Skip to content

⬆️ Updates Pygments to v2.20.0 [SECURITY]#3542

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/pypi-pygments-vulnerability
Open

⬆️ Updates Pygments to v2.20.0 [SECURITY]#3542
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/pypi-pygments-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Mar 26, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
Pygments (changelog) ==2.12.0 → ==2.20.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2022-40896

A ReDoS issue was discovered in pygments/lexers/smithy.py in Pygments until 2.15.0 via SmithyLexer.

CVE-2026-4539

A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Release Notes

pygments/pygments (Pygments)

v2.20.0

Compare Source

(released March 29th, 2026)

v2.19.2

Compare Source

(released June 21st, 2025)

v2.19.1

Compare Source

(released January 6th, 2025)

  • Updated lexers:

    • Ini: Fix quoted string regression introduced in 2.19.0
    • Lua: Fix a regression introduced in 2.19.0

v2.19.0

Compare Source

(released January 5th, 2025)

  • Mark file extensions for HTML/XML+Evoque as aliases (#​2743)
  • Add a color for Operator.Word to the rrt style (#​2709)
  • Fix broken link in the documentation (#​2803, #​2804)
  • Drop executable bit where not needed (#​2781)
  • Reduce Mojo priority relative to Python in analyze_text (#​2771, #​2772)
  • Fix documentation builds (#​2712)
  • Match example file names to the lexer's name (#​2713, #​2715)
  • Ensure lexer metadata is present (#​2714)
  • Search more directories on macOS for fonts (#​2809)
  • Improve test robustness (#​2812)

v2.18.0

Compare Source

(released May 4th, 2024)

  • New lexers:

  • Updated lexers:

    • Awk: recognize ternary operator (#​2687)
    • Bash: add openrc alias (#​2599, #​2371)
    • Coq: add keywords, lex more vernacular command arguments, produce
      fewer tokens on heading comments (#​2678)
    • DNS zone files: Fix comment parsing (#​2595)
    • Hy: Support unicode literals (#​1126)
    • Inform6: Update to Inform 6.42 (#​2644)
    • lean: Fix name handling (#​2614)
    • Logtalk: add uninstantiation keyword and recognize
      escape sequences (#​2619)
    • Macaulay2: Update to 1.23 (#​2655)
    • Python: fix highlighting of soft keywords before None/True/False
    • reStructuredText: use Token.Comment for comments instead of
      Comment.Preproc (#​2598)
    • Rust: highlight :, :: and -> as Punctuation
      and whitespace as Whitespace, instead of Text
      in both cases (#​2631)
    • Spice: Add keywords (#​2621)
    • SQL Explain: allow negative numbers (#​2610)
    • Swift: Support multiline strings (#​2681)
    • ThingsDB: add constants and new functions; support template
      strings (#​2624)
    • UL4: support nested <?doc?> and <?note?> tags (#​2597)
    • VHDL: support multi-line comments of VHDL-2008 (#​2622)
    • Wikitext: Remove kk-* in variant_langs (#​2647)
    • Xtend: Add val and var (#​2602)

  • New styles:

  • Make background colors in the image formatter work with Pillow 10.0 (#​2623)

  • Require Python 3.8. As a result, the importlib-metadata package
    is no longer needed for fast plugin discovery on Python 3.7.
    The plugins extra (used as, e.g., pip install pygments[plugins])
    is kept for backwards compatibility but now has no effect. (#​2601)

  • Require the url attribute for lexers inside Pygments, add
    it to many lexers (#​2588)

  • Replace Pyflakes linter with Ruff (#​2592)

  • Add macOS CI (#​2594)

  • Built-in lexers now declare the version of Pygments in which they were
    added in a required version_added lexer attribute, instead of a
    .. versionadded:: directive in the docstring (#​2589, #​2634)

  • The url attribute is now required for built-in lexers and
    has been added to all existing lexers (#​2588)

  • The RTF formatter supports line number and line highlighting now (#​1217, #​2654)

  • Add \sa0 keyword in the RTF formatter (#​1111, #​2607)

  • Register pycon as an alias for the Python console lexer (#​2697)

  • Add MIME-Type for DesktopLexer (#​2613)

  • Fix native style to meet WCAG AA guidelines (#​2600)

  • Fix typo in documentation (#​2672)

  • Use format strings consistently (#​2661)

  • Add __class_getitem__ to Formatter to improve typing support (#​2665)

v2.17.2

Compare Source

(released November 21, 2023)

  • Fix a packaging issue on macOS (#​2593)

v2.17.1

Compare Source

(released November 19, 2023)

  • Updated lexers:

    • TOML: Fix bug making lexing of single-quoted strings too eager

v2.17.0

Compare Source

(released November 18, 2023)

  • New lexers:

  • Updated lexers:

    • Cypher: fix comment matching, add missing keywords (#​2504)
    • Fortran: add elseif keyword (#​2528)
    • Lean: make it available as lean3, in preparation for
      a possible switch to lean highlighting as Lean 4 (#​2546)
    • JSON: add MIME types and file extensions for several line-delimited
      JSON formats (#​2490)
    • Nix: many improvements (#​2551, #​1800)
    • OCaml: Add and keyword, remove value from keywords (#​2521)
    • Python: add starlark and bazel aliases (#​2517, #​2516)
    • Snowball: Treat len like size (#​2508)
    • Spice: add panic keyword and -> operator (#​2510)
    • squid.conf: fix catastrophic backtracking (#​2583)
    • TOML: rewritten, with many fixes (#​2576)
    • Turtle: support blank nodes (#​2581)
    • Wikitext: fix erroneous highlighting of LanguageConverter markup
      (#​2493), add missing variant languages (#​2494)
    • CMake: support [=[ bracketed arguments ]=] (#​2549)

  • Fix ctags support and tests (#​2487)

  • Include Lexer.add_filter in the documentation (#​2519)

  • Add a Lean3Lexer alias (#​2546)

  • The pygments.styles module contains a new STYLES variable
    with a dictionary of built-in styles. The old STYLE_MAP variable,
    which uses a different format, is kept for backwards compatibility.

  • On Windows, add a new installation extra (windows-terminal) which pulls in
    dependencies for colored console output. See :doc:cmdline for more details.
    (#​2505)

  • Support more file types in autopygmentize script (#​2513)

  • Change color of numbers in rrt style (#​2526)

  • Fix error when trying to look up plugin formatters by file extension
    of the output format (#​2563)

  • Use Hatchling as a build backend instead of setuptools.
    This change is transparent to most users. Distribution packagers
    who build without build isolation need to add hatchling as a build
    dependency and remove setuptools. People downloading source distributions
    and wheels from PyPI directly should note that they now have pygments
    in their file names instead of Pygments. (#​2573)

  • Improve the test framework to also check for lost tokens when processing the
    snippets and example files (#​2582.)

  • Improve the Dracula style definition to make it easier to maintain (#​2575)

v2.16.1

Compare Source

(released August 6th, 2023)

  • Fix native style missing from style list (#​2484)

v2.16.0

Compare Source

(released August 6th, 2023)

  • New lexers:

  • Updated lexers:

    • ASC: Add application/pem-certificate-chain mimetype (#​2471)
    • C/C++: Refine keyword lists (#​2421, #​2422)
    • Carbon: Fix long processing times on invalid input, fix number
      lexing (#​2454, #​2456)
    • Elpi: Handle quotations (#​2419)
    • Go: Support additional built-ins (#​2481)
    • HTTP: Support empty headers (#​2461), support more general methods (#​2460),
      also recognize responses in analyse_text implementation (#​2460), and
      highlight URL encoded data (#​2465, #​1620)
    • Igor Pro: Update to Igor Pro 9 (#​2482)
    • lean: Recognize expressions nested within attributes (#​1817)
    • Macaulay2: Update builtins (#​2457)
    • Markdown: Allow extra characters after language name
      in code blocks (#​2437)
    • NestedText: Update to version 3 (#​2459)
    • scdoc: Improve language guessing implementation (#​2402)
    • Spice: Update to latest version (#​2476)
    • Transact SQL: Add Pre-sorted Group keyword (#​2417)
    • Uxntal: Update for current runes (#​2424)
    • Wikitext: Fix templates in wiki links; fix a language converter false
      positive; add bold italic markup (#​2447)

