not display logo_name if it is set to False.

:git_tag:0.7.15 -- 2024-01-08

• :feature:213 Allow an arbitrary string in the logo_name option.
• :feature:114 Improved sidebar CSS styles.
• :issue:178 Deprecated canonical_url in favor of html_baseurl.
• 🐛200 Removed duplicate <meta name="viewport" ... /> tag.
• 🐛188 Removed underline from whitespace.
• 🐛164 Removed type="text/javascript" from elements.
• 🐛161 Replaced © with unicode decimal code entity [#169](https://github.com/sphinx-doc/alabaster/issues/169);.

:git_tag:0.7.14 -- 2024-01-08

• Dropped support for Python 3.8 and earlier.
• Dropped support for Sphinx 3.3 and earlier.
• :issue:198 Fix horizontal scrolling on mobile.
• :issue:206 Properly support the html_support_sphinx config value.
• :issue:211 Fix the GitHub 'forkme' banner.
• Added alabaster_version_info to the HTML template context.
• Declare support for Python 3.13.
• Adopt the Ruff linter and formatter.
• Migrate from CircleCI to GitHub Actions.

Commits

• f3fdc04 Bump to 0.7.16
• 39cbbc1 Do not display logo_name == 'false'
• d24c4cb Bump to 0.7.15
• 56f12de Include documentation in the sdist
• 2d8d038 Adorn the LICENSE file with a suffix
• a31816c Remove obscenities (#173)
• 166d6e7 Replace © with unicode decimal code entity (#161)
• b9e8d79 Deprecate canonical_url in favor of html_baseurl (#178)
• 848e718 Allow an arbitrary string in the logo_name option (#213)
• 6922a16 Improve sidebar styles
• Additional commits viewable in compare view

Updates babel from 2.14.0 to 2.17.0

Release notes

Sourced from babel's releases.

v2.17.0

Happy 2025! This release is being made from FOSDEM 2025, in Brussels, Belgium. 🇧🇪

Thank you to all contributors, new and old, and here's to another great year of internationalization and localization!

---

The changelog below is auto-generated by GitHub.

Please see CHANGELOG.rst for additional details.

---

What's Changed

• Fix deprecation warnings for datetime.utcnow() by @​tomasr8 in python-babel/babel#1119
• Enclose white spaces in references by @​Dunedan in python-babel/babel#1105
• Replace str.index with str.find by @​tomasr8 in python-babel/babel#1130
• Replace more alternate characters in format_skeleton by @​tomasr8 in python-babel/babel#1122
• Fix extracted lineno with nested calls by @​dylankiss in python-babel/babel#1126
• "Deleted duplicate code in test" by @​mattdiaz007 in python-babel/babel#1138
• Fix of list index out of range error in PoFileParser.add_message when translations is empty by @​gabe-sherman in python-babel/babel#1135
• Make seconds optional in parse_time time formats by @​tomasr8 in python-babel/babel#1141
• Mark wraptext deprecated; use TextWrapper directly in write_po by @​akx in python-babel/babel#1140
• Fix the way obsolete messages are stored by @​tomasr8 in python-babel/babel#1132
• Replace OrderedDict with just dict by @​tomasr8 in python-babel/babel#1149
• Use CLDR 46 by @​tomasr8 in python-babel/babel#1145
• Update CI to use python 3.13 and Ubuntu 24.04 by @​tomasr8 in python-babel/babel#1153
• Adjust docs/conf.py to add compatibility with sphinx 8 by @​hrnciar in python-babel/babel#1155
• Allow specifying an explicit format in parse_date/parse_time by @​tomasr8 in python-babel/babel#1131
• Simplify read_mo logic regarding catalog.charset by @​tomasr8 in python-babel/babel#1148
• Bump CI/tool versions by @​akx in python-babel/babel#1160
• fix: check_and_call_extract_file uses the first matching method and options, instead of the first matching method and last matching options by @​jpmckinney in python-babel/babel#1121
• Prevent wrapping file locations containing white space by @​tomasr8 in python-babel/babel#1120
• Add tzdata as dev dependency and sync with tox.ini by @​wandrew004 in python-babel/babel#1159
• Support short and narrow formats for format_timedelta when using add_direction by @​akx in python-babel/babel#1163
• Improve handling for locale=None by @​akx in python-babel/babel#1164
• Use pytest.raises(match=...) by @​akx in python-babel/babel#1166
• Strip extra leading slashes in /etc/localtime by @​akx in python-babel/babel#1165
• Remove redundant assignment in Catalog.__setitem__ by @​tomasr8 in python-babel/babel#1167
• Small cleanups by @​akx in python-babel/babel#1170
• Small test cleanup by @​akx in python-babel/babel#1172
• Add Message.python_brace_format by @​tomasr8 in python-babel/babel#1169
• Import Literal from the typing module by @​tomasr8 in python-babel/babel#1175
• Prefer LC_MONETARY when formatting currencies by @​akx in python-babel/babel#1173
• Fix dates formatting Y, w and W symbols for week-numbering by @​jun66j5 in python-babel/babel#1179
• Increase test coverage of the python_format checker by @​tomasr8 in python-babel/babel#1176
• Prepare for 2.17.0 by @​akx in python-babel/babel#1182

New Contributors

• @​Dunedan made their first contribution in python-babel/babel#1105

... (truncated)

Changelog

Sourced from babel's changelog.

Version 2.17.0

Happy 2025! This release is being made from FOSDEM 2025, in Brussels, Belgium.

Thank you to all contributors, new and old, and here's to another great year of internationalization and localization!

Features

* CLDR: Babel now uses CLDR 46, by @tomasr8 in :gh:`1145`
* Dates: Allow specifying an explicit format in parse_date/parse_time by @tomasr8 in :gh:`1131`
* Dates: More alternate characters are now supported by `format_skeleton`. By @tomasr8 in :gh:`1122`
* Dates: Support short and narrow formats for format_timedelta when using `add_direction`, by @akx in :gh:`1163`
* Messages: .po files now enclose white spaces in filenames like GNU gettext does. By @Dunedan in :gh:`1105`, and @tomasr8 in :gh:`1120`
* Messages: Initial support for `Message.python_brace_format`, by @tomasr8 in :gh:`1169`
* Numbers: LC_MONETARY is now preferred when formatting currencies, by @akx in :gh:`1173`
Bugfixes

• Dates: Make seconds optional in parse_time time formats by @​tomasr8 in :gh:1141
• Dates: Replace str.index with str.find by @​tomasr8 in :gh:1130
• Dates: Strip extra leading slashes in /etc/localtime by @​akx in :gh:1165
• Dates: Week numbering and formatting of dates with week numbers was repaired by @​jun66j5 in :gh:1179
• General: Improve handling for locale=None by @​akx in :gh:1164
• General: Remove redundant assignment in Catalog.__setitem__ by @​tomasr8 in :gh:1167
• Messages: Fix extracted lineno with nested calls, by @​dylankiss in :gh:1126
• Messages: Fix of list index out of range when translations is empty, by @​gabe-sherman in :gh:1135
• Messages: Fix the way obsolete messages are stored by @​tomasr8 in :gh:1132
• Messages: Simplify read_mo logic regarding catalog.charset by @​tomasr8 in :gh:1148
• Messages: Use the first matching method & options, rather than first matching method & last options, by @​jpmckinney in :gh:1121

Deprecation and compatibility

* Dates: Fix deprecation warnings for `datetime.utcnow()` by @tomasr8 in :gh:`1119`
* Docs: Adjust docs/conf.py to add compatibility with sphinx 8 by @hrnciar in :gh:`1155`
* General: Import `Literal` from the typing module by @tomasr8 in :gh:`1175`
* General: Replace `OrderedDict` with just `dict` by @tomasr8 in :gh:`1149`
* Messages: Mark `wraptext` deprecated; use `TextWrapper` directly in `write_po` by @akx in :gh:`1140`
Infrastructure

* Add tzdata as dev dependency and sync with tox.ini by @wandrew004 in :gh:`1159`
* Duplicate test code was deleted by @mattdiaz007 in :gh:`1138`
* Increase test coverage of the `python_format` checker by @tomasr8 in :gh:`1176`
* Small cleanups by @akx in :gh:`1160`, :gh:`1166`, :gh:`1170` and :gh:`1172`
</tr></table> 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>

<li><a href="https://github.com/python-babel/babel/commit/b50a1d2186c20f3359f7e10853d2b2225a46ed40&quot;&gt;&lt;code&gt;b50a1d2&lt;/code&gt;&lt;/a> Prepare for 2.17.0 (<a href="https://redirect.github.com/python-babel/babel/issues/1182&quot;&gt;#1182&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/python-babel/babel/commit/5f117b2689573aa98acc8a47108c49b99f4d1394&quot;&gt;&lt;code&gt;5f117b2&lt;/code&gt;&lt;/a> Increase test coverage of the <code>python_format</code> checker (<a href="https://redirect.github.com/python-babel/babel/issues/1176&quot;&gt;#1176&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/python-babel/babel/commit/363ad7531fb5dcdc3e9844573592b0b44afb914b&quot;&gt;&lt;code&gt;363ad75&lt;/code&gt;&lt;/a> Fix dates formatting <code>Y</code>, <code>w</code> and <code>W</code> symbols for week-numbering (<a href="https://redirect.github.com/python-babel/babel/issues/1179&quot;&gt;#1179&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/python-babel/babel/commit/e9c3ef8d0de3080ca59f7f8dbabf9b52983adc7d&quot;&gt;&lt;code&gt;e9c3ef8&lt;/code&gt;&lt;/a> Merge pull request <a href="https://redirect.github.com/python-babel/babel/issues/1173&quot;&gt;#1173&lt;/a> from python-babel/lc-monetary-2</li>

<li><a href="https://github.com/python-babel/babel/commit/56ef7c7f578a904917464c187e399abb762bd5e3&quot;&gt;&lt;code&gt;56ef7c7&lt;/code&gt;&lt;/a> Prefer LC_MONETARY when formatting currency</li>

<li><a href="https://github.com/python-babel/babel/commit/aee6d698b541dc50439280d7e093092cc0d4b832&quot;&gt;&lt;code&gt;aee6d69&lt;/code&gt;&lt;/a> <code>default_locale</code>: support multiple keys</li>

<li><a href="https://github.com/python-babel/babel/commit/2d8a808864d1aae5d3d02d4f95917c79740c5d35&quot;&gt;&lt;code&gt;2d8a808&lt;/code&gt;&lt;/a> Import <code>Literal</code> &amp; <code>TypedDict</code> from the typing module (<a href="https://redirect.github.com/python-babel/babel/issues/1175&quot;&gt;#1175&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/python-babel/babel/commit/98b9562c05e5276038c27ec12c12f3e92dc027b6&quot;&gt;&lt;code&gt;98b9562&lt;/code&gt;&lt;/a> Add basic support for <code>Message.python_brace_format</code> (<a href="https://redirect.github.com/python-babel/babel/issues/1169&quot;&gt;#1169&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/python-babel/babel/commit/0c1091c9de9543e30bc4b845eb10b5bf84516d7b&quot;&gt;&lt;code&gt;0c1091c&lt;/code&gt;&lt;/a> Small test cleanup (<a href="https://redirect.github.com/python-babel/babel/issues/1172&quot;&gt;#1172&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/python-babel/babel/commit/db4879136a7fbcef475f26b75dbdd65d0ce488f9&quot;&gt;&lt;code&gt;db48791&lt;/code&gt;&lt;/a> Merge pull request <a href="https://redirect.github.com/python-babel/babel/issues/1170&quot;&gt;#1170&lt;/a> from python-babel/small-cleanup</li>

<li>Additional commits viewable in <a href="https://github.com/python-babel/babel/compare/v2.14.0...v2.17.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />


Updates beautifulsoup4 from 4.12.2 to 4.13.3
Updates certifi from 2023.11.17 to 2025.1.31

Commits

088f931 2025.01.31 (#336)
1c17795 Bump pypa/gh-action-pypi-publish from 1.12.3 to 1.12.4 (#335)
a2e88f0 Bump actions/upload-artifact from 4.5.0 to 4.6.0 (#334)
82284ed Bump peter-evans/create-pull-request from 7.0.5 to 7.0.6 (#333)
10d3d1d Bump actions/upload-artifact from 4.4.3 to 4.5.0 (#332)
4ba3900 2024.12.14 (#329)
9164660 Bump pypa/gh-action-pypi-publish from 1.12.2 to 1.12.3 (#331)
3dc3651 Bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.2 (#328)
c5bf18d Bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0 (#327)
b908391 Bump actions/setup-python from 5.2.0 to 5.3.0 (#326)
Additional commits viewable in compare view




Updates charset-normalizer from 3.3.2 to 3.4.1

Release notes
Sourced from charset-normalizer's releases.

Version 3.4.1
🚀 We're still raising awareness around HTTP/2, and HTTP/3!
Did you know that Internet Explorer 11 shipped with an optional HTTP/2 support back in 2013? also libcurl did ship it in 2014[...]
Using Requests today is the rough equivalent of using EOL Windows 8!  We promptly invite Python developers to look at the first drop-in replacement for Requests, namely Niquests. Ship with native WebSocket, SSE, Happy Eyeballs, DNS over HTTPS, and so on[...] All of this while remaining compatible with all Requests prior plug-ins / add-ons.
It leverages charset-normalizer in a better way! Check it out, you will gain up to being 3X faster and get a real/respectable support with it.
3.4.1 (2024-12-24)
Changed

Project metadata are now stored using pyproject.toml instead of setup.cfg using setuptools as the build backend.
Enforce annotation delayed loading for a simpler and consistent types in the project.
Optional mypyc compilation upgraded to version 1.14 for Python >= 3.8

Added

pre-commit configuration.
noxfile.

Removed

build-requirements.txt as per using pyproject.toml native build configuration.
bin/integration.py and bin/serve.py in favor of downstream integration test (see noxfile).
setup.cfg in favor of pyproject.toml metadata configuration.
Unused utils.range_scan function.

Fixed

Converting content to Unicode bytes may insert utf_8 instead of preferred utf-8. (#572)
Deprecation warning "'count' is passed as positional argument" when converting to Unicode bytes on Python 3.13+

Version 3.4.0
🚀 charset-normalizer is raising awareness around HTTP/2, and HTTP/3!
Did you know that Internet Explorer 11 shipped with an optional HTTP/2 support back in 2013? also libcurl did ship it in 2014[...]
All of this while our community is still struggling to make a firm advancement in HTTP clients. Now, many of you use Requests
as the defacto http client, now, and for many years now, Requests has been frozen. Being left in a vegetative state and not evolving,
this blocked millions of developers from using more advanced features.
We promptly invite Python developers to look at the drop-in replacement for Requests, namely Niquests.
It leverage charset-normalizer in a better way! Check it out, you will be positively surprised! Don't wait another decade.
We are thankful to @​microsoft and involved parties for funding our work through the Microsoft FOSS Fund program.
3.4.0 (2024-10-08)
Added

Argument --no-preemptive in the CLI to prevent the detector to search for hints.
Support for Python 3.13 (#512)

Fixed

Relax the TypeError exception thrown when trying to compare a CharsetMatch with anything else than a CharsetMatch.



... (truncated)


Changelog
Sourced from charset-normalizer's changelog.

3.4.1 (2024-12-24)
Changed

Project metadata are now stored using pyproject.toml instead of setup.cfg using setuptools as the build backend.
Enforce annotation delayed loading for a simpler and consistent types in the project.
Optional mypyc compilation upgraded to version 1.14 for Python >= 3.8

Added

pre-commit configuration.
noxfile.

Removed

build-requirements.txt as per using pyproject.toml native build configuration.
bin/integration.py and bin/serve.py in favor of downstream integration test (see noxfile).
setup.cfg in favor of pyproject.toml metadata configuration.
Unused utils.range_scan function.

Fixed

Converting content to Unicode bytes may insert utf_8 instead of preferred utf-8. (#572)
Deprecation warning "'count' is passed as positional argument" when converting to Unicode bytes on Python 3.13+

3.4.0 (2024-10-08)
Added

Argument --no-preemptive in the CLI to prevent the detector to search for hints.
Support for Python 3.13 (#512)

Fixed

Relax the TypeError exception thrown when trying to compare a CharsetMatch with anything else than a CharsetMatch.
Improved the general reliability of the detector based on user feedbacks. (#520) (#509) (#498) (#407) (#537)
Declared charset in content (preemptive detection) not changed when converting to utf-8 bytes. (#381)




Commits

ffdf7f5 :wrench: fix long description content-type inferred as rst instead of md
c7197b7 :pencil: fix changelog entries (#582)
c390e1f Merge pull request #581 from jawah/refresh-part-2
f9d6b8c :lock: add CODEOWNERS
7ce1ef1 :wrench: use ubuntu-22.04 for cibuildwheel in continuous deployment workflow
deed205 :wrench: update LICENSE copyright
f11f571 :wrench: include noxfile in sdist
1ec7c06 :wrench: update changelog
14b4649 :bug: output(...) replace declarative mark using non iana compliant encoding ...
1b06bc0 Merge branch 'refresh-part-2' of github.com:jawah/charset_normalizer into ref...
Additional commits viewable in compare view




Updates docutils from 0.20.1 to 0.21.2
Updates furo from 2024.1.29 to 2024.8.6

Changelog
Sourced from furo's changelog.

Changelog

2024.08.06 -- Energetic Eminence

✨ Add support for Sphinx 8
✨ Add smoother transitions between breakpoints
Increase specificity of table-wrapper selector
Avoid page breaks inside paragraphs

2024.07.18 -- Dull Denim

Improve how icons are handled and aligned.
Improve scroll event handler.
Hide the copybutton by default.
Fix source_view_link configuration handling.
Fix close tag on pencil icon.

2024.05.06 -- Cheerful Cerulean

✨ Add new custom icons for auto mode, reflecting the currently active theme.
✨ Add a view this page button.
✨ Add colours and highlighting to "version modified" API helpers.
✨ Add release information to various customisation knobs.
Make all icons bigger and use a thinner stroke with them.

2024.04.27 -- Bold Burgundy

Add a skip to content link.
Add --font-stack--headings.
Add :visited colour and enforce uniform contrast between light/dark.
Add an offset of :target to reduce back-to-top overlap.
Improve dark mode colours.
Fix outstanding colour contrast warnings on Firefox.
Fix bad indent in footnotes.
Tweak handling of default configuration options in a more resilient manner.
Tweak length and sizing of API source links.
Stop search engine indexing on search page.

2024.01.29 -- Amazing Amethyst


... (truncated)


Commits

1bbf4ee Prepare release: 2024.08.06
bcb22c3 Update changelog
e633f02 Improve the selector for sidebar
d2fa2e0 [pre-commit.ci] pre-commit autoupdate (#821)
05a2d63 Add smoother transitions between breakpoints
d261d3b [pre-commit.ci] pre-commit autoupdate (#810)
2d3b6ba Add support for Sphinx 8
bf98041 Increase specificity of table-wrapper selector
fc6337c Fix the figures
fd3f422 Avoid page breaks inside paragraphs
Additional commits viewable in compare view




Updates idna from 3.6 to 3.10

Release notes
Sourced from idna's releases.

v3.10
No release notes provided.
v3.9
No release notes provided.
v3.8
What's Changed

Fix regression where IDNAError exception was not being produced for certain inputs.
Add support for Python 3.13, drop support for Python 3.5 as it is no longer testable.
Documentation improvements
Updates to package testing using Github actions

Thanks to Hugo van Kemenade for contributions to this release.
Full Changelog: https://github.com/kjd/idna/compare/v3.7...v3.8
v3.7
What's Changed

Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.
Full Changelog: https://github.com/kjd/idna/compare/v3.6...v3.7



Changelog
Sourced from idna's changelog.

3.10 (2024-09-15)
+++++++++++++++++

Reverted to Unicode 15.1.0 data. Unicode 16 has some significant changes
to UTS46 processing that will require more work to properly implement.

3.9 (2024-09-13)
++++++++++++++++

Update to Unicode 16.0.0
Deprecate setup.cfg in favour of pyproject.toml
Use ruff for code formatting

Thanks to Waket Zheng for contributions to this release.
3.8 (2024-08-23)
++++++++++++++++

Fix regression where IDNAError exception was not being produced for
certain inputs.
Add support for Python 3.13, drop support for Python 3.5 as it is no
longer testable.
Documentation improvements
Updates to package testing using Github actions

Thanks to Hugo van Kemenade for contributions to this release.
3.7 (2024-04-11)
++++++++++++++++

Fix issue where specially crafted inputs to encode() could
take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.



Commits

729225d Release v3.10
3eef168 Merge pull request #194 from kjd/revert-unicode-16
ceca619 Revert Unicode 16.0.0 data updates
c43ac75 Merge pull request #191 from kjd/release-3.9
1b8800a Release v3.9
a1fd168 Merge pull request #190 from kjd/unicode-16
7732c61 Merge branch 'master' into unicode-16
4ed183d Refactor membership test
762216b Format with ruff
580ece9 Implement changes to UTS46 algorithm
Additional commits viewable in compare view




Updates jinja2 from 3.1.2 to 3.1.6

Release notes
Sourced from jinja2's releases.

3.1.6
This is the Jinja 3.1.6 security release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/Jinja2/3.1.6/
Changes: https://jinja.palletsprojects.com/en/stable/changes/#version-3-1-6

The |attr filter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7

3.1.5
This is the Jinja 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/Jinja2/3.1.5/
Changes: https://jinja.palletsprojects.com/changes/#version-3-1-5
Milestone: https://github.com/pallets/jinja/milestone/16?closed=1

The sandboxed environment handles indirect calls to str.format, such as by passing a stored reference to a filter that calls its argument. GHSA-q2x7-8rv6-6q7h
Escape template name before formatting it into error messages, to avoid issues with names that contain f-string syntax. #1792, GHSA-gmj6-6f8f-6699
Sandbox does not allow clear and pop on known mutable sequence types. #2032
Calling sync render for an async template uses asyncio.run. #1952
Avoid unclosed auto_aiter warnings. #1960
Return an aclose-able AsyncGenerator from Template.generate_async. #1960
Avoid leaving root_render_func() unclosed in Template.generate_async. #1960
Avoid leaving async generators unclosed in blocks, includes and extends. #1960
The runtime uses the correct concat function for the current environment when calling block references. #1701
Make |unique async-aware, allowing it to be used after another async-aware filter. #1781
|int filter handles OverflowError from scientific notation. #1921
Make compiling deterministic for tuple unpacking in a {% set ... %} call. #2021
Fix dunder protocol (copy/pickle/etc) interaction with Undefined objects. #2025
Fix copy/pickle support for the internal missing object. #2027
Environment.overlay(enable_async) is applied correctly. #2061
The error message from FileSystemLoader includes the paths that were searched. #1661
PackageLoader shows a clearer error message when the package does not contain the templates directory. #1705
Improve annotations for methods returning copies. #1880
urlize does not add mailto: to values like @a@b. #1870
Tests decorated with @pass_context can be used with the |select filter. #1624
Using set for multiple assignment (a, b = 1, 2) does not fail when the target is a namespace attribute. #1413
Using set in all branches of {% if %}{% elif %}{% else %} blocks does not cause the variable to be considered initially undefined. #1253

3.1.4
This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.
PyPI: https://pypi.org/project/Jinja2/3.1.4/
Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-4

The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. GHSA-h75v-3vvj-5mfj

3.1.3
This is a fix release for the 3.1.x feature branch.

Fix for GHSA-h5c8-rqwp-cp95. You are affected if you are using xmlattr and passing user input as attribute keys.



... (truncated)


Changelog
Sourced from jinja2's changelog.

Version 3.1.6
Released 2025-03-05

The |attr filter does not bypass the environment's attribute lookup,
allowing the sandbox to apply its checks. :ghsa:cpwx-vrp4-4pq7

Version 3.1.5
Released 2024-12-21

The sandboxed environment handles indirect calls to str.format, such as
by passing a stored reference to a filter that calls its argument.
:ghsa:q2x7-8rv6-6q7h
Escape template name before formatting it into error messages, to avoid
issues with names that contain f-string syntax.
:issue:1792, :ghsa:gmj6-6f8f-6699
Sandbox does not allow clear and pop on known mutable sequence
types. :issue:2032
Calling sync render for an async template uses asyncio.run.
:pr:1952
Avoid unclosed auto_aiter warnings. :pr:1960
Return an aclose-able AsyncGenerator from
Template.generate_async. :pr:1960
Avoid leaving root_render_func() unclosed in
Template.generate_async. :pr:1960
Avoid leaving async generators unclosed in blocks, includes and extends.
:pr:1960
The runtime uses the correct concat function for the current environment
when calling block references. :issue:1701
Make |unique async-aware, allowing it to be used after another
async-aware filter. :issue:1781
|int filter handles OverflowError from scientific notation.
:issue:1921
Make compiling deterministic for tuple unpacking in a {% set ... %}
call. :issue:2021
Fix dunder protocol (copy/pickle/etc) interaction with Undefined
objects. :issue:2025
Fix copy/pickle support for the internal missing object.
:issue:2027
Environment.overlay(enable_async) is applied correctly. :pr:2061
The error message from FileSystemLoader includes the paths that were
searched. :issue:1661
PackageLoader shows a clearer error message when the package does not
contain the templates directory. :issue:1705
Improve annotations for methods returning copies. :pr:1880
urlize does not add mailto: to values like @a@b. :pr:1870



... (truncated)


Commits

1520688 release version 3.1.6
90457bb Merge commit from fork
065334d attr filter uses env.getattr
033c200 start version 3.1.6
bc68d4e use global contributing guide (#2070)
247de5e use global contributing guide
ab8218c use project advisory link instead of global
b4ffc8f release version 3.1.5 (#2066)
877f6e5 release version 3.1.5
8d58859 remove test pypi
Additional commits viewable in compare view




Updates markdown from 3.5.1 to 3.7

Release notes
Sourced from markdown's releases.

Release 3.7
Changed
Refactor abbr Extension
A new AbbrTreeprocessor has been introduced, which replaces the now deprecated
AbbrInlineProcessor. Abbreviation processing now happens after Attribute Lists,
avoiding a conflict between the two extensions (#1460).
The AbbrPreprocessor class has been renamed to AbbrBlockprocessor, which
better reflects what it is. AbbrPreprocessor has been deprecated.
A call to Markdown.reset() now clears all previously defined abbreviations.
Abbreviations are now sorted by length before executing AbbrTreeprocessor
to ensure that multi-word abbreviations are implemented even if an abbreviation
exists for one of those component words. (#1465)
Abbreviations without a definition are now ignored. This avoids applying
abbr tags to text without a title value.
Added an optional glossary configuration option to the abbreviations extension.
This provides a simple and efficient way to apply a dictionary of abbreviations
to every page.
Abbreviations can now be disabled by setting their definition to "" or ''.
This can be useful when using the glossary option.
Fixed

Fixed links to source code on GitHub from the documentation (#1453).

Release 3.6
Changed
Refactor TOC Sanitation

All postprocessors are now run on heading content.
Footnote references are now stripped from heading content. Fixes #660.
A more robust striptags is provided to convert headings to plain text.
Unlike, the markupsafe implementation, HTML entities are not unescaped.
The plain text name, rich html, and unescaped raw data-toc-label are
saved to toc_tokens, allowing users to access the full rich text content of
the headings directly from toc_tokens.
The value of data-toc-label is sanitized separate from heading content
before being written to name. This fixes a bug which allowed markup through
in certain circumstances. To access the raw unsanitized data, retrieve the
value from token['data-toc-label'] directly.
An html.unescape call is made just prior to calling slugify so that



... (truncated)


Changelog
Sourced from markdown's changelog.

[3.7] -- 2024-08-16
Changed
Refactor abbr Extension
A new AbbrTreeprocessor has been introduced, which replaces the now deprecated
AbbrInlineProcessor. Abbreviation processing now happens after Attribute Lists,
avoiding a conflict between the two extensions (#1460).
The AbbrPreprocessor class has been renamed to AbbrBlockprocessor, which
better reflects what it is. AbbrPreprocessor has been deprecated.
A call to Markdown.reset() now clears all previously defined abbreviations.
Abbreviations are now sorted by length before executing AbbrTreeprocessor
to ensure that multi-word abbreviations are implemented even if an abbreviation
exists for one of those component words. (#1465)
Abbreviations without a definition are now ignored. This avoids applying
abbr tags to text without a title value.
Added an optional glossary configuration option to the abbreviations extension.
This provides a simple and efficient way to apply a dictionary of abbreviations
to every page.
Abbreviations can now be disabled by setting their definition to "" or ''.
This can be useful when using the glossary option.
Fixed

Fixed links to source code on GitHub from the documentation (#1453).

[3.6] -- 2024-03-14
Changed
Refactor TOC Sanitation

All postprocessors are now run on heading content.
Footnote references are now stripped from heading content. Fixes #660.
A more robust striptags is provided to convert headings to plain text.
Unlike, the markupsafe implementation, HTML entities are not unescaped.
The plain text name, rich html, and unescaped raw data-toc-label are
saved to toc_tokens, allowing users to access the full rich text content of
the headings directly from toc_tokens.
The value of data-toc-label is sanitized separate from heading content
before being written to name. This fixes a bug which allowed markup through
in certain circumstances. To access the raw unsanitized data, retrieve the



... (truncated)


Commits

da03cd6 Bump version to 3.7
bd836a1 Update griffe_extensions to support Griffe v 1.0.
33359fa Abbr Extension: Definition Sorting and Glossary storage
ec8c305 Refactor abbr Extension
993b57b Fixed links to source code on GitHub from the documentation
e524b8f Bump version to 3.6
3d8afc6 Allow attr_list quoted values to contain curly braces
9edba85 Refactor abbr escaping
e4ab4a6 Refactor TOC sanitation
a18765c Explicitly omit carot and backslash from abbr
Additional commits viewable in compare view




Updates markupsafe from 2.1.3 to 3.0.2

Release notes
Sourced from markupsafe's releases.

3.0.2
This is the MarkupSafe 3.0.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes.
PyPI: https://pypi.org/project/MarkupSafe/3.0.2/
Changes: https://markupsafe.palletsprojects.com/en/stable/changes/#version-3-0-2
Milestone: https://github.com/pallets/markupsafe/milestone/14?closed=1

Fix compatibility when __str__ returns a str subclass. #472
Build requires setuptools >= 70.1. #475

3.0.1
This is the MarkupSafe 3.0.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes.
PyPI: https://pypi.org/project/MarkupSafe/3.0.1/
Changes: https://markupsafe.palletsprojects.com/en/stable/changes/#version-3-0-1
Milestone: https://github.com/pallets/markupsafe/milestone/13?closed=1

Address compiler warnings that became errors in GCC 14. #466
Fix compatibility with proxy objects. #467

3.0.0
This is the MarkupSafe 3.0.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. The 3.0.x branch is now the supported fix branch, the 2.1.x branch will become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.
PyPI: ...
Description has been truncated