Skip to content

Bump mako from 1.3.12 to 1.4.2 - #641

Merged
BigSpaceships merged 1 commit into
developfrom
dependabot/pip/mako-1.4.2
Oct 27, 2026
Merged

Bump mako from 1.3.12 to 1.4.2#641
BigSpaceships merged 1 commit into
developfrom
dependabot/pip/mako-1.4.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps mako from 1.3.12 to 1.4.2.

Release notes

Sourced from mako's releases.

1.4.2

Released: Tue Sep 22 2026

bug

  • [bug] [tests] Adjusted the test suite to accommodate for a change in Pygments 2.21.0 where the HtmlFormatter now renders " and ' characters literally rather than as HTML entities, which caused failures in tests that assert against the rendered output of html_error_template().

    References: #440

  • [bug] [template] Fixed issue in TemplateLookup where a URI beginning with a drive designator (e.g. C:/../../secret.txt) could bypass the directory traversal check on Windows, allowing reads of arbitrary files outside of the template directory. The check in Template normalized the URI using os.path, which on Windows is ntpath; as ntpath splits the drive designator off and treats the remainder as rooted, the .. segments were absorbed before the check could inspect them. Normalization is now performed with posixpath, which is the same module used by TemplateLookup.get_template() to resolve the URI to a file.

    References: #441

1.4.1

Released: Wed Aug 5 2026

bug

  • [bug] [installation] Fixed issue in the 1.4.0 packaging where the repository's internal tools/ directory was detected by setuptools package discovery and installed as a top-level tools package into site-packages, shadowing unrelated tools packages belonging to other applications. Package discovery is now limited to the mako package explicitly.

    References: #438

1.4.0

Released: Tue Aug 4 2026

changed

  • [changed] [examples] The examples/bench folder has been removed as it used mostly

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Oct 16, 2026
@dependabot
Bump mako from 1.3.12 to 1.4.2
f61615d 
Bumps [mako](https://github.com/sqlalchemy/mako) from 1.3.12 to 1.4.2.
- [Release notes](https://github.com/sqlalchemy/mako/releases)
- [Changelog](https://github.com/sqlalchemy/mako/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/mako/commits)

---
updated-dependencies:
- dependency-name: mako
  dependency-version: 1.4.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump mako from 1.3.12 to 1.4.2 Bump mako from 1.3.12 to 1.4.2 Oct 27, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/mako-1.4.2 branch from f606219 to f61615d Compare October 27, 2026 04:10
BigSpaceships
BigSpaceships approved these changes Oct 27, 2026
View reviewed changes

@BigSpaceships BigSpaceships left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seems sensible

@BigSpaceships
BigSpaceships merged commit 0f076c1 into develop Oct 27, 2026
4 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/mako-1.4.2 branch October 27, 2026 04:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@BigSpaceships BigSpaceships BigSpaceships approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@BigSpaceships