  • Add Generic.EmphStrong token for bold italic markup (#​2444)

  • Add Lightbulb style (#​2474)

  • Improve contrast in Monokai style (#​2448)

  • Add documentation how to create terminal code highlighting commands (#​2131, #​2425)

  • Add support for loading TrueType fonts to the ImageFormatter (#​1960)

v2.15.1

Compare Source

(released April 18th, 2023)

  • Updated lexers:

  • Fix Python console traceback lexing being too strict
    and sometimes reordering output (#​2407, #​2410, #​2412)

v2.15.0

Compare Source

(released April 10th, 2023)

  • Added lexers:

  • Updated lexers:

    • AMDGPU: Add support for scratch_ instructions, the attr*.* argument,
      as well as the off modifier (#​2327).

    • APDL: Miscellaneous improvements (#​2314)

    • bash/tcsh:

    • Chapel: Support attributes (#​2376)

    • CMake: Implement bracket style comments (#​2338, #​2354)

    • CSS: Improve lexing of numbers inside function calls (#​2382, #​2383)

    • diff: Support normal diff syntax, as opposed to unified diff syntax (#​2321)

    • GLSL, HLSL:

      • Support line continuations in preprocessor code (#​2350)
      • Improve preprocessor directive handling (#​2357)

    • LilyPond: minor update of builtins

    • PHP: support attributes (#​2055, #​2347, #​2360), fix anonymous classes without
      parameters (#​2359), improve lexing of variable variable syntax (#​2358)

    • Python:

    • Rebol/Red: Don't require script headers (#​2348, #​2349)

    • Spice: Update keywords (#​2336)

    • SQL+Jinja (analyse_text method): Fix catastrophic backtracking (#​2355)

    • Terraform: Add hcl alias (#​2375)

  • Declare support for Python 3.11 and drop support for Python 3.6 (#​2324).

  • Update native style to improve contrast (#​2325).

  • Update `github-dark`` style to match latest Primer style (#​2401)

  • Revert a change that made guessing lexers based on file names slower
    on Python 3.10 and older (#​2328).

  • Fix some places where a locale-dependent encoding could unintentionally
    be used instead of UTF-8 (#​2326).

  • Fix Python traceback handling (#​2226, #​2329).

  • Groff formatter: sort color definitions for reproducibility (#​2343)

  • Move project metadata to pyproject.toml, remove setup.py
    and setup.cfg (#​2342)

  • The top-level Makefile has been removed. Instead, all shortcuts
    for developing are now defined and run through tox. The doc folder
    still contains a Makefile as an alternative to tox -e doc.

v2.14.0

Compare Source

(released January 1st, 2023)

  • Added lexers:

  • Updated lexers:

    • Abap: Update keywords (#​2281)

    • Alloy: Update for Alloy 6 (#​1963)

    • C family (C, C++ and many others):

      • Fix an issue where a chunk would be wrongly recognized as a function
        definition due to braces in comments (#​2210)
      • Improve parantheses handling for function definitions (#​2207, #​2208)

    • C#: Fix number and operator recognition (#​2256, #​2257)

    • CSound: Updated builtins (#​2268)

    • F#: Add .fsx file extension (#​2282)

    • gas (GNU assembler): recognize braces as punctuation (#​2230)

    • HTTP: Add CONNECT keyword (#​2242)

    • Inform 6: Fix lexing of properties and doubles (#​2214)

    • INI: Allow comments that are not their own line (#​2217, #​2161)

    • Java properties: Fix issue with whitespace-delimited keys, support
      comments starting with ! and escapes, no longer support undocumented
      ; and // comments (#​2241)

    • LilyPond: Improve heuristics, add \maxima duration (#​2283)

    • LLVM: Add opaque pointer type (#​2269)

