cswimr/SeaCogs
cswimr/SeaCogs
Watch
1
1
Fork
You've already forked SeaCogs
 2
Code Issues 10 Pull requests 14 Projects 1 Wiki Activity Actions

chore(deps): update dependency mkdocs-material to v9.7.7 [security] #204

Open
Renovate wants to merge 1 commit from renovate/pypi-mkdocs-material-vulnerability into main
pull from: renovate/pypi-mkdocs-material-vulnerability
merge into: cswimr:main
Conversation 0 Commits 1 Files changed 1 +4 -4
Renovate commented 2026-10-26 15:08:54 -04:00
Collaborator
Copy link

This PR contains the following updates:

Package Change Age Confidence
mkdocs-material (changelog) 9.7.6 → 9.7.7 age confidence

Material for MkDocs: DOM XSS in search suggestions via query parameter

CVE-2026-73295 / GHSA-xvg9-69gf-fjrf / PYSEC-2026-3864

More information

Details

Impact

Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction.

Patches

The issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later.

Workarounds

Sites unable to upgrade should disable the search.suggest feature.

Severity

  • CVSS Score: 5.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Material for MkDocs: DOM XSS in search suggestions via query parameter

CVE-2026-73295 / GHSA-xvg9-69gf-fjrf / PYSEC-2026-3864

More information

Details

Impact

Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction.

Patches

The issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later.

Workarounds

Sites unable to upgrade should disable the search.suggest feature.

Severity

  • CVSS Score: 5.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

Release Notes

squidfunk/mkdocs-material (mkdocs-material)

v9.7.7: mkdocs-material-9.7.7

Compare Source

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. After this date, the project will remain available on PyPI and GitHub, but no further maintenance is planned except in exceptional circumstances.

For users looking for a long-term, actively developed successor, we're building Zensical – a next-generation static site generator designed for technical documentation. If you're planning a new documentation project or evaluating your long-term options, we invite you to take a look.

Organizations requiring support beyond this date are welcome to get in touch to discuss available options.

Read the full announcement on our blog

Changes

  • Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [mkdocs-material](https://github.com/squidfunk/mkdocs-material) ([changelog](https://squidfunk.github.io/mkdocs-material/changelog/)) | `9.7.6` → `9.7.7` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/mkdocs-material/9.7.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/mkdocs-material/9.7.6/9.7.7?slim=true) | --- ### Material for MkDocs: DOM XSS in search suggestions via query parameter [CVE-2026-73295](https://nvd.nist.gov/vuln/detail/CVE-2026-73295) / [GHSA-xvg9-69gf-fjrf](https://github.com/advisories/GHSA-xvg9-69gf-fjrf) / PYSEC-2026-3864 <details> <summary>More information</summary> #### Details ##### Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional `search.suggest` feature. A crafted `q` URL parameter could execute JavaScript in the documentation site's origin after user interaction. ##### Patches The issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later. ##### Workarounds Sites unable to upgrade should disable the `search.suggest` feature. #### Severity - CVSS Score: 5.4 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N` #### References - [https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf](https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf) - [https://nvd.nist.gov/vuln/detail/CVE-2026-73295](https://nvd.nist.gov/vuln/detail/CVE-2026-73295) - [https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25](https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25) - [https://github.com/squidfunk/mkdocs-material](https://github.com/squidfunk/mkdocs-material) - [https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7](https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-xvg9-69gf-fjrf) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Material for MkDocs: DOM XSS in search suggestions via query parameter [CVE-2026-73295](https://nvd.nist.gov/vuln/detail/CVE-2026-73295) / [GHSA-xvg9-69gf-fjrf](https://github.com/advisories/GHSA-xvg9-69gf-fjrf) / PYSEC-2026-3864 <details> <summary>More information</summary> #### Details ##### Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional `search.suggest` feature. A crafted `q` URL parameter could execute JavaScript in the documentation site's origin after user interaction. ##### Patches The issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later. ##### Workarounds Sites unable to upgrade should disable the `search.suggest` feature. #### Severity - CVSS Score: 5.4 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N` #### References - [https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf](https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf) - [https://nvd.nist.gov/vuln/detail/CVE-2026-73295](https://nvd.nist.gov/vuln/detail/CVE-2026-73295) - [https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25](https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25) - [https://github.com/squidfunk/mkdocs-material](https://github.com/squidfunk/mkdocs-material) - [https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7](https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7) - [https://pypi.org/project/mkdocs-material](https://pypi.org/project/mkdocs-material) - [https://github.com/advisories/GHSA-xvg9-69gf-fjrf](https://github.com/advisories/GHSA-xvg9-69gf-fjrf) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3864) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### Release Notes <details> <summary>squidfunk/mkdocs-material (mkdocs-material)</summary> ### [`v9.7.7`](https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7): mkdocs-material-9.7.7 [Compare Source](https://github.com/squidfunk/mkdocs-material/compare/9.7.6...9.7.7) > \[!WARNING] > > **Material for MkDocs is approaching end of life** > > Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. After this date, the project will remain available on PyPI and GitHub, but no further maintenance is planned except in exceptional circumstances. > > For users looking for a long-term, actively developed successor, we're building [Zensical] – a next-generation static site generator designed for technical documentation. If you're planning a new documentation project or evaluating your long-term options, we invite you to take a look. > > Organizations requiring support beyond this date are welcome to get in touch to discuss available options. > > [Read the full announcement on our blog] [Zensical]: https://zensical.org [Read the full announcement on our blog]: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/ #### Changes - Fixed a DOM-based XSS vulnerability in search suggestions > Thanks to [@&#8203;p-](https://github.com/p-) for responsibly reporting this issue. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODEuOCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MS44IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
chore(deps): update dependency mkdocs-material to v9.7.7 [security]
All checks were successful
Actions / Lint (pull_request) Successful in 1m1s
Details
Actions / Build Documentation (pull_request) Successful in 59s
Details
Actions / Ensure Cogs Load (pull_request) Successful in 4m56s
Details
9f8c723483
All checks were successful
Actions / Lint (pull_request) Successful in 1m1s
Required
Details
Actions / Build Documentation (pull_request) Successful in 59s
Required
Details
Actions / Ensure Cogs Load (pull_request) Successful in 4m56s
Required
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/pypi-mkdocs-material-vulnerability:renovate/pypi-mkdocs-material-vulnerability
git switch renovate/pypi-mkdocs-material-vulnerability
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is not working

  
cog
New cog

  
cog
Aurora
 Issue relates to the Aurora cog

  
cog
Backup
 Issue relates to the Backup cog

  
cog
Bible
 Issue relates to the Bible cog

  
cog
EmojiInfo
 Issue relates to the EmojiInfo cog

  
cog
HotReload
 Issue relates to the HotReload cog

  
cog
IssueCards
 Issue relates to the IssueCards cog

  
cog
Nerdify
 Issue relates to the Nerdify cog

  
cog
Pterodactyl
 Issue relates to the Pterodactyl cog

  
cog
RobloxVerify
 Issue relates to the RobloxVerify cog

  
cog
SeaUtils
 Issue relates to the SeaUtils cog

  
cog
SentinelCore
 Issue relates to the SentinelCore cog

  
cog
TickChanger
 Issue relates to the TickChanger cog

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
bug
cog
cog
Aurora
cog
Backup
cog
Bible
cog
EmojiInfo
cog
HotReload
cog
IssueCards
cog
Nerdify
cog
Pterodactyl
cog
RobloxVerify
cog
SeaUtils
cog
SentinelCore
cog
TickChanger
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
cswimr/SeaCogs!204
No description provided.