Update dependency markdown-it-py to v2.2.0 [SECURITY] - autoclosed
Metadata
Current evaluation
Renovate bot PR updating markdown-it-py to v2.2.0 for security fixes was autoclosed without review or merge. The update was abandoned, likely due to inactivity or configuration.
Suggested action: —
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [markdown-it-py](https://togithub.com/executablebooks/markdown-it-py) | `==2.1.0` -> `==2.2.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
### GitHub Vulnerability Alerts
#### [CVE-2023-26302](https://nvd.nist.gov/vuln/detail/CVE-2023-26302)
Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.
#### [CVE-2023-26303](https://nvd.nist.gov/vuln/detail/CVE-2023-26303)
Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.
---
### Release Notes
<details>
<summary>executablebooks/markdown-it-py (markdown-it-py)</summary>
### [`v2.2.0`](https://togithub.com/executablebooks/markdown-it-py/blob/HEAD/CHANGELOG.md#220---2023-02-22)
[Compare Source](https://togithub.com/executablebooks/markdown-it-py/compare/v2.1.0...v2.2.0)
##### What's Changed
- ⬆️ UPGRADE: Allow linkify-it-py v2 by [@​hukkin](https://togithub.com/hukkin) in [#​218](https://togithub.com/executablebooks/markdown-it-py/pull/218)
- 🐛 FIX: CVE-2023-26303 by [@​chrisjsewell](https://togithub.com/chrisjsewell) in [#​246](https://togithub.com/executablebooks/markdown-it-py/pull/246)
- 🐛 FIX: CLI crash on non-utf8 character by [@​chrisjsewell](https://togithub.com/chrisjsewell) in [#​247](https://togithub.com/executablebooks/markdown-it-py/pull/247)
- 📚 DOCS: Update the example by [@​redstoneleo](https://togithub.com/redstoneleo) in [#​229](https://togithub.com/executablebooks/markdown-it-py/pull/229)
- 📚 DOCS: Add section about markdown renderer by [@​holamgadol](https://togithub.com/holamgadol) in [#​227](https://togithub.com/executablebooks/markdown-it-py/pull/227)
- 🔧 Create SECURITY.md by [@​chrisjsewell](https://togithub.com/chrisjsewell) in [#​248](https://togithub.com/executablebooks/markdown-it-py/pull/248)
- 🔧 MAINTAIN: Update mypy's additional dependencies by [@​hukkin](https://togithub.com/hukkin) in [#​217](https://togithub.com/executablebooks/markdown-it-py/pull/217)
- Fix typo by [@​jwilk](https://togithub.com/jwilk) in [#​230](https://togithub.com/executablebooks/markdown-it-py/pull/230)
- 🔧 Bump GH actions by [@​chrisjsewell](https://togithub.com/chrisjsewell) in [#​244](https://togithub.com/executablebooks/markdown-it-py/pull/244)
- 🔧 Update benchmark pkg versions by [@​chrisjsewell](https://togithub.com/chrisjsewell) in [#​245](https://togithub.com/executablebooks/markdown-it-py/pull/245)
##### New Contributors
Thanks to 🎉
- [@​jwilk](https://togithub.com/jwilk) made their first contribution in [#​230](https://togithub.com/executablebooks/markdown-it-py/pull/230)
- [@​holamgadol](https://togithub.com/holamgadol) made their first contribution in [#​227](https://togithub.com/executablebooks/markdown-it-py/pull/227)
- [@​redstoneleo](https://togithub.com/redstoneleo) made their first contribution in [#​229](https://togithub.com/executablebooks/markdown-it-py/pull/229)
**Full Changelog**: <https://github.com/executablebooks/markdown-it-py/compare/v2.1.0...v2.2.0>
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC.
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/imagecraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy44Ny4yIiwidXBkYXRlZEluVmVyIjoiMzcuODcuMiIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Renovate bot PR updating markdown-it-py to v2.2.0 for security fixes was autoclosed without review or merge. The update was abandoned, likely due to inactivity or configuration. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | The Renovate PR updating markdown-it-py to v2.2.0 to address two CVEs was autoclosed without merging. The security update was not applied, likely superseded or abandoned due to inactivity or configuration. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Automated PR updating markdown-it-py to v2.2.0 to patch CVE-2023-26302 and CVE-2023-26303 was autoclosed. The update became obsolete or was superseded, with no merge performed. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #10 Update dependency Pygments to v2.15.0 [SECURITY] - autoclosed | imagecraft | closed | Renovate bot PR to update Pygments to v2.15.0 for CVE-2022-40896 was autoclosed without merging. No reviews or CI checks were performed. | |
| #1921 build(deps): update dependency requests to v2.32.2 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate bot pull request updating requests to v2.32.2 to address CVE-2024-35195 was autoclosed. The dependency update was not merged and remains abandoned, likely due to branch deletion or being superseded by another resolution. | |
| #6125 build(deps): update dependency requests to v2.33.0 [security] (main) - autoclosed | snapcraft | closed | Renovate automatically closed the requests v2.33.0 security update without merging. The PR was abandoned due to inactivity and unresolved CI checks, leaving the dependency outdated. | |
| #12 Update dependency requests to v2.31.0 [SECURITY] - autoclosed | imagecraft | closed | Renovate autoclosed this pull request to update requests to v2.31.0 for CVE-2023-32681. The PR was abandoned without merging, indicating it was superseded by a newer update or stale configuration. | |
| #2066 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/3.2) - autoclosed | charmcraft | closed | Renovate bot pull request updating jinja2 to v3.1.5 for security fixes was automatically closed without review or merge. The update was abandoned by the bot. | |
| #2209 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/3.3) - autoclosed | charmcraft | closed | Renovate bot dependency update for jinja2 to v3.1.6 was autoclosed without review or merging. The security patch was abandoned. | |
| #4 Update dependency reportlab to v3.6.13 [SECURITY] - autoclosed | imagecraft | closed | Automated reportlab update to v3.6.13 for CVE-2023-33733 was autoclosed without merging. The bot closed the inactive PR due to zero reviews and no CI checks. | |
| #1117 build(deps): update dependency requests to v2.32.4 [security] (main) - autoclosed | craft-parts | closed | Renovate autoclosed the pull request updating requests to v2.32.4 for CVE-2024-47081. The security update was automatically closed and unmerged, likely due to CI failures or being superseded. | |
| #1283 build(deps): update dependency setuptools to v82 (main) - autoclosed | rockcraft | closed | The setuptools dependency update PR was autoclosed without merging. Renovate bot automatically closed the request after it received no reviews or comments. | |
| #1689 chore(deps): update dependency requests to v2.32.0 [security] - autoclosed | charmcraft | closed | Renovate bot dependency update to requests v2.32.0 for CVE-2024-35195 was autoclosed. The branch was abandoned without review or merge, as the update was likely already applied or superseded. |