[dependabot]

Bumps the all_uv group with 5 updates in the / directory:

Package	From	To
mkdocs-excalidraw	0.6.2	0.6.3
mkdocs-git-revision-date-localized-plugin	1.5.4	1.6.2
mkdocs-glightbox	0.5.2	0.5.3
mkdocs-material	9.7.7	9.8.0
prek	0.5.2	0.5.7

Updates mkdocs-excalidraw from 0.6.2 to 0.6.3

Release notes

Sourced from mkdocs-excalidraw's releases.

v0.6.3

0.6.3 (2026-10-11)

Bug Fixes

• gha dependencies: bump actions/setup-python (e19bfcb)
• gha dependencies: bump actions/setup-python from 6 to 7 in the github-actions group (#73) (e19bfcb)
• js dependencies: bump the javascript-packages group across 1 directory with 2 updates (#75) (6faecbf)

Changelog

Sourced from mkdocs-excalidraw's changelog.

0.6.3 (2026-10-11)

Bug Fixes

• gha dependencies: bump actions/setup-python (e19bfcb)
• gha dependencies: bump actions/setup-python from 6 to 7 in the github-actions group (#73) (e19bfcb)
• js dependencies: bump the javascript-packages group across 1 directory with 2 updates (#75) (6faecbf)

Commits

• 01acfb0 chore(main): release 0.6.3 (#76)
• 6faecbf fix(js dependencies): bump the javascript-packages group across 1 directory w...
• e19bfcb fix(gha dependencies): bump actions/setup-python from 6 to 7 in the github-ac...
• See full diff in compare view

Updates mkdocs-git-revision-date-localized-plugin from 1.5.4 to 1.6.2

Release notes

Sourced from mkdocs-git-revision-date-localized-plugin's releases.

v1.6.2

Fixes

• mkdocs serve now picks up commits made while it runs, including amended commits and changes to the ignored commits file. With --dirty, the initial build is also faster (#215, #236).
• Generated pages get one stable timestamp per build, so both dates match and strict builds no longer warn about them (#231, #232 by @​akashchamp, #237).

Performance

• When enable_creation_date is off, the plugin no longer looks up creation commits. This roughly halves build time on large sites (#238).

v1.6.1

Security

• Require GitPython >= 3.2.1, which fixes a remote code execution issue in submodule cloning (GHSA for GitPython "validates a submodule's .git path only after cloning into it").

Maintenance

• Python 3.10 is end-of-life and no longer tested. It can still be installed, but it is no longer supported.

v1.6.0

Highlights

Faster builds

Every page asked git which tag pointed at its commit, and asked again for the site-wide revision commit — the same answer, recomputed for each page. Those lookups are now cached.

The bigger your site, the more you save: on a 1000 page site this removes roughly 18 seconds of build time.

custom_format keeps your own words

If your format had any text around the date directives, that text came out scrambled:

custom_format: "Updated on %d %B %Y"

before:   Up23AMt723 on 23 January 2022
now:      Updated on 23 January 2022

Any format that was made up purely of % directives (including the %d. %B %Y default) was unaffected and still renders exactly as before. Unrecognised directives such as %Q are now left alone instead of being quietly reinterpreted as a different date field.

Creation date commit hash and tag now work

page.meta.git_creation_date_localized_hash and page.meta.git_creation_date_localized_tag were documented but always came back empty. If you use them in a theme override to link back to the commit or release that introduced a page, they now contain what you expect.

Shallow clone warnings reach more setups

The warning that tells you your dates will be wrong because CI only fetched part of the history was silently skipped whenever your .git was not in the directory you ran mkdocs from — a repository inside docs/, or a temporary checkout made by plugins such as monorepo. It now fires there too.

... (truncated)

Commits

• a33e3c0 Bump version to 1.6.2
• bf1f5b0 Merge pull request #238 from timvink/perf/skip-creation-lookups
• 6706d87 Start each benchmark and test build like mkdocs build does
• 275a549 Add build benchmark script for creation date lookups
• cdd3385 Skip creation commit lookups when creation dates are disabled
• 2b8237e Add failing test for creation commit lookups with creation dates disabled
• a14fd9a Merge pull request #236 from timvink/fix/serve-stale-commit-cache
• 6e8aca2 Address Fable review of the serve cache invalidation
• 78469fb Address codex review of the serve cache invalidation
• 72686cf Add failing tests for codex review findings on serve cache
• Additional commits viewable in compare view

Updates mkdocs-glightbox from 0.5.2 to 0.5.3

Release notes

Sourced from mkdocs-glightbox's releases.

mkdocs-glightbox-0.5.3

• Supported selectolax 1.0.1 (#75)

