:arrow_up: Updates mkdocs-include-markdown-plugin to v7 [SECURITY] by renovate[bot] · Pull Request #3537 · AlexRogalskiy/java-patterns

Add cache_dir global setting to configure the path to the cache directory. When setted avoids the requirement to install platformdirs to use HTTP caching.

`v7.1.1`

Compare Source

New features

Add a new directives global setting to customize directive names.

Enhancements

Some performance optimizations.

`v7.0.1`

Compare Source

Enhancements

Performance optimization up to 25% faster.

`v7.0.0`

Compare Source

Breaking changes

No longer installable on Python v3.8

Minimum Python version for installation is v3.9. Python v3.8 reached his end of life at 2024-10-07.

Comments are turned off by default

Before this release, the default value for comments argument of include-markdown directive was true. Now has been switched to false. This prevents some inconvenients, for example, trying to include one-line texts on table cells and list items.

If you want the previous behaviour, configure comments as true in the global configuration:

plugins:
  - include-markdown:
      comments: true

Indented code blocks must be surrounded by newlines

Now mkdocs-include-markdown-plugin will only detect indented code blocks if are surrounded by newlines, conforming to CommonMark specification.

In the practice this means that you must surround indented code blocks with newlines or possible link targets URLs will be rewritten to work in relative files. For example, the next code is not treated as an indented code block any more and will break:

Foo
    const auto lambda = []() { .... };

`v6.2.2`

Compare Source

Enhancements

Add official support for Python v3.13.
Relax wcmatch dependency.

`v6.2.1`

Compare Source

Bug fixes

Improve performance of inclusion regex processing. Prevents to take a lot of time parsing long lines looking for inclusions.

`v6.2.0`

Compare Source

New features

Add recursive argument to include-markdown directive.

Enhancements

Apply substitutions from all directives at once. Improves performance in all includes and prevents big performance degradations including large contents in the same files of other includes.
Warn when passing invalid arguments to directives. It could catches bad syntax, like trying to turning off comments in include directives (include does not provides a comments argument).

`v6.1.1`

Compare Source

Enhancements

Change substitions order of directives. Prevents performance degradations when including long files with include directive in the same file with other include-markdown directive.

`v6.1.0`

Compare Source

New features

Add a new recursive argument to the include directive that allows to stop recursively processing includes in included files.

`v6.0.7`

Compare Source

Bug fixes

Fix error message on Windows when a file that is not inside the same drive of the docs_dir directory is not found.

`v6.0.6`

Compare Source

Bug fixes

Fixed errors when using Mkdocs>=1.6.0 generated files (#205). Now if you try to include using a relative path from a generated file, an error will be raised.

`v6.0.5`

Compare Source

Bug fixes

Fixed default setting heading_offset not being applied.

`v6.0.4`

Compare Source

Bug fixes

Fixed logging variables not included formatting messages (regression from v6.0.2).

`v6.0.3`

Compare Source

Enhancements

Add mkdocs>=1.4 as dependency.

`v6.0.2`

Compare Source

Enhancements

Dropped Python upper version requirement bound.

`v6.0.1`

Compare Source

Bug fixes

Fixed some warnings not shown when missing start and end delimiters in some contexts (regression from v6.0.0).

`v6.0.0`

Compare Source

⚠️ Breaking changes

Inclusion and exclusion relative paths and globs must start with ./ or ../. Non-explicit relative paths (like foo/bar.md) will be treated as relative to docs_dir (typically the docs/ directory). To migrate just prepend ./ in all your implicit relative paths and globs.
```
- {% include-markdown "foo/bar.md" %}
+ {% include-markdown "./foo/bar.md" %}

- {% include-markdown "foo/*.md" %}
+ {% include-markdown "./foo/*.md" %}
```
exclude configuration setting added in v5.1.0 is not treated more as a default value for the exclude argument. Now accepts an array that defines multiple global exclusion patterns that will extend the exclude argument pattern matches. Relative paths used by the exclude global setting will be treated as relatives to docs_dir.

