From 1799178370188185a69fddc10f0d172b41c362d6 Mon Sep 17 00:00:00 2001 From: Shirofune-Security <43838376+Shirofune-Security@users.noreply.github.com> Date: Sat, 24 Oct 2026 00:36:52 +0900 Subject: [PATCH] security(docs): bump mkdocs-material to 9.8.0 (CVE-2026-73295) Bumps mkdocs-material 9.7.6 -> 9.8.0 (latest), which resolves Dependabot alert #1. mkdocs-material 7.2.0 through 9.7.6 contains a DOM-based XSS in the optional `search.suggest` feature via a crafted `q` URL parameter (GHSA-xvg9-69gf-fjrf, CVE-2026-73295, CVSS 5.4); fixed in 9.7.7 and later. Documentation-site build dependency only (website/requirements.txt, used by .github/workflows/docs.yml); does not affect WELA itself. Co-Authored-By: Claude Opus 4.8 --- website/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/website/requirements.txt b/website/requirements.txt index 1f957055..ffb81e54 100644 --- a/website/requirements.txt +++ b/website/requirements.txt @@ -2,6 +2,6 @@ # Used by .github/workflows/docs.yml and for local previews: # pip install -r website/requirements.txt # mkdocs serve -f website/mkdocs.yml -mkdocs-material==9.7.6 +mkdocs-material==9.8.0 mkdocs-glightbox==0.5.2 mkdocs-static-i18n==1.3.1