Bump pymdown-extensions from 11.0 to 11.0.1

[dependabot]

Bumps pymdown-extensions from 11.0 to 11.0.1.

Release notes

Sourced from pymdown-extensions's releases.

11.0.1

• FIX: BetterEm: Fix regex pattern inefficiencies.
• FIX: Tilde: Fix regex pattern inefficiencies.
• FIX: Caret: Fix regex pattern inefficiencies.
• FIX: MagicLink: Fix regex pattern inefficiencies.

Commits

• c684985 Merge commit from fork
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[claude]

🔍 Dependency Analysis Summary

Package	Old	New	Type
pymdown-extensions	11.0	11.0.1	Transitive (via zensical and mkdocstrings)

Only uv.lock changed — no pyproject.toml constraint churn. This is a patch-level security release.

Overall risk: LOW ✅ (and it resolves a High-severity advisory)

---

📋 Changelog Review

• Name: pymdown-extensions (11.0 → 11.0.1)
• Changes: Four fixes, all regex-pattern efficiency corrections in inline processors:
  • FIX: BetterEm — regex pattern inefficiencies
  • FIX: Tilde — regex pattern inefficiencies
  • FIX: Caret — regex pattern inefficiencies
  • FIX: MagicLink — regex pattern inefficiencies
• Breaking Changes: None. No API, option, or output changes — the patterns were rewritten to avoid catastrophic backtracking, not to change what they match.
• Security Fixes: Yes — this is the whole point of the release.
  • CVE-2026-67422 / GHSA-gm37-52c6-37mw — exponential-backtracking ReDoS (High severity)
  • Affects the caret, tilde, betterem, and magiclink inline processors in versions ≤ 11.0. Delimiter runs could be partitioned in exponentially many ways, so a single untrusted Markdown line under 50 bytes could drive markdown.markdown() into unbounded CPU usage. Fixed in 11.0.1.
  • The upstream commit is titled "Merge commit from fork", consistent with a coordinated private security fix.

Practical exposure for this repo: low. This is a static docs site — Markdown is rendered at build time from trusted, in-repo content, not from attacker-supplied input. The realistic worst case is a slow build, not a live DoS. Still worth taking: it clears the Dependabot/CVE alert and costs nothing.

---

⚠️ Build Impact

• uv sync --locked: pass — lockfile is consistent, no resolution drift (43 packages checked).

• uv run zensical build --clean: pass ✅

  Build started
  No issues found
  Build finished in 2.80s
  

  strict: true is set in mkdocs.yml, so "No issues found" also confirms no broken internal links or refs were introduced.

• Breaking changes found: No.

• Extension surface check: mkdocs.yml enables a fair number of pymdownx.* extensions — blocks.caption, details, superfences, emoji, highlight, inlinehilite, snippets, tabbed. None of the four patched processors (caret, tilde, betterem, magiclink) are explicitly enabled in this config, so the change is essentially inert for our rendered output. Note that pymdown-extensions arrives transitively through both zensical (0.0.57) and mkdocstrings (1.0.6); neither pins it away from 11.0.1, and the build confirms compatibility.

---

🛠️ Recommendation

• Merge Recommendation: APPROVE ✅

  Patch release, security-fix-only, no breaking changes, no API surface touched, the affected processors are not even enabled in our config, and the site builds clean against it. About as safe as a Dependabot PR gets.

• Follow-up: None required. Base branch is main, which is correct — this touches uv.lock only, not docs/chat_widget/, so it does not belong on widget-develop.

_{Note: I did not run uv run pytest scripts/tests (the command needed approval in this environment). Those tests cover scripts/update_confluence_release.py and are unrelated to Markdown rendering, so it does not change the recommendation — CI covers them.}