    • Macaulay2: Update keywords (#​2305)

    • Minecraft-related lexers (SNB and Minecraft function) moved to
      pygments.lexers.minecraft (#​2276)

    • Nim: General improvements (#​1970)

    • Nix: Fix single quotes inside indented strings (#​2289)

    • Objective J: Fix catastrophic backtracking (#​2225)

    • NASM: Add support for SSE/AVX/AVX-512 registers as well as 'rel'
      and 'abs' address operators (#​2212)

    • Powershell:

    • Solidity: Add boolean operators (#​2292)

    • Spice: Add enum keyword and fix a bug regarding binary,
      hexadecimal and octal number tokens (#​2227)

    • YAML: Accept colons in key names (#​2277)

  • Fix make mapfiles when Pygments is not installed in editable mode
    (#​2223)

  • Support more filetypes and compression types in autopygmentize (#​2219)

  • Merge consecutive tokens in Autohotkey, Clay (#​2248)

  • Add .nasm as a recognized file type for NASM (#​2280)

  • Add *Spec.hs as a recognized file type for HSpec (#​2308)

  • Add *.pyi (for typing stub files) as a recognized file type for
    Python (#​2231)

  • The HTML lexer no longer emits empty spans for whitespace (#​2304)

  • Fix IRCFormatter inserting linenumbers incorrectly (#​2270)

v2.13.0

Compare Source

(released August 15th, 2022)

  • Added lexers:

  • Updated lexers:

    • Ada: support Ada 2022 (#​2121); disable recognition of namespaces
      because it disturbs lexing of aspects (#​2125)
    • Agda: allow straight quotes in module names (#​2163)
    • C family (C, C++ and many others): allow comments between
      elements of function headers, e.g. between the arguments and
      the opening brace for the body (#​1891)
    • C++: Resolve several cases of Error tokens (#​2207, #​2208)
    • Coq: Add some common keywords, improve recognition of Set
      and qualified identifiers (#​2158)
    • F*: Allow C-style comments anywhere in a line
    • Fortran: Fix catastrophic backtracking with backslashes in strings
      (#​2194)
    • Go: add support for generics (#​2167)
    • Inform: Update for version 6.40 (#​2190)
    • Isabelle: recognize cartouches (#​2089)
    • Java: support multiline strings aka. text blocks (#​2132)
    • Kotlin: Add value modifier (#​2142)
    • LilyPond: Add some missing builtins
    • Macaulay2: Update builtins (#​2139)
    • Matlab session: fix traceback when a line continuation ellipsis
      appears in the output (#​2166)
    • .NET: Add aliases for LibreOffice Basic, OpenOfficeBasic and
      StarOffice Basic (#​2170)
    • Nim: Use Name.Builtin instead of Keyword.Type (#​2136)
    • PHP: fix \"$var\" inside strings (#​2105)
    • Python: only recognize \N, \u and \U escape sequences
      in string literals, but not in bytes literals where they are
      not supported (#​2204)
    • Tcl: support ${name} variables (#​2145)
    • Terraform: Accept leading whitespace for << heredoc
      delimiters (#​2162)
    • Teraterm: Various improvements (#​2165)
    • Spice: add support for the recently added features including more
      builtin functions and bin, oct, hex number formats (#​2206)

  • Added styles:

  • Pygments now tries to use the importlib.metadata module to
    discover plugins instead of the slower pkg_resources (#​2155). In
    particular, this largely speeds up the pygmentize script when
    the lexer is not specified.

    importlib.metadata is only available in the Python standard
    library since Python 3.8. For older versions, there exists an
    importlib_metadata backport on PyPI. For this reason, Pygments
    now defines a packaging extra plugins, which adds a requirement
    on importlib_metadata if the Python version is older than
    3.8. Thus, in order to install Pygments with optimal plugin
    support even for old Python versions, you should do::

    pip install pygments[plugins]

    Pygments still falls back on pkg_resources if neither
    importlib.metadata nor importlib_metadata is found, but it
    will be slower.

  • Silently ignore BrokenPipeError in the command-line interface
    (#​2193).