New features

Includer and excluder globs now accept Bash-style wildcard patterns, allowing more flexible inclusions and exclusions, for example:
```
{% include-markdown "**" exclude="./{index,LICENSE}.md" %}
```
Allow to define paths and globs relative to docs/ directory for inclusions and exclusions with implicit relative paths like foo/bar.md or index.md.

Enhancements

Raise PluginErrors instead of BuildErrors as recommended by Mkdocs.

`v5.1.0`

Compare Source

New features

The next default values for arguments can be defined as settings:

start
end
exclude
heading_offset
rewrite_relative_urls

Bug fixes

Fixed error getting content from cache.
Fixed detection of invalid heading-offset values.

Improvements

Improved invalid values detection of boolean and integer arguments.

`v5.0.0`

Compare Source

⚠️ Breaking changes

Drop Python 3.7 support.
Drop Mkdocs < 1.4.0 support.

Enhancements

Add support for Python 3.12.

New features

Files to include can be now be URLs to include remote content.
Added cache extra and setting to control HTTP requests persistent file caching.

Bug fixes

Fix errors not producing a non zero exitcode when building.

`v4.0.4`

Compare Source

Bug fixes:

Fixed error using livereload server with Mkdocs < 1.4.0

`v4.0.3`

Compare Source

Enhancements:

Added some performance improvements.

`v4.0.2`

Compare Source

Bug fixes:

Fixed LiveReloadServer not imported at runtime with serve command (regression in 4.0.1)

`v4.0.1`

Compare Source

Enhancements:

The plugin has been fully typed.

Bug fixes:

Prevented an edge case bug when specifying an invalid encoding parameter in directives.

`v4.0.0`

Compare Source

⚠️ Breaking changes:

The plugin is no longer installable on Python 3.6.

`v3.9.1`

Compare Source

Bug fixes:

Fixed event order on Mkdocs >= 1.4.0

`v3.9.0`

Compare Source

New features:

Included files are watched when using mkdocs serve. Only supported from Mkdocs v1.4.0 onwards.

Deprecated:

The support for Python 3.6 has been oficially deprecated and the plugin will not be installable on that version from the next v4.0.0 release.

`v3.8.1`

Compare Source

Bug fixes:

Fixed two errors relative to includer indentation for both directives.

`v3.8.0`

Compare Source

New features:

Allow to configure globally some arguments passed to directives, see Configuration 👀

`v3.7.1`

Compare Source

Bug fixes:

HTML-escape file paths in comments generated by include-markdown directive to prevent broken content when including some edge cases.

`v3.7.0`

Compare Source

New features:

Added new argument encoding for both directives.

`v3.6.1`

Compare Source

Bug fixes:

Wrap start and end delimiters contents by single quotes in comments to show them better.

`v3.6.0`

Compare Source

New features:

Allow to configure globally custom tags strings to open and close directives (#112).

`v3.5.2`

Compare Source

Bug fixes:

Fixed incompatibility between trailing-newlines and comments arguments of include-markdown directive.

`v3.5.1`

Compare Source

Bug fixes:

Fixed nested inclusions showing incorrect warning messages.
Fixed error skipping relative URLs rewriting in indented codeblocks using Windows newlines.

Enhancements:

Allow to pass string arguments wrapped by single quotes ' escaping them with \'.
Show errors if filename, end, start or exclude arguments are empty.
Show error rather than raising an exception if a file to be included is not found.
Show error rather than raising an exception if a parsed boolean value is not valid.
Improved warning messages adding affected line number and directive.

`v3.5.0`

Compare Source

New features:

New option trailing-newlines for both directives to strip trailing newlines from content to include.
Both directives accept now recursive ** wildcard globbing to match against subdirectories including multiple files.

Enhancements:

String arguments filename, start, end and exclude now accept double quotes " in values escaping them with \".

`v3.4.1`

Compare Source

Bug fixes:

Fixed offset application not skipped in codeblocks at nested Markdown blocks.
Fixed incorrect output skipping relative URL rewritings in indented codeblocks.

Enhancements:

Optimize migrating from pathlib to os.path.
Some tiny performance optimizations processing text.

`v3.4.0`

Compare Source

Enhancements:

Warn if end or start arguments are not detected inside content to include.

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Moscow, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-03-26T17:17:24Z

@check-spelling-bot Report

Unrecognized words, please review:

adr
akka
alexrogalskiy
allcontributors
api
arcver
assing
badgen
BETTERCODE
betterjavacode
blogspot
boopickle
bootcamp
brightgreen
bugfixes
buymeacoffee
ceb
codeready
codesandbox
codetriage
committers
configmaps
debezium
demystified
dependabot
devcases
devfile
dirtyreload
DOI
dreamix
dropdown
eab
eap
eisele
embeddableinstantiator
embeddables
facebook
fastai
fastpages
fastparse
firsttimersonly
flushmode
forthebadge
frapsoft
freemarker
FRP
fthomas
gerrit
getquill
GIFs
gitbook
gitflow
githubbox
gitpod
GPLv
Gradle
grunwald
guideslines
gunnar
Hashids
Hasids
helloworld
hitsofcode
hmil
infoworld
insidejava
Instantiator
IPhone
istio
janssen
japgolly
javacodegeeks
javafx
javamelody
javaone
JAVAPROG
jboss
jcliff
jdbc
jdk
jextract
jfr
jfrunit
johan
jpa
JRE
jsonignore
jsp
jsparty
julienrf
Jupyter
kubernetes
latestdoi
LETSTALK
letstalkaboutjava
LGPL
LGPLv
lihaoyi
liskov
logfile
mades
makeapullrequest
markdownguide
markus
matryoshka
mcve
mega
microservices
milessabin
mirrorring
mkdocs
modelviewculture
monix
mtl
mutationquery
namespaces
nestjs
Netflix
newreleases
nullables
nvie
objectmappers
odl
openapi
opengraph
opentelemetry
osslifecycle
oyanglul
pagespeedresultmobile
pasteable
patreon
paypal
PITMP
plumbr
podcast
precog
pufler
pypa
quarkus
quicklens
RANDOMTHOUGHTS
randomthoughtsonjavaprogramming
rce
reactify
readthedocs
reddit
renovatebot
reporoster
repostatus
resteasy
rfm
Rogalskiy
rogalsky
rubyonrails
runtimes
scalacss
scalafiddle
scalafmt
scalajs
scalameta
scalanlp
scalastyle
scalaz
scm
seeyoufarm
selectionquery
softwaremill
sourcegraph
spamming
splunk
sql
squants
squbs
sscce
stakeholders
starchart
sttp
stylegu
suggestig
suzaku
thejavaprogrammer
thorben
tilda
tokei
trufoj
tsb
tsbleo
tscojc
tscqlg
tsd
tsdllr
typelevel
udash
upickle
urt
ussue
violoate
vos
wget
wildfly
wix
workspaces
zenodo
zgc
zio

Previously acknowledged words that are now absent

acl activesupport adaoraul addons aeiou AFile afterall Alexey alfredxing algolia allowfullscreen Anatoliy andreyvit Ankit Anning apps appveyor arengu args ariejan arounds asciinema asdf ashmaroli attr Autobuild autocompletion autogenerated Autolink autoload autoreconf autosave awood awscli backport backtick barcamp baseurl bashrc baz bbatsov bdimcheff bellvat benbalter Beney binstubs bip bitbucket Blogger blogging bonafide Bou breadcrumbs briandoll bridgetown bridgetownrb brightbox brighterplanet buddyworks Bugfix Burela byparker cachegrind calavera callgraphs cartera cavalle CDNs cgi changefreq chango charset Chayoung chcp chdir Cheatsheet Checkoway chmod chown Chrononaut chruby cibuild cimg circleci CJK classname cloudcannon Cloudinary cloudsh CLT CODEOWNERS coderay codeslinger coffeescript colorator commandline commonmark compat compatibilize concat configyml contentblocks CORS Cov CRLFs cron crontab cruft css csv Currin CVE CWD cygwin daringfireball Dassonville datafiles datetime DCEU Debian debuggability defunkt delegators deployer deps dest Devkit devops digitalocean dirs disqus ditaa dnf doclist doctype doeorg dommmel dotfile Dousse downcase downcased duckduckgo duritong Dusseau dysinger ecf editorconfig eduardoboucas Elasticsearch elsif Emacs emails endcapture endcomment endfor endhighlight endif endraw endrender endtablerow Enumerables EOL erb errordocument Espinaco eugenebolshakov evaled exe execjs extensionpack extname exts favicon Fengyun ffi figcaption filesystem Finazzo firstimage FIXME flakey flickr fnmatch fontello forloop formcake formcarry formester formingo formkeep formspark formspree formx Forwardable frameborder freenode frontend frontmatter fsnotify ftp fullstory Gaudino gcc gcnovus gemfile gemset gemspec getform getset getsimpleform gettalong gfm ghp ghpages giraffeacademy githubcom gitignore gitlab gjtorikian globbed globbing google gotcha Goulven gridism GSo gsub gsubbing Hakiri hardcode hashbang hashmap helaili henrik heredoc heroku highlighter hilighting Hoizey hostman hostname htaccess htm htmlproofer httpd httpdocs hyperlinks Iaa ial ico icomoon iconset ified iframe Impl Inlining invokables irc ivey ize jalali jameshamann jamstackthemes jan Jax jayferd jcon jdoe jeffreytse jeffrydegrande Jekpack jekyllbot jekyllconf Jekyllers Jekyllin Jekylling jekyllized jekylllayoutconcept jekyllrb jekyllthemes jemoji jmcglone jneen johnreilly jpg jqr jruby jsonify juretta jwarby Kacper Kasberg kbd Kentico Kewin keycdn kickster Kinnula kiwifruit Kolesky konklone kontent Kotvinsky kramdown Kulig Kwokfu Lamprecht laquo lastmod launchctl launchy laurilehmijoki ldquo learnxinyminutes lexer LGTM libcurl libffi lightgray limjh linenos linkify linux liufengyun livereload localheinz localtime Locher loglevel Losslessly lovin lsi lsquo lstrip lyche macos macromates mademistakes Manmeet markdownify Maroli Marsceill maruku mathjax mathml mattr Maximiliano mchung mdash memberspace Memoize memoized memoizing mentoring mergable Mertcan mertkahyaoglu microdata mimetype mingw minibundle minifier minitest Mittal mixin mkasberg mkd mkdir mkdn mkdown mmistakes modernizr mojombo moncefbelyamani moz mreid msdn mswin MSYS mtime multiline munging Mvvm myblog mycontent mydata mydoc myimage mypage myposts myproject myrepo mysite myvalue myvar myvariable Nadjib nakanishi namespace namespaced navbar nbsp nearlyfreespeech nethack netlify netlifycms Neue nginx ngx nielsenramon nior noifniof nokogiri notextile onclick onebox oneclick onschedule openssl Optim orderofinterpretation orgs OSVDB osx packagecontrol pacman paginator pandoc pantulis params parkr parseable paspagon passthrough pathawks Pathutil paywall pdf Pelykh permalink PHP pinboard Piwigo pjhyett pkill pkpass placeholders planetjekyll plantuml plugin podcasts popen Porcel Posterous postfiles postlayout postmodern prefetching preinstalled prepends Prioritise Probot projectlist pubstorm pufuwozu pwa pwd pygments qrush Quaid rackup Rakefile razorops rbenv rdiscount rdoc rdquo realz rebund redcarpet redcloth redgreen refactor Refheap regen regex regexp remi reqs Responsify revertable rfc rfelix RHEL ridk roadmap rowspan rspec rsquo rstrip rsync rtomayko Rubo rubocop rubychan rubygem rubyinstaller rubyprof Ruparelia Rusiczki rvm ryanflorence saas samplelist samrayner sandboxed Sassc sassify schemastore Schroers Schwartzian scp scrollbar scroller scss scssify sdk SDKROOT sectore seo serverless setenv SFTP shingo shopify shortlog shoulda sieversii sigpipe simplecov Singhaniya siteleaf sitemap SITENAME Slicehost slugified slugify smartforms smartify snipcart somedir sonnym Sonomy sourced sourcemaps spam spotify ssg ssh SSL staticfiles staticman statictastic STDERR stdout Stickyposts strftime stringified Stringify stylesheet subdir subdomain subfolder subfolderitems subnav subpages subpath subpiece subsubfolderitems subthing subvalues subwidget sudo superdirectories superdirs SUSE sverrirs svn swfobject swupd symlink symlinking tablerow tada Taillandier talkyard tbody technicalpickles templating templatize Termux textilize textpattern thead therubyracer Theunissen Thornquest thoughtbot throughs Tidelift timeago timezone titleize TLS tmm tmp toc tok tomjoht toml tomo toolset toshimaru triaged triaging truncatewords tsv ttf Tudou Tumblr Tweetsert txtpen Tyborska tzinfo ubuntu uby ujh ultron undumpable unencode Unescape unescaping unicode uniq upcase uppercasing uri urlset username usr utf utils utime vanpelt Vasovi vendored vercel versioned vertycal Veyor vilcans Vishesh visualstudio vnd vohedge vps vscode vwochnik Walkthroughs wdm We'd webfont webhook webhosting webmentions webrick weekdate whitelist whitelisting wikipedia wildcards willcodeforfoo woff wordpress Workaround wsl xcode xcrun xdg Xhmikos xhtml Xiaoiver XMinutes xmlns xmlschema yajl Yarp Yashu Yastreb Youku youtube yunbox zeropadding Zlatan zlib zoneinfo zpinter Zsh zshrc zypper zzot

To accept these unrecognized words as correct (and remove the previously acknowledged and now absent words), run the following commands

... in a clone of the git@github.com:AlexRogalskiy/java-patterns.git repository
on the renovate/pypi-mkdocs-include-markdown-plugin-vulnerability branch:

update_files() {
perl -e '
my @expect_files=qw('".github/actions/spelling/expect.txt"');
@ARGV=@expect_files;
my @stale=qw('"$patch_remove"');
my $re=join "|", @stale;
my $suffix=".".time();
my $previous="";
sub maybe_unlink { unlink($_[0]) if $_[0]; }
while (<>) {
if ($ARGV ne $old_argv) { maybe_unlink($previous); $previous="$ARGV$suffix"; rename($ARGV, $previous); open(ARGV_OUT, ">$ARGV"); select(ARGV_OUT); $old_argv = $ARGV; }
next if /^(?:$re)(?:(?:\r|\n)*$| .*)/; print;
}; maybe_unlink($previous);'
perl -e '
my $new_expect_file=".github/actions/spelling/expect.txt";
use File::Path qw(make_path);
use File::Basename qw(dirname);
make_path (dirname($new_expect_file));
open FILE, q{<}, $new_expect_file; chomp(my @words = <FILE>); close FILE;
my @add=qw('"$patch_add"');
my %items; @items{@words} = @words x (1); @items{@add} = @add x (1);
@words = sort {lc($a)."-".$a cmp lc($b)."-".$b} keys %items;
open FILE, q{>}, $new_expect_file; for my $word (@words) { print FILE "$word\n" if $word =~ /\w/; };
close FILE;
system("git", "add", $new_expect_file);
'
}

comment_json=$(mktemp)
curl -L -s -S \
  --header "Content-Type: application/json" \
  "https://api.github.com/repos/AlexRogalskiy/java-patterns/issues/comments/4136759823" > "$comment_json"
comment_body=$(mktemp)
jq -r .body < "$comment_json" > $comment_body
rm $comment_json

patch_remove=$(perl -ne 'next unless s{^</summary>(.*)</details>$}{$1}; print' < "$comment_body")
  

patch_add=$(perl -e '$/=undef;
$_=<>;
s{<details>.*}{}s;
s{^#.*}{};
s{\n##.*}{};
s{(?:^|\n)\s*\*}{}g;
s{\s+}{ }g;
print' < "$comment_body")
  
update_files
rm $comment_body
git add -u

If you see a bunch of garbage

If it relates to a ...

well-formed pattern

See if there's a pattern that would match it.

