[dependabot]

Bumps the docs group with 3 updates in the / directory: mkdocs-material, mkdocs-git-revision-date-localized-plugin and semver.

Updates mkdocs-material from 9.8.0 to 9.8.1

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.8.1

[!WARNING]

Material for MkDocs reaches end of life on May 5, 2027. Critical fixes and security updates continue until that date.

We're continuing our work with Zensical, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.

You can evaluate Zensical alongside MkDocs using your existing mkdocs.yml. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The classic theme variant preserves the appearance of Material for MkDocs. See the migration guide for the steps and current compatibility details.

Upcoming changes on November 5

• Updated Docker base image to Alpine 3.24
• Updated Docker image dependencies to fix vulnerabilities
• Updated Node build-time dependencies to fix vulnerabilities

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.8.1 (2026-11-07)

• Updated Docker base image to Alpine 3.24
• Updated Docker image dependencies to fix vulnerabilities
• Updated Node build-time dependencies to fix vulnerabilities

mkdocs-material-9.8.0 (2026-10-24)

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

• Updated Node build-time dependencies to fix vulnerabilities
• Updated Python dependency minimums and required Python 3.11
• Removed RSS from recommended dependencies
• Updated project status and maintenance links
• Updated CLI notice with end-of-life and migration guidance
• Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide: https://zensical.org/docs/compatibility/mkdocs/migration/

It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Jinja2: affected <=3.1.5; new minimum 3.1.6 (CVE-2025-27516) GHSA-cpwx-vrp4-4pq7

Markdown: affected <3.8.1; new minimum 3.8.1 (CVE-2025-69534) GHSA-5wmx-573v-2qwq

Pygments: affected <2.20.0; new minimum 2.20.0 (CVE-2026-4539) GHSA-5239-wwwm-4pmq

... (truncated)

Commits

• 16c95ad Prepare 9.8.1 release
• b3fe832 Fixed documentation workflow
• 004d29e Updated dependencies to fix vulnerabilities
• 7590e14 Documentation
• 0f044db Updated documentation build to use public Material
• dc38d1e Documentation
• ebbfb46 Updated Docker base image to Alpine 3.24
• 624aff1 Updated build and documentation workflows
• See full diff in compare view

Updates mkdocs-git-revision-date-localized-plugin from 1.6.1 to 1.7.0

Release notes

Sourced from mkdocs-git-revision-date-localized-plugin's releases.

v1.7.0

What's Changed

• Fix creation date when git 2.56 --follow stops at a rename by @​timvink in timvink/mkdocs-git-revision-date-localized-plugin#242

Full Changelog: timvink/mkdocs-git-revision-date-localized-plugin@v1.6.3...v1.7.0

v1.6.3

What's Changed

• Include test fixtures in the sdist by @​timvink in timvink/mkdocs-git-revision-date-localized-plugin#240

Full Changelog: timvink/mkdocs-git-revision-date-localized-plugin@v1.6.2...v1.6.3

v1.6.2

Fixes

• mkdocs serve now picks up commits made while it runs, including amended commits and changes to the ignored commits file. With --dirty, the initial build is also faster (#215, #236).
• Generated pages get one stable timestamp per build, so both dates match and strict builds no longer warn about them (#231, #232 by @​akashchamp, #237).

Performance

• When enable_creation_date is off, the plugin no longer looks up creation commits. This roughly halves build time on large sites (#238).

Commits

• 71d4250 Bump version to 1.7.0
• a4a32f4 Merge pull request #242 from timvink/fix/git-2.56-follow-creation-date
• b22b495 Track the file name across crossed renames and use literal pathspecs
• 4f05f42 Test rename chains, follow disabled and uncommitted pages
• 677b904 Continue past renames to find the real creation commit
• 27a5baf Fall back to the oldest followed commit when the creation query is empty
• d91240f Add failing tests for creation date when git log --follow stops at a rename
• 6778aad Bump version to 1.6.3
• c83bca5 Merge pull request #240 from timvink/fix/sdist-include-tests
• 930cbfb Include test fixtures in the sdist
• Additional commits viewable in compare view

Updates semver from 3.1.0 to 3.1.1

Release notes

Sourced from semver's releases.

3.1.1

What's Changed

• Reject invalid token arguments in Version.bump_prerelease and Version.bump_build by @​Str0k in python-semver/python-semver#483
• Fix #484: Increment old-style prerelease with dot by @​tomschr in python-semver/python-semver#485
• Drop build metadata when bumping an old-style prerelease by @​youdie006 in python-semver/python-semver#486
• Compare long numeric prerelease identifiers without integer conversion by @​SAY-5 in python-semver/python-semver#488
• fix: validate and match prerelease token prefixes by @​MbappeWU in python-semver/python-semver#489
• Bump urllib3 from 2.7.0 to 2.8.0 by @​dependabot[bot] in python-semver/python-semver#491
• Bump virtualenv from 21.5.1 to 21.7.13 by @​dependabot[bot] in python-semver/python-semver#492
• Annotate supported bytes inputs to Version.is_valid by @​xiehuanyi in python-semver/python-semver#495
• Preserve version order when switching prerelease tokens by @​Apeksha9389 in python-semver/python-semver#498
• Preserve version order when legacy prerelease counters roll over by @​pabszero in python-semver/python-semver#500
• Bump virtualenv from 21.7.13 to 21.14.13 by @​dependabot[bot] in python-semver/python-semver#503
• Bump certifi from 2026.6.17 to 2026.10.19 by @​dependabot[bot] in python-semver/python-semver#504
• Preserve constructor TypeError in Version.replace by @​Zhuyuyangyy in python-semver/python-semver#501
• test: cover six behaviours found untested by mutation testing by @​coresystemdev23 in python-semver/python-semver#502
• Use the integer index protocol for Version subscripts by @​shrohan2003 in python-semver/python-semver#508
• Bump version 3.1.0 -> 3.1.1 by @​tomschr in python-semver/python-semver#509

New Contributors

• @​youdie006 made their first contribution in python-semver/python-semver#486
• @​SAY-5 made their first contribution in python-semver/python-semver#488
• @​MbappeWU made their first contribution in python-semver/python-semver#489
• @​xiehuanyi made their first contribution in python-semver/python-semver#495
• @​Apeksha9389 made their first contribution in python-semver/python-semver#498
• @​pabszero made their first contribution in python-semver/python-semver#500
• @​Zhuyuyangyy made their first contribution in python-semver/python-semver#501
• @​coresystemdev23 made their first contribution in python-semver/python-semver#502
• @​shrohan2003 made their first contribution in python-semver/python-semver#508

Full Changelog: python-semver/python-semver@3.1.0...3.1.1 Documentation: https://python-semver.readthedocs.io/en/3.1.1/ Discussion: python-semver/python-semver#510

Changelog

Sourced from semver's changelog.

Version 3.1.1

:Released: 2026-11-09 :Maintainer: Tom Schraitle

Bug Fixes

• :pr:483: Fix :meth:~semver.Version.bump_prerelease and :meth:~semver.Version.bump_build to raise a :class:ValueError when the token argument is not a valid dot-separated SemVer identifier (for example build+meta or rc.). Previously such tokens were concatenated unchecked, producing version strings that :meth:~semver.Version.parse itself would reject.

• :pr:486: Fix :meth:~semver.Version.next_version to drop the build metadata when incrementing an old-style prerelease without a dot separator (for example rc3). Previously 1.2.3-rc3+build.5 became 1.2.3-rc4+build.5 while 1.2.3-rc.3+build.5 became 1.2.3-rc.4.

• :pr:489: Version.next_version now validates used prerelease tokens and matches token families literally. Invalid tokens raise ValueError. Dotted prefixes advance correctly while existing qualifier chains and legacy counters are preserved.

• :pr:495: The type annotation of Version.is_valid() now includes its existing support for UTF-8 encoded byte strings.

• :pr:501: Version.replace() now preserves the original constructor TypeError when an existing version component receives an invalid value, rather than reporting zero unexpected keyword arguments.

• :pr:508: Version subscripts now accept objects implementing __index__ and raise TypeError for invalid key types.

• :gh:484: Fix :meth:~semver.Version.next_version to correctly increment old-style prerelease versions without a dot separator (for example rc3). Previously, calling next_version("prerelease") on such versions would reset the prerelease number to 1 instead of incrementing it.

• :gh:487: Comparing versions with long numeric prerelease identifiers no longer raises ValueError because of Python's integer string conversion limit.

• :gh:497: Version.next_version("prerelease", prerelease_token=...) now advances the patch version when switching tokens would otherwise produce a lower version. For example, switching from 1.2.3-rc.1 to alpha returns 1.2.4-alpha.1. Forward token changes retain the current patch version.

• :gh:499: Version.next_version("prerelease") now advances the patch version when incrementing an old-style prerelease counter would produce an older version. For example, 1.2.3-rc9 becomes 1.2.4-rc10. The legacy token and incremented counter are preserved; increments that already move forward keep the current patch version.

Trivial Changes

• :pr:502: Add tests for six behaviours that mutation testing showed were not covered: :func:match() at the boundary version, build metadata in :func:is_compatible(), numeric-only prereleases in :func:bump_prerelease(), the :command:pysemver return code for an invalid version, and the :func:deprecated() messages.

... (truncated)

Commits

• b6e83e3 Bump version 3.1.0 -> 3.1.1 (#509)
• 9f6894d Fix Version subscripts to honor index (#508)
• f3c7138 test: cover six behaviours found untested by mutation testing (#502)
• 0bd62d4 Preserve constructor TypeError in Version.replace (#501)
• 15a42d0 Bump certifi from 2026.6.17 to 2026.10.19 (#504)
• 868a6b3 Bump virtualenv from 21.7.13 to 21.14.13 (#503)
• 9ef4131 Preserve version order when legacy prerelease counters roll over (#500)
• bcd151f Preserve version order when switching prerelease tokens (#498)
• 94debf9 Annotate supported bytes inputs to Version.is_valid (#495)
• 84561d5 Bump virtualenv from 21.5.1 to 21.7.13 (#492)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Thank you for your contribution, one of the team will evaluate shortly.