  • The HtmlFormatter now uses the linespans attribute for
    anchorlinenos if the lineanchors attribute is unset (#​2026).

  • The highlight, lex and format functions no longer
    wrongly report "argument must be a lexer/formatter instance, not a
    class" in some cases where this is not the actual problem (#​2123).

  • Fix warnings in doc build (#​2124).

  • The codetagify filter now recognizes FIXME tags by default (#​2150).

  • The pygmentize command now recognizes if the COLORTERM
    environment variable is set to a value indicating that true-color
    support is available. In that case, it uses the TerminalTrueColorFormatter
    by default (#​2160)

  • Remove redundant caches for filename patterns (#​2153)

  • Use new non-deprecated Pillow API for text bounding box in ImageFormatter
    (#​2198)

  • Remove default_style (#​930, #​2183)

  • Stop treating DeprecationWarnings as errors in the unit tests (#​2196)

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Moscow, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Copy Markdown
Contributor Author

renovate bot commented Mar 26, 2026

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

  • Branch has one or more failed status checks

@auto-assign auto-assign bot requested a review from AlexRogalskiy March 26, 2026 21:22
@github-actions github-actions bot added the docs label Mar 26, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 26, 2026 •
edited
Loading

@check-spelling-bot Report

Unrecognized words, please review:

  • adr
  • akka
  • alexrogalskiy
  • allcontributors
  • api
  • arcver
  • assing
  • badgen
  • BETTERCODE
  • betterjavacode
  • blogspot
  • boopickle
  • bootcamp
  • brightgreen
  • bugfixes
  • buymeacoffee
  • ceb
  • codeready
  • codesandbox
  • codetriage
  • committers
  • configmaps
  • debezium
  • demystified
  • dependabot
  • devcases
  • devfile
  • dirtyreload
  • DOI
  • dreamix
  • dropdown
  • eab
  • eap
  • eisele
  • embeddableinstantiator
  • embeddables
  • facebook
  • fastai
  • fastpages
  • fastparse
  • firsttimersonly
  • flushmode
  • forthebadge
  • frapsoft
  • freemarker
  • FRP
  • fthomas
  • gerrit
  • getquill
  • GIFs
  • gitbook
  • gitflow
  • githubbox
  • gitpod
  • GPLv
  • Gradle
  • grunwald
  • guideslines
  • gunnar
  • Hashids
  • Hasids
  • helloworld
  • hitsofcode
  • hmil
  • infoworld
  • insidejava
  • Instantiator
  • IPhone
  • istio
  • janssen
  • japgolly
  • javacodegeeks
  • javafx
  • javamelody
  • javaone
  • JAVAPROG
  • jboss
  • jcliff
  • jdbc
  • jdk
  • jextract
  • jfr
  • jfrunit
  • johan
  • jpa
  • JRE
  • jsonignore
  • jsp
  • jsparty
  • julienrf
  • Jupyter
  • kubernetes
  • latestdoi
  • LETSTALK
  • letstalkaboutjava
  • LGPL
  • LGPLv
  • lihaoyi
  • liskov
  • logfile
  • mades
  • makeapullrequest
  • markdownguide
  • markus
  • matryoshka
  • mcve
  • mega
  • microservices
  • milessabin
  • mirrorring
  • mkdocs
  • modelviewculture
  • monix
  • mtl
  • mutationquery
  • namespaces
  • nestjs
  • Netflix
  • newreleases
  • nullables
  • nvie
  • objectmappers
  • odl
  • openapi
  • opengraph
  • opentelemetry
  • osslifecycle
  • oyanglul
  • pagespeedresultmobile
  • pasteable
  • patreon
  • paypal
  • PITMP
  • plumbr
  • podcast
  • precog
  • pufler
  • pypa
  • quarkus
  • quicklens
  • RANDOMTHOUGHTS
  • randomthoughtsonjavaprogramming
  • rce
  • reactify
  • readthedocs
  • reddit
  • renovatebot
  • reporoster
  • repostatus
  • resteasy
  • rfm
  • Rogalskiy
  • rogalsky
  • rubyonrails
  • runtimes
  • scalacss
  • scalafiddle
  • scalafmt
  • scalajs
  • scalameta
  • scalanlp
  • scalastyle
  • scalaz
  • scm
  • seeyoufarm
  • selectionquery
  • softwaremill
  • sourcegraph
  • spamming
  • splunk
  • sql
  • squants
  • squbs
  • sscce
  • stakeholders
  • starchart
  • sttp
  • stylegu
  • suggestig
  • suzaku
  • thejavaprogrammer
  • thorben
  • tilda
  • tokei
  • trufoj
  • tsb
  • tsbleo
  • tscojc
  • tscqlg
  • tsd
  • tsdllr
  • typelevel
  • udash
  • upickle
  • urt
  • ussue
  • violoate
  • vos
  • wget
  • wildfly
  • wix
  • workspaces
  • zenodo
  • zgc
  • zio
Previously acknowledged words that are now absent acl activesupport adaoraul addons aeiou AFile afterall Alexey alfredxing algolia allowfullscreen Anatoliy andreyvit Ankit Anning apps appveyor arengu args ariejan arounds asciinema asdf ashmaroli attr Autobuild autocompletion autogenerated Autolink autoload autoreconf autosave awood awscli backport backtick barcamp baseurl bashrc baz bbatsov bdimcheff bellvat benbalter Beney binstubs bip bitbucket Blogger blogging bonafide Bou breadcrumbs briandoll bridgetown bridgetownrb brightbox brighterplanet buddyworks Bugfix Burela byparker cachegrind calavera callgraphs cartera cavalle CDNs cgi changefreq chango charset Chayoung chcp chdir Cheatsheet Checkoway chmod chown Chrononaut chruby cibuild cimg circleci CJK classname cloudcannon Cloudinary cloudsh CLT CODEOWNERS coderay codeslinger coffeescript colorator commandline commonmark compat compatibilize concat configyml contentblocks CORS Cov CRLFs cron crontab cruft css csv Currin CVE CWD cygwin daringfireball Dassonville datafiles datetime DCEU Debian debuggability defunkt delegators deployer deps dest Devkit devops digitalocean dirs disqus ditaa dnf doclist doctype doeorg dommmel dotfile Dousse downcase downcased duckduckgo duritong Dusseau dysinger ecf editorconfig eduardoboucas Elasticsearch elsif Emacs emails endcapture endcomment endfor endhighlight endif endraw endrender endtablerow Enumerables EOL erb errordocument Espinaco eugenebolshakov evaled exe execjs extensionpack extname exts favicon Fengyun ffi figcaption filesystem Finazzo firstimage FIXME flakey flickr fnmatch fontello forloop formcake formcarry formester formingo formkeep formspark formspree formx Forwardable frameborder freenode frontend frontmatter fsnotify ftp fullstory Gaudino gcc gcnovus gemfile gemset gemspec getform getset getsimpleform gettalong gfm ghp ghpages giraffeacademy githubcom gitignore gitlab gjtorikian globbed globbing google gotcha Goulven gridism GSo gsub gsubbing Hakiri hardcode hashbang hashmap helaili henrik heredoc heroku highlighter hilighting Hoizey hostman hostname htaccess htm htmlproofer httpd httpdocs hyperlinks Iaa ial ico icomoon iconset ified iframe Impl Inlining invokables irc ivey ize jalali jameshamann jamstackthemes jan Jax jayferd jcon jdoe jeffreytse jeffrydegrande Jekpack jekyllbot jekyllconf Jekyllers Jekyllin Jekylling jekyllized jekylllayoutconcept jekyllrb jekyllthemes jemoji jmcglone jneen johnreilly jpg jqr jruby jsonify juretta jwarby Kacper Kasberg kbd Kentico Kewin keycdn kickster Kinnula kiwifruit Kolesky konklone kontent Kotvinsky kramdown Kulig Kwokfu Lamprecht laquo lastmod launchctl launchy laurilehmijoki ldquo learnxinyminutes lexer LGTM libcurl libffi lightgray limjh linenos linkify linux liufengyun livereload localheinz localtime Locher loglevel Losslessly lovin lsi lsquo lstrip lyche macos macromates mademistakes Manmeet markdownify Maroli Marsceill maruku mathjax mathml mattr Maximiliano mchung mdash memberspace Memoize memoized memoizing mentoring mergable Mertcan mertkahyaoglu microdata mimetype mingw minibundle minifier minitest Mittal mixin mkasberg mkd mkdir mkdn mkdown mmistakes modernizr mojombo moncefbelyamani moz mreid msdn mswin MSYS mtime multiline munging Mvvm myblog mycontent mydata mydoc myimage mypage myposts myproject myrepo mysite myvalue myvar myvariable Nadjib nakanishi namespace namespaced navbar nbsp nearlyfreespeech nethack netlify netlifycms Neue nginx ngx nielsenramon nior noifniof nokogiri notextile onclick onebox oneclick onschedule openssl Optim orderofinterpretation orgs OSVDB osx packagecontrol pacman paginator pandoc pantulis params parkr parseable paspagon passthrough pathawks Pathutil paywall pdf Pelykh permalink PHP pinboard Piwigo pjhyett pkill pkpass placeholders planetjekyll plantuml plugin podcasts popen Porcel Posterous postfiles postlayout postmodern prefetching preinstalled prepends Prioritise Probot projectlist pubstorm pufuwozu pwa pwd pygments qrush Quaid rackup Rakefile razorops rbenv rdiscount rdoc rdquo realz rebund redcarpet redcloth redgreen refactor Refheap regen regex regexp remi reqs Responsify revertable rfc rfelix RHEL ridk roadmap rowspan rspec rsquo rstrip rsync rtomayko Rubo rubocop rubychan rubygem rubyinstaller rubyprof Ruparelia Rusiczki rvm ryanflorence saas samplelist samrayner sandboxed Sassc sassify schemastore Schroers Schwartzian scp scrollbar scroller scss scssify sdk SDKROOT sectore seo serverless setenv SFTP shingo shopify shortlog shoulda sieversii sigpipe simplecov Singhaniya siteleaf sitemap SITENAME Slicehost slugified slugify smartforms smartify snipcart somedir sonnym Sonomy sourced sourcemaps spam spotify ssg ssh SSL staticfiles staticman statictastic STDERR stdout Stickyposts strftime stringified Stringify stylesheet subdir subdomain subfolder subfolderitems subnav subpages subpath subpiece subsubfolderitems subthing subvalues subwidget sudo superdirectories superdirs SUSE sverrirs svn swfobject swupd symlink symlinking tablerow tada Taillandier talkyard tbody technicalpickles templating templatize Termux textilize textpattern thead therubyracer Theunissen Thornquest thoughtbot throughs Tidelift timeago timezone titleize TLS tmm tmp toc tok tomjoht toml tomo toolset toshimaru triaged triaging truncatewords tsv ttf Tudou Tumblr Tweetsert txtpen Tyborska tzinfo ubuntu uby ujh ultron undumpable unencode Unescape unescaping unicode uniq upcase uppercasing uri urlset username usr utf utils utime vanpelt Vasovi vendored vercel versioned vertycal Veyor vilcans Vishesh visualstudio vnd vohedge vps vscode vwochnik Walkthroughs wdm We'd webfont webhook webhosting webmentions webrick weekdate whitelist whitelisting wikipedia wildcards willcodeforfoo woff wordpress Workaround wsl xcode xcrun xdg Xhmikos xhtml Xiaoiver XMinutes xmlns xmlschema yajl Yarp Yashu Yastreb Youku youtube yunbox zeropadding Zlatan zlib zoneinfo zpinter Zsh zshrc zypper zzot
To accept these unrecognized words as correct (and remove the previously acknowledged and now absent words), run the following commands

... in a clone of the git@github.com:AlexRogalskiy/java-patterns.git repository
on the renovate/pypi-pygments-vulnerability branch:

update_files() {
perl -e '
my @expect_files=qw('".github/actions/spelling/expect.txt"');
@ARGV=@expect_files;
my @stale=qw('"$patch_remove"');
my $re=join "|", @stale;
my $suffix=".".time();
my $previous="";
sub maybe_unlink { unlink($_[0]) if $_[0]; }
while (<>) {
if ($ARGV ne $old_argv) { maybe_unlink($previous); $previous="$ARGV$suffix"; rename($ARGV, $previous); open(ARGV_OUT, ">$ARGV"); select(ARGV_OUT); $old_argv = $ARGV; }
next if /^(?:$re)(?:(?:\r|\n)*$| .*)/; print;
}; maybe_unlink($previous);'
perl -e '
my $new_expect_file=".github/actions/spelling/expect.txt";
use File::Path qw(make_path);
use File::Basename qw(dirname);
make_path (dirname($new_expect_file));
open FILE, q{<}, $new_expect_file; chomp(my @words = <FILE>); close FILE;
my @add=qw('"$patch_add"');
my %items; @items{@words} = @words x (1); @items{@add} = @add x (1);
@words = sort {lc($a)."-".$a cmp lc($b)."-".$b} keys %items;
open FILE, q{>}, $new_expect_file; for my $word (@words) { print FILE "$word\n" if $word =~ /\w/; };
close FILE;
system("git", "add", $new_expect_file);
'
}

comment_json=$(mktemp)
curl -L -s -S \
  --header "Content-Type: application/json" \
  "https://api.github.com/repos/AlexRogalskiy/java-patterns/issues/comments/4138335037" > "$comment_json"
comment_body=$(mktemp)
jq -r .body < "$comment_json" > $comment_body
rm $comment_json

patch_remove=$(perl -ne 'next unless s{^</summary>(.*)</details>$}{$1}; print' < "$comment_body")
  

patch_add=$(perl -e '$/=undef;
$_=<>;
s{<details>.*}{}s;
s{^#.*}{};
s{\n##.*}{};
s{(?:^|\n)\s*\*}{}g;
s{\s+}{ }g;
print' < "$comment_body")
  
update_files
rm $comment_body
git add -u
If you see a bunch of garbage

If it relates to a ...

well-formed pattern

See if there's a pattern that would match it.

If not, try writing one and adding it to the patterns.txt file.

Patterns are Perl 5 Regular Expressions - you can test yours before committing to verify it will match your lines.

Note that patterns can't match multiline strings.

binary-ish string

Please add a file path to the excludes.txt file instead of just accepting the garbage.

File paths are Perl 5 Regular Expressions - you can test yours before committing to verify it will match your files.

^ refers to the file's path from the root of the repository, so ^README\.md$ would exclude README.md (on whichever branch you're using).

@renovate renovate bot changed the title ⬆️ Updates Pygments to v2.15.0 [SECURITY] ⬆️ Updates Pygments to v2.15.0 [SECURITY] - autoclosed Mar 27, 2026
@renovate renovate bot closed this Mar 27, 2026
@renovate renovate bot deleted the renovate/pypi-pygments-vulnerability branch March 27, 2026 01:59
@github-actions github-actions bot locked and limited conversation to collaborators Mar 27, 2026
@renovate renovate bot changed the title ⬆️ Updates Pygments to v2.15.0 [SECURITY] - autoclosed ⬆️ Updates Pygments to v2.20.0 [SECURITY] Mar 30, 2026
@renovate renovate bot reopened this Mar 30, 2026
@renovate renovate bot force-pushed the renovate/pypi-pygments-vulnerability branch 2 times, most recently from aae6063 to 5d7e2ac Compare March 30, 2026 17:28
@renovate
⬆️ Updates Pygments to v2.20.0 [SECURITY]
3d2b61c 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate bot force-pushed the renovate/pypi-pygments-vulnerability branch from 5d7e2ac to 3d2b61c Compare April 6, 2026 01:14
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@AlexRogalskiy AlexRogalskiy Awaiting requested review from AlexRogalskiy

Assignees

No one assigned

Labels

docs javascript dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants