Skip to content

chore(deps): update dependency pygments to v2.20.0 [security]#16

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/pypi-pygments-vulnerability
Open

chore(deps): update dependency pygments to v2.20.0 [security]#16
renovate[bot] wants to merge 1 commit intomainfrom
renovate/pypi-pygments-vulnerability

Conversation

@renovate
Copy link
Copy Markdown

@renovate renovate bot commented Mar 31, 2026

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
pygments (changelog) ==2.16.1 → ==2.20.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2026-4539

A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Release Notes

pygments/pygments (pygments)

v2.20.0

Compare Source

(released March 29th, 2026)

v2.19.2

Compare Source

(released June 21st, 2025)

v2.19.1

Compare Source

(released January 6th, 2025)

  • Updated lexers:

    • Ini: Fix quoted string regression introduced in 2.19.0
    • Lua: Fix a regression introduced in 2.19.0

v2.19.0

Compare Source

(released January 5th, 2025)

  • Mark file extensions for HTML/XML+Evoque as aliases (#​2743)
  • Add a color for Operator.Word to the rrt style (#​2709)
  • Fix broken link in the documentation (#​2803, #​2804)
  • Drop executable bit where not needed (#​2781)
  • Reduce Mojo priority relative to Python in analyze_text (#​2771, #​2772)
  • Fix documentation builds (#​2712)
  • Match example file names to the lexer's name (#​2713, #​2715)
  • Ensure lexer metadata is present (#​2714)
  • Search more directories on macOS for fonts (#​2809)
  • Improve test robustness (#​2812)

v2.18.0

Compare Source

(released May 4th, 2024)

  • New lexers:

  • Updated lexers:

    • Awk: recognize ternary operator (#​2687)
    • Bash: add openrc alias (#​2599, #​2371)
    • Coq: add keywords, lex more vernacular command arguments, produce
      fewer tokens on heading comments (#​2678)
    • DNS zone files: Fix comment parsing (#​2595)
    • Hy: Support unicode literals (#​1126)
    • Inform6: Update to Inform 6.42 (#​2644)
    • lean: Fix name handling (#​2614)
    • Logtalk: add uninstantiation keyword and recognize
      escape sequences (#​2619)
    • Macaulay2: Update to 1.23 (#​2655)
    • Python: fix highlighting of soft keywords before None/True/False
    • reStructuredText: use Token.Comment for comments instead of
      Comment.Preproc (#​2598)
    • Rust: highlight :, :: and -> as Punctuation
      and whitespace as Whitespace, instead of Text
      in both cases (#​2631)
    • Spice: Add keywords (#​2621)
    • SQL Explain: allow negative numbers (#​2610)
    • Swift: Support multiline strings (#​2681)
    • ThingsDB: add constants and new functions; support template
      strings (#​2624)
    • UL4: support nested <?doc?> and <?note?> tags (#​2597)
    • VHDL: support multi-line comments of VHDL-2008 (#​2622)
    • Wikitext: Remove kk-* in variant_langs (#​2647)
    • Xtend: Add val and var (#​2602)

  • New styles:

  • Make background colors in the image formatter work with Pillow 10.0 (#​2623)

  • Require Python 3.8. As a result, the importlib-metadata package
    is no longer needed for fast plugin discovery on Python 3.7.
    The plugins extra (used as, e.g., pip install pygments[plugins])
    is kept for backwards compatibility but now has no effect. (#​2601)

  • Require the url attribute for lexers inside Pygments, add
    it to many lexers (#​2588)

  • Replace Pyflakes linter with Ruff (#​2592)

  • Add macOS CI (#​2594)

  • Built-in lexers now declare the version of Pygments in which they were
    added in a required version_added lexer attribute, instead of a
    .. versionadded:: directive in the docstring (#​2589, #​2634)

  • The url attribute is now required for built-in lexers and
    has been added to all existing lexers (#​2588)

  • The RTF formatter supports line number and line highlighting now (#​1217, #​2654)

  • Add \sa0 keyword in the RTF formatter (#​1111, #​2607)

  • Register pycon as an alias for the Python console lexer (#​2697)

  • Add MIME-Type for DesktopLexer (#​2613)

  • Fix native style to meet WCAG AA guidelines (#​2600)

  • Fix typo in documentation (#​2672)

  • Use format strings consistently (#​2661)

  • Add __class_getitem__ to Formatter to improve typing support (#​2665)

v2.17.2

Compare Source

(released November 21, 2023)

  • Fix a packaging issue on macOS (#​2593)

v2.17.1

Compare Source

(released November 19, 2023)

  • Updated lexers:

    • TOML: Fix bug making lexing of single-quoted strings too eager

v2.17.0

Compare Source

(released November 18, 2023)

  • New lexers:

  • Updated lexers:

    • Cypher: fix comment matching, add missing keywords (#​2504)
    • Fortran: add elseif keyword (#​2528)
    • Lean: make it available as lean3, in preparation for
      a possible switch to lean highlighting as Lean 4 (#​2546)
    • JSON: add MIME types and file extensions for several line-delimited
      JSON formats (#​2490)
    • Nix: many improvements (#​2551, #​1800)
    • OCaml: Add and keyword, remove value from keywords (#​2521)
    • Python: add starlark and bazel aliases (#​2517, #​2516)
    • Snowball: Treat len like size (#​2508)
    • Spice: add panic keyword and -> operator (#​2510)
    • squid.conf: fix catastrophic backtracking (#​2583)
    • TOML: rewritten, with many fixes (#​2576)
    • Turtle: support blank nodes (#​2581)
    • Wikitext: fix erroneous highlighting of LanguageConverter markup
      (#​2493), add missing variant languages (#​2494)
    • CMake: support [=[ bracketed arguments ]=] (#​2549)

  • Fix ctags support and tests (#​2487)

  • Include Lexer.add_filter in the documentation (#​2519)

  • Add a Lean3Lexer alias (#​2546)

  • The pygments.styles module contains a new STYLES variable
    with a dictionary of built-in styles. The old STYLE_MAP variable,
    which uses a different format, is kept for backwards compatibility.

  • On Windows, add a new installation extra (windows-terminal) which pulls in
    dependencies for colored console output. See :doc:cmdline for more details.
    (#​2505)

  • Support more file types in autopygmentize script (#​2513)

  • Change color of numbers in rrt style (#​2526)

  • Fix error when trying to look up plugin formatters by file extension
    of the output format (#​2563)

  • Use Hatchling as a build backend instead of setuptools.
    This change is transparent to most users. Distribution packagers
    who build without build isolation need to add hatchling as a build
    dependency and remove setuptools. People downloading source distributions
    and wheels from PyPI directly should note that they now have pygments
    in their file names instead of Pygments. (#​2573)

  • Improve the test framework to also check for lost tokens when processing the
    snippets and example files (#​2582.)

  • Improve the Dracula style definition to make it easier to maintain (#​2575)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants