Skip to content

Update dependency pygments to v2.20.0 [SECURITY]#68

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/pypi-pygments-vulnerability
Open

Update dependency pygments to v2.20.0 [SECURITY]#68
renovate[bot] wants to merge 1 commit intomainfrom
renovate/pypi-pygments-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Apr 15, 2026

This PR contains the following updates:

Package Change Age Confidence
pygments (changelog) ==2.14.0 → ==2.20.0 age confidence

GitHub Vulnerability Alerts

CVE-2022-40896

A ReDoS issue was discovered in pygments/lexers/smithy.py in Pygments until 2.15.0 via SmithyLexer.

Severity
  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVE-2026-4539

A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Severity
  • CVSS Score: 1.9 / 10 (Low)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Release Notes

pygments/pygments (pygments)

v2.20.0

Compare Source

(released March 29th, 2026)

v2.19.2

Compare Source

(released June 21st, 2025)

v2.19.1

Compare Source

(released January 6th, 2025)

  • Updated lexers:

    • Ini: Fix quoted string regression introduced in 2.19.0
    • Lua: Fix a regression introduced in 2.19.0

v2.19.0

Compare Source

(released January 5th, 2025)

  • Mark file extensions for HTML/XML+Evoque as aliases (#​2743)
  • Add a color for Operator.Word to the rrt style (#​2709)
  • Fix broken link in the documentation (#​2803, #​2804)
  • Drop executable bit where not needed (#​2781)
  • Reduce Mojo priority relative to Python in analyze_text (#​2771, #​2772)
  • Fix documentation builds (#​2712)
  • Match example file names to the lexer's name (#​2713, #​2715)
  • Ensure lexer metadata is present (#​2714)
  • Search more directories on macOS for fonts (#​2809)
  • Improve test robustness (#​2812)

v2.18.0

Compare Source

(released May 4th, 2024)

  • New lexers:

  • Updated lexers:

    • Awk: recognize ternary operator (#​2687)
    • Bash: add openrc alias (#​2599, #​2371)
    • Coq: add keywords, lex more vernacular command arguments, produce
      fewer tokens on heading comments (#​2678)
    • DNS zone files: Fix comment parsing (#​2595)
    • Hy: Support unicode literals (#​1126)
    • Inform6: Update to Inform 6.42 (#​2644)
    • lean: Fix name handling (#​2614)
    • Logtalk: add uninstantiation keyword and recognize
      escape sequences (#​2619)
    • Macaulay2: Update to 1.23 (#​2655)
    • Python: fix highlighting of soft keywords before None/True/False
    • reStructuredText: use Token.Comment for comments instead of
      Comment.Preproc (#​2598)
    • Rust: highlight :, :: and -> as Punctuation
      and whitespace as Whitespace, instead of Text
      in both cases (#​2631)
    • Spice: Add keywords (#​2621)
    • SQL Explain: allow negative numbers (#​2610)
    • Swift: Support multiline strings (#​2681)
    • ThingsDB: add constants and new functions; support template
      strings (#​2624)
    • UL4: support nested <?doc?> and <?note?> tags (#​2597)
    • VHDL: support multi-line comments of VHDL-2008 (#​2622)
    • Wikitext: Remove kk-* in variant_langs (#​2647)
    • Xtend: Add val and var (#​2602)

  • New styles:

  • Make background colors in the image formatter work with Pillow 10.0 (#​2623)

  • Require Python 3.8. As a result, the importlib-metadata package
    is no longer needed for fast plugin discovery on Python 3.7.
    The plugins extra (used as, e.g., pip install pygments[plugins])
    is kept for backwards compatibility but now has no effect. (#​2601)

  • Require the url attribute for lexers inside Pygments, add
    it to many lexers (#​2588)

  • Replace Pyflakes linter with Ruff (#​2592)

  • Add macOS CI (#​2594)

  • Built-in lexers now declare the version of Pygments in which they were
    added in a required version_added lexer attribute, instead of a
    .. versionadded:: directive in the docstring (#​2589, #​2634)

  • The url attribute is now required for built-in lexers and
    has been added to all existing lexers (#​2588)

  • The RTF formatter supports line number and line highlighting now (#​1217, #​2654)

  • Add \sa0 keyword in the RTF formatter (#​1111, #​2607)

  • Register pycon as an alias for the Python console lexer (#​2697)

  • Add MIME-Type for DesktopLexer (#​2613)

  • Fix native style to meet WCAG AA guidelines (#​2600)

  • Fix typo in documentation (#​2672)

  • Use format strings consistently (#​2661)

  • Add __class_getitem__ to Formatter to improve typing support (#​2665)

v2.17.2

Compare Source

(released November 21, 2023)

  • Fix a packaging issue on macOS (#​2593)

v2.17.1

Compare Source

(released November 19, 2023)

  • Updated lexers:

    • TOML: Fix bug making lexing of single-quoted strings too eager

v2.17.0

Compare Source

(released November 18, 2023)

  • New lexers:

  • Updated lexers:

    • Cypher: fix comment matching, add missing keywords (#​2504)
    • Fortran: add elseif keyword (#​2528)
    • Lean: make it available as lean3, in preparation for
      a possible switch to lean highlighting as Lean 4 (#​2546)
    • JSON: add MIME types and file extensions for several line-delimited
      JSON formats (#​2490)
    • Nix: many improvements (#​2551, #​1800)
    • OCaml: Add and keyword, remove value from keywords (#​2521)
    • Python: add starlark and bazel aliases (#​2517, #​2516)
    • Snowball: Treat len like size (#​2508)
    • Spice: add panic keyword and -> operator (#​2510)
    • squid.conf: fix catastrophic backtracking (#​2583)
    • TOML: rewritten, with many fixes (#​2576)
    • Turtle: support blank nodes (#​2581)
    • Wikitext: fix erroneous highlighting of LanguageConverter markup
      (#​2493), add missing variant languages (#​2494)
    • CMake: support [=[ bracketed arguments ]=] (#​2549)

  • Fix ctags support and tests (#​2487)

  • Include Lexer.add_filter in the documentation (#​2519)

  • Add a Lean3Lexer alias (#​2546)

  • The pygments.styles module contains a new STYLES variable
    with a dictionary of built-in styles. The old STYLE_MAP variable,
    which uses a different format, is kept for backwards compatibility.

  • On Windows, add a new installation extra (windows-terminal) which pulls in
    dependencies for colored console output. See :doc:cmdline for more details.
    (#​2505)

  • Support more file types in autopygmentize script (#​2513)

  • Change color of numbers in rrt style (#​2526)

  • Fix error when trying to look up plugin formatters by file extension
    of the output format (#​2563)

  • Use Hatchling as a build backend instead of setuptools.
    This change is transparent to most users. Distribution packagers
    who build without build isolation need to add hatchling as a build
    dependency and remove setuptools. People downloading source distributions
    and wheels from PyPI directly should note that they now have pygments
    in their file names instead of Pygments. (#​2573)

  • Improve the test framework to also check for lost tokens when processing the
    snippets and example files (#​2582.)

  • Improve the Dracula style definition to make it easier to maintain (#​2575)

v2.16.1

Compare Source

(released August 6th, 2023)

  • Fix native style missing from style list (#​2484)

v2.16.0

Compare Source

(released August 6th, 2023)

  • New lexers:

  • Updated lexers:

    • ASC: Add application/pem-certificate-chain mimetype (#​2471)
    • C/C++: Refine keyword lists (#​2421, #​2422)
    • Carbon: Fix long processing times on invalid input, fix number
      lexing (#​2454, #​2456)
    • Elpi: Handle quotations (#​2419)
    • Go: Support additional built-ins (#​2481)
    • HTTP: Support empty headers (#​2461), support more general methods (#​2460),
      also recognize responses in analyse_text implementation (#​2460), and
      highlight URL encoded data (#​2465, #​1620)
    • Igor Pro: Update to Igor Pro 9 (#​2482)
    • lean: Recognize expressions nested within attributes (#​1817)
    • Macaulay2: Update builtins (#​2457)
    • Markdown: Allow extra characters after language name
      in code blocks (#​2437)
    • NestedText: Update to version 3 (#​2459)
    • scdoc: Improve language guessing implementation (#​2402)
    • Spice: Update to latest version (#​2476)
    • Transact SQL: Add Pre-sorted Group keyword (#​2417)
    • Uxntal: Update for current runes (#​2424)
    • Wikitext: Fix templates in wiki links; fix a language converter false
      positive; add bold italic markup (#​2447)

  • Add Generic.EmphStrong token for bold italic markup (#​2444)

  • Add Lightbulb style (#​2474)

  • Improve contrast in Monokai style (#​2448)

  • Add documentation how to create terminal code highlighting commands (#​2131, #​2425)

  • Add support for loading TrueType fonts to the ImageFormatter (#​1960)

v2.15.1

Compare Source

(released April 18th, 2023)

  • Updated lexers:

  • Fix Python console traceback lexing being too strict
    and sometimes reordering output (#​2407, #​2410, #​2412)

v2.15.0

Compare Source

(released April 10th, 2023)

  • Added lexers:

  • Updated lexers:

    • AMDGPU: Add support for scratch_ instructions, the attr*.* argument,
      as well as the off modifier (#​2327).

    • APDL: Miscellaneous improvements (#​2314)

    • bash/tcsh:

    • Chapel: Support attributes (#​2376)

    • CMake: Implement bracket style comments (#​2338, #​2354)

    • CSS: Improve lexing of numbers inside function calls (#​2382, #​2383)

    • diff: Support normal diff syntax, as opposed to unified diff syntax (#​2321)

    • GLSL, HLSL:

      • Support line continuations in preprocessor code (#​2350)
      • Improve preprocessor directive handling (#​2357)

    • LilyPond: minor update of builtins

    • PHP: support attributes (#​2055, #​2347, #​2360), fix anonymous classes without
      parameters (#​2359), improve lexing of variable variable syntax (#​2358)

    • Python:

    • Rebol/Red: Don't require script headers (#​2348, #​2349)

    • Spice: Update keywords (#​2336)

    • SQL+Jinja (analyse_text method): Fix catastrophic backtracking (#​2355)

    • Terraform: Add hcl alias (#​2375)

  • Declare support for Python 3.11 and drop support for Python 3.6 (#​2324).

  • Update native style to improve contrast (#​2325).

  • Update `github-dark`` style to match latest Primer style (#​2401)

  • Revert a change that made guessing lexers based on file names slower
    on Python 3.10 and older (#​2328).

  • Fix some places where a locale-dependent encoding could unintentionally
    be used instead of UTF-8 (#​2326).

  • Fix Python traceback handling (#​2226, #​2329).

  • Groff formatter: sort color definitions for reproducibility (#​2343)

  • Move project metadata to pyproject.toml, remove setup.py
    and setup.cfg (#​2342)

  • The top-level Makefile has been removed. Instead, all shortcuts
    for developing are now defined and run through tox. The doc folder
    still contains a Makefile as an alternative to tox -e doc.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants