From f2fd3f0cc9cff60a3039ac570951e2f8c396523d Mon Sep 17 00:00:00 2001
From: chris-colinsky <chris@lunarcommand.xyz>
Date: Thu, 6 Aug 2026 19:48:10 -0700
Subject: [PATCH] Bump pymdown-extensions to 11 for security fix

Dependabot 18: pymdown-extensions <= 10.21.3 has a path traversal in
the b64 extension (an <img src> can read files outside base_path),
fixed in 11.0.0. The <11 constraint pinned the vulnerable version;
raise it to >=11,<12 and re-lock (10.21.3 -> 11.0.1). Dev/docs-only
dependency, and the b64 extension is not in our markdown_extensions,
so the risk was low; the bump clears the alert. mkdocs build --strict
passes on 11.0.1.
---
 pyproject.toml | 2 +-
 uv.lock        | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index b3a8ce3..27b0535 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -85,7 +85,7 @@ docs = [
     "mkdocs>=1.6,<2",
     "mkdocs-material[imaging]>=9.5,<10",
     "mkdocstrings[python]>=0.27,<1",
-    "pymdown-extensions>=10.0,<11",
+    "pymdown-extensions>=11.0,<12",
     "mkdocs-glightbox>=0.4,<1",
     "mkdocs-llmstxt>=0.1,<1",
 ]
diff --git a/uv.lock b/uv.lock
index d2c27f7..9d4f07c 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1002,7 +1002,7 @@ docs = [
     { name = "mkdocs-llmstxt", specifier = ">=0.1,<1" },
     { name = "mkdocs-material", extras = ["imaging"], specifier = ">=9.5,<10" },
     { name = "mkdocstrings", extras = ["python"], specifier = ">=0.27,<1" },
-    { name = "pymdown-extensions", specifier = ">=10.0,<11" },
+    { name = "pymdown-extensions", specifier = ">=11.0,<12" },
 ]
 examples = [{ name = "openai", specifier = ">=1.40" }]
 observability = [{ name = "openarmature", extras = ["otel", "langfuse"] }]
@@ -1374,15 +1374,15 @@ wheels = [
 
 [[package]]
 name = "pymdown-extensions"
-version = "10.21.3"
+version = "11.0.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "markdown" },
     { name = "pyyaml" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9e/26/d1015444da4d952a1ca487a236b522eb979766f0295a0bd0c5fc089989a9/pymdown_extensions-10.21.3.tar.gz", hash = "sha256:72cfcf55f07aea0d4af2c4f11dd4e52466ddfb1bb819673146398e0bd3a77354", size = 854140, upload-time = "2026-05-13T12:57:32.267Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/21/a9/5f0c535ba3b08fe09270c16808e053a968868242ecbd5676d4e3a488bf28/pymdown_extensions-11.0.1.tar.gz", hash = "sha256:dd2905ae6fc5b75582fafb139a1266ffc754705efa902aa50067fa7ff4f94ec0", size = 857113, upload-time = "2026-07-02T17:59:22.955Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7e/85/545a951eecc270fcd688288c600017e2050a1aacb56c711d208586d3e470/pymdown_extensions-10.21.3-py3-none-any.whl", hash = "sha256:d7a5d08014fc571e80ca21dd6f854e31f94c489800350564d55d15b3c41e76b6", size = 269002, upload-time = "2026-05-13T12:57:30.296Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/54/da572c98c0b77626a91b5d3b89f0231d8bff5125c225420908632f8b342d/pymdown_extensions-11.0.1-py3-none-any.whl", hash = "sha256:db3943a62bab7e03af1364f0c4083e64b91fb097675a4b6cceccfbe9a77e5eb2", size = 269455, upload-time = "2026-07-02T17:59:21.271Z" },
 ]
 
 [[package]]