Dependabot aug2026

[hakonhagland]

Clear all 23 open Dependabot alerts in python/sphinx_docs/poetry.lock

All 23 open Dependabot alerts on this repository sit in the single lock file python/sphinx_docs/poetry.lock and cover five distinct packages. This PR closes all of them with a targeted relock — one poetry update --lock <pkg> per affected package — so the only versions that move are the six that actually need to. A plain poetry update would additionally have pulled in sphinx 7.2.6 → 7.3.7, sphinx-versioned-docs 1.3.1 → 1.4, typer 0.9.0 → 0.27.1, rich 13 → 15 and roughly thirty more packages. Several of those are load-bearing for the gh-pages docs build — sphinx-versioned-docs provides the sphinx-versioned command the workflow runs, and typer/rich sit underneath it — so the churn carries real regression risk while closing no additional alerts. That upgrade is better done separately and reviewed on its own.

Version delta versus master:

Package	Before	After
GitPython	3.1.50	3.1.58
setuptools	80.7.1	84.0.0
idna	3.7	3.18
Pygments	2.17.2	2.20.0
requests	2.32.4	2.34.2
pytest	8.3.4	9.1.1

Bump GitPython to 3.1.58 (commit 1)

• Fixes 18 of the 23 alerts (Please publish versions for 2025.10 and 2026.04 #26–#44) in one hop. Between 2026-07-21 and 2026-08-07 a campaign of argument-injection findings was published against GitPython, each patched in an incremental 3.1.x release.
• Covers unguarded git option forwarding enabling arbitrary file read/overwrite or command execution via clone and checkout hooks (GHSA-956x-8gvw-wg5v, GHSA-6p8h-3wgx-97gf, GHSA-fjr4-x663-mwxc, GHSA-3f7w-8rr8-f37f, GHSA-4gmw-gg2m-w46p, GHSA-9rj7-rf2p-w77r, GHSA-hh9p-6wh2-4mfc, GHSA-539m-9xh6-q6rr, GHSA-p538-c434-8v24); denylist bypasses through option abbreviation, joined short options and single-character token smuggling (GHSA-v396-v7q4-x2qj, GHSA-2f96-g7mh-g2hx, GHSA-r9mr-m37c-5fr3, GHSA-wvpp-8hx9-p66j); git-config injection forging core.sshCommand and core.hooksPath (GHSA-3rp5-jjmw-4wv2, GHSA-jm78-9fvv-mhgr); environment-variable exfiltration via expandvars() on clone and remote URLs (GHSA-rwj8-pgh3-r573, GHSA-94p4-4cq8-9g67); and repository creation outside the working tree via an unvalidated .gitmodules submodule name (GHSA-hmq2-w58f-27jc).
• No exposure in practice, but no reason to stay behind either: GitPython is only reached here with fixed, non-attacker-controlled values — git.Repo.init() and a positional branch checkout in the test fixtures, and plain branch-name checkouts inside sphinx-versioned-docs. Both call sites were checked against the new option guards and are unaffected.

Bump setuptools to 84.0.0 (commit 2)

• Fixes alert #30, GHSA-h35f-9h28-mq5c (CVE-2026-59890): MANIFEST.in exclusion bypass when building an sdist, through an NFC/NFD Unicode normalization collision on macOS APFS/HFS+ filesystems.
• setuptools is a transitive runtime dependency pulled in by sphinx-versioned-docs.

Bump idna to 3.18 (commit 3)

• Fixes alert Bump idna from 3.7 to 3.15 in /python/sphinx_docs #25, GHSA-65pc-fj4g-8rjx (CVE-2026-45409): specially crafted input to idna.encode() bypasses the CVE-2024-3651 fix, allowing excessive resource consumption.
• idna is a transitive dependency of requests, and was still locked at 3.7.

Bump Pygments to 2.20.0 (commit 4)

• Fixes alert Upgrade requests 2.32.3->2.32.4 #16, GHSA-5239-wwwm-4pmq (CVE-2026-4539): regular expression denial of service caused by an inefficient regex for GUID matching.
• Pygments is a transitive dependency of Sphinx.

Bump requests to 2.34.2 (commit 5)

• Fixes alert Use OPM-action to install poetry, instead of abatilo/actions-poetry s… #15, GHSA-gc5v-m9x4-r6x2 (CVE-2026-25645): insecure temporary file reuse in the extract_zipped_paths() utility function.

Bump pytest to 9.1.1 (commit 6)

• Fixes alert Add template support to sphinx_ext_docstrings.py #17, GHSA-6w46-j5rx-g56g (CVE-2025-71176): insecure handling of the per-user temporary directory, which is reused across runs and can be pre-created by another local user.
• This is the only alert that needs a pyproject.toml change — the fix first landed in pytest 9.0.3, so the dev constraint moves from ^8.3.4 to ^9.0.3. Every other bump is lock-only.
• pytest-mock 3.14.0 requires only pytest >= 6.2.5 and is unaffected.

Verification

• poetry install && poetry run pytest tests passes on the new lock.
• The full multi-version docs build was reproduced locally in a throwaway clone — poetry run sphinx-versioned -m master -b "master release-2025.10 release-2026.04" --force --git-root ../../ succeeded for all three branches and produced the expected docs/_build/ tree. This is the check that matters for the GitPython bump, since sphinx-versioned is what drives the branch checkouts.
• CI re-runs both: python_sphinx_docs.yml builds the docs on push, and python_scripts.yml runs the test suite on Python 3.11 and 3.12.

Follow-up (not in this PR)

This repository has no .github/dependabot.yml, so GitHub only raises security alerts and never opens version-update PRs. That is why the lock had drifted to a 2024-era idna and certifi. Adding a grouped pip configuration for /python/sphinx_docs would keep this from recurring — grouping matters, since GitPython alone went through eight patch releases in the three weeks from 2026-07-21 to 2026-08-07, and ungrouped that would have arrived as a steady stream of individual PRs.