If not, try writing one and adding it to the patterns.txt file.

Patterns are Perl 5 Regular Expressions - you can test yours before committing to verify it will match your lines.

Note that patterns can't match multiline strings.

binary-ish string

Please add a file path to the excludes.txt file instead of just accepting the garbage.

File paths are Perl 5 Regular Expressions - you can test yours before committing to verify it will match your files.

^ refers to the file's path from the root of the repository, so ^README\.md$ would exclude README.md (on whichever branch you're using).

github-actions

Scan Summary

Tool	Critical	High	Medium	Low	Status
Dependency Scan (universal)	2	12	14	0	❌
Shell Script Analysis	0	0	0	195	✅
Kotlin Security Audit	0	0	0	0	✅
Security Audit for Infrastructure	14	92	8	32	❌
Kotlin Static Analysis	0	0	0	0	✅
Python Source Analyzer	0	0	0	0	✅
Secrets Audit	0	4	0	0	❌

Recommendation

Please review the findings from Code scanning alerts before approving this pull request. You can also configure the build rules or add suppressions to customize this bot 👍

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot added the javascript dependencies label Mar 26, 2026

auto-assign bot requested a review from AlexRogalskiy March 26, 2026 17:13

github-actions bot added the docs label Mar 26, 2026

github-actions bot reviewed Mar 26, 2026

View reviewed changes

github-actions bot added the security findings label Mar 26, 2026

renovate bot changed the title ~~⬆️ Updates mkdocs-include-markdown-plugin to v7 [SECURITY]~~ ⬆️ Updates mkdocs-include-markdown-plugin to v7 [SECURITY] - autoclosed Mar 27, 2026

renovate bot closed this Mar 27, 2026

renovate bot deleted the renovate/pypi-mkdocs-include-markdown-plugin-vulnerability branch March 27, 2026 01:59

github-actions bot locked and limited conversation to collaborators Mar 27, 2026

⬆️ Updates mkdocs-include-markdown-plugin to v7 [SECURITY]

51fb238

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot changed the title ~~⬆️ Updates mkdocs-include-markdown-plugin to v7 [SECURITY] - autoclosed~~ ⬆️ Updates mkdocs-include-markdown-plugin to v7 [SECURITY] Mar 30, 2026

renovate bot reopened this Mar 30, 2026

renovate bot force-pushed the renovate/pypi-mkdocs-include-markdown-plugin-vulnerability branch from 13f5025 to 51fb238 Compare March 30, 2026 19:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

⬆️ Updates mkdocs-include-markdown-plugin to v7 [SECURITY]#3537

⬆️ Updates mkdocs-include-markdown-plugin to v7 [SECURITY]#3537
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/pypi-mkdocs-include-markdown-plugin-vulnerability

renovate bot commented Mar 26, 2026

Uh oh!

github-actions bot commented Mar 26, 2026 •

edited

Loading

Uh oh!

github-actions bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate bot commented Mar 26, 2026

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

Release Notes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Enhancements

Enhancements

New features

Enhancements

Enhancements

Breaking changes

No longer installable on Python v3.8

Comments are turned off by default

Indented code blocks must be surrounded by newlines

Enhancements

Bug fixes

New features

Enhancements

Enhancements

New features

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Enhancements

Enhancements

Bug fixes

⚠️ Breaking changes

New features

Enhancements

New features

Bug fixes

Improvements

⚠️ Breaking changes

Enhancements

New features

Bug fixes

Configuration

Uh oh!

github-actions bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@check-spelling-bot Report

Unrecognized words, please review:

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Scan Summary

Recommendation

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

github-actions bot commented Mar 26, 2026 •

edited

Loading