Changelog

Sourced from mkdocs-glightbox's changelog.

mkdocs-glightbox-0.5.3 (2026-10-25)

* Supported selectolax 1.0.1 ([#75](https://github.com/blueswen/mkdocs-glightbox/issues/75))

mkdocs-glightbox-0.5.2 (2025-10-23)

* Updated selectolax dependency to >=0.3.29 to support Python 3.14 ([#64](https://github.com/blueswen/mkdocs-glightbox/issues/64))

mkdocs-glightbox-0.5.1 (2025-09-04)

* Pined selectolax to 0.3.29 to avoid missing binary wheel issue on some platforms ([#63](https://github.com/blueswen/mkdocs-glightbox/issues/63))

mkdocs-glightbox-0.5.0 (2025-09-03)

* Updated glightbox to 3.3.1
* Migrated to uv and pyproject.toml for development and building
* Replaced regex with Selectolax to improve performance, availability and maintainability ([#44](https://github.com/blueswen/mkdocs-glightbox/issues/44), [#56](https://github.com/blueswen/mkdocs-glightbox/issues/56), [#61](https://github.com/blueswen/mkdocs-glightbox/issues/61))
* Updated tests and workflow
* Support auto themed ([#49](https://github.com/blueswen/mkdocs-glightbox/issues/49))

mkdocs-glightbox-0.4.0 (2023-05-06)

* Supported manual mode ([#29](https://github.com/blueswen/mkdocs-glightbox/issues/29))
* Allow calling lightbox methods from other places ([#34](https://github.com/blueswen/mkdocs-glightbox/issues/34))
* Added id to appended script tag ([#38](https://github.com/blueswen/mkdocs-glightbox/issues/38))
* Access theme attribute directly ([#40](https://github.com/blueswen/mkdocs-glightbox/issues/40))
* Better JavaScript Error Handling ([#36](https://github.com/blueswen/mkdocs-glightbox/issues/36))

mkdocs-glightbox-0.3.7 (2023-01-24)

* Supported custom background and shadow ([#27](https://github.com/blueswen/mkdocs-glightbox/issues/27))

mkdocs-glightbox-0.3.6 (2023-12-30)

* Modified width default to auto prevent zooming large image bug ([#21](https://github.com/blueswen/mkdocs-glightbox/issues/21))
* Supported only enable glightbox with on-glb class in given page ([#28](https://github.com/blueswen/mkdocs-glightbox/issues/28))

mkdocs-glightbox-0.3.5 (2023-11-18)

* Supported compatibility with the privacy plugin of Material for MkDocs insiders ([#25](https://github.com/blueswen/mkdocs-glightbox/issues/25))

mkdocs-glightbox-0.3.4 (2023-04-25)

* Fixed regex bug: quote issue and empty alt issue ([#14](https://github.com/blueswen/mkdocs-glightbox/issues/14) [#19](https://github.com/blueswen/mkdocs-glightbox/issues/19))

mkdocs-glightbox-0.3.3 (2023-04-20)

* Refactored processing logic with regex ([#14](https://github.com/blueswen/mkdocs-glightbox/issues/14))

mkdocs-glightbox-0.3.2 (2023-03-19)

... (truncated)

Commits

• 4f9a1fd Fix action
• ec394c7 Fix action
• 93bba26 Release v0.5.3
• fa88c97 Remove python 3.8
• 15c0423 Merge pull request #75 from yoavyanuka/fix/selectolax-1.0.1-dropped-images
• b2b0382 Fix images disappearing with selectolax 1.0.1
• 869c56c Add data src test case
• 7339d61 Merge pull request #66 from jaywhj/fix/data-src-support
• 036d066 adding support for the "data-src" attribute to img
• See full diff in compare view

Updates mkdocs-material from 9.7.7 to 9.8.0

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.8.0

[!WARNING]

Material for MkDocs reaches end of life on May 5, 2027. Critical fixes and security updates continue until that date.

We're continuing our work with Zensical, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.

You can evaluate Zensical alongside MkDocs using your existing mkdocs.yml. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The classic theme variant preserves the appearance of Material for MkDocs. See the migration guide for the steps and current compatibility details.

Upcoming changes on November 5

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

• Updated Node build-time dependencies to fix vulnerabilities
• Updated Python dependency minimums and required Python 3.11
• Removed RSS from recommended dependencies
• Updated project status and maintenance links
• Updated CLI notice with end-of-life and migration guidance
• Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide. It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Dependency	Affected versions	New minimum	Advisory
Jinja2	<=3.1.5	3.1.6	CVE-2025-27516
Markdown	<3.8.1	3.8.1	CVE-2025-69534
Pygments	<2.20.0	2.20.0	CVE-2026-4539
PyMdown Extensions	<=11.0.0	11.0.1	CVE-2026-67422
Requests	<2.33.0	2.33.0	CVE-2026-25645
Pillow	<13.0.0	13.0.0	CVE-2026-96636
CairoSVG	<=2.9.0	2.9.1	CVE-2026-107378
GitPython	<=3.2.0	3.2.1	CVE-2026-114145

Pillow and CairoSVG apply to the imaging extra; GitPython applies to the git extra.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.8.0 (2026-10-24)

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

• Updated Node build-time dependencies to fix vulnerabilities
• Updated Python dependency minimums and required Python 3.11
• Removed RSS from recommended dependencies
• Updated project status and maintenance links
• Updated CLI notice with end-of-life and migration guidance
• Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide: https://zensical.org/docs/compatibility/mkdocs/migration/

It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Jinja2: affected <=3.1.5; new minimum 3.1.6 (CVE-2025-27516) GHSA-cpwx-vrp4-4pq7

Markdown: affected <3.8.1; new minimum 3.8.1 (CVE-2025-69534) GHSA-5wmx-573v-2qwq

Pygments: affected <2.20.0; new minimum 2.20.0 (CVE-2026-4539) GHSA-5239-wwwm-4pmq

PyMdown Extensions: affected <=11.0.0; new minimum 11.0.1 (CVE-2026-67422) GHSA-gm37-52c6-37mw

Requests: affected <2.33.0; new minimum 2.33.0 (CVE-2026-25645) GHSA-gc5v-m9x4-r6x2

... (truncated)

Commits

• 0f72ad6 Merge pull request #8615 from squidfunk/fix/security
• 85a048d Documentation
• 10c572e Prepare 9.8.0 release
• dd8a7ef Cleaned up unused assets
• 8771cef Updated README
• 7c9a1cc Updated changelog
• 3ce9310 Removed redirects from recommended dependencies
• 0b77e8f Updated CLI notice with end-of-life and migration guidance
• 66e4f9c Updated project status and maintenance links
• 1ed13d2 Removed RSS from recommended dependencies
• Additional commits viewable in compare view

Updates prek from 0.5.2 to 0.5.7

Release notes

Sourced from prek's releases.

0.5.7

Release Notes

Released on 2026-10-21.

Enhancements

• Support system Rust toolchains without rustup (#2887)

Performance

• Use blocking file checks for CPU-heavy builtin hooks (#2910)

Other changes

• Update CA root crates and uv for the eMudhra intermediate CA compromise (#2919)

Contributors

• @​shaanmajid
• @​j178

Install prek 0.5.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.5.7

File	Platform	Checksum
prek-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
prek-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
prek-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
prek-x86_64-pc-windows-msvc.zip	x64 Windows	checksum

... (truncated)

Changelog

Sourced from prek's changelog.

0.5.7

Released on 2026-10-21.

Enhancements

• Support system Rust toolchains without rustup (#2887)

Performance

• Use blocking file checks for CPU-heavy builtin hooks (#2910)

Other changes

• Update CA root crates and uv for the eMudhra intermediate CA compromise (#2919)

Contributors

• @​shaanmajid
• @​j178

0.5.6

Released on 2026-10-19.

Enhancements

• Add builtin hook check-commit-trailers (#2885)
• Add builtin hook check-signed-commit (#2725)

Performance

• Enable PGO for native release builds (#2890)
• Reduce hook process launches with balanced batches (#2907)
• Resolve hook commands before batching (#2840)

Bug fixes

• Accept UTF-8 BOM in check-json (#2879)
• Preserve unquoted dotted revisions in prek update (#2853)

Documentation

• Document standalone installer options (#2859)
• Update benchmarks for prek 0.5.5 (#2786)

Other changes

• Enable ICF for release builds (#2891)
• Update uv to 0.13.0 (#2856)

... (truncated)

Commits

• 8569a4a Bump version to 0.5.7 (#2920)
• c290bac Bump certifi from 2026.7.22 to 2026.10.19 (#2921)
• 40287b8 Temporarily skip Aliyun uv download in CI (#2922)
• 062c8a0 Update CA root crates and uv for the eMudhra intermediate CA compromise (#2919)
• 5b66378 Log download and archive extraction stages (#2917)
• c369353 Share tar extraction across compression formats (#2916)
• 1c82a0d Move managed Rust toolchain discovery into the installer (#2914)
• 2bf1958 Support system Rust toolchains without rustup (#2887)
• 812e80f Move shared hook helpers and rename run to concurrency (#2911)
• 615a001 Use blocking file checks for CPU-heavy builtin hooks (#2910)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions