Bump pygments from 2.19.1 to 2.20.0 by dependabot[bot] · Pull Request #468 · togethercomputer/together-python

dependabot · 2026-10-08T04:31:43Z

Bumps pygments from 2.19.1 to 2.20.0.

Release notes

2.20.0

New lexers:

Rell (#2914)

Updated lexers:

archetype: Fix catastrophic backtracking in GUID and ID patterns (#3064)

ASN.1: Recognize minus sign and fix range operator (#3014, #3060)

C++: Add C++26 keywords (#2955), add integer literal suffixes (#2966)

ComponentPascal: Fix analyse_text (#3028, #3032)

Coq renamed to Rocq (#2883, #2908)

Cython: Various improvements (#2932, #2933)

Debian control: Improve architecture parsing (#3052)

Devicetree: Add support for overlay/fragments (#3021), add bytestring support (#3022), fix catastrophic backtracking (#3057)

Fennel: Various improvements (#2911)

Haskell: Handle escape sequences in character literals (#3069, #1795)

Java: Add module keywords (#2955)

Lean4: Add operators ]', ]?, ]! (#2946)

LESS: Support single-line comments (#3005)

LilyPond: Update to 2.25.29 (#2974)

LLVM: Support C-style comments (#3023, #2978)

Lua(u): Fix catastrophic backtracking (#3047)

Macaulay2: Update to 1.25.05 (#2893), 1.25.11 (#2988)

Mathematica: Various improvements (#2957)

meson: Add additional operators (#2919)

MySQL: Update keywords (#2970)

org-Mode: Support both schedule and deadline (#2899)

PHP: Add __PROPERTY__ magic constant (#2924), add reserved keywords (#3002)

PostgreSQL: Add more keywords (#2985)

protobuf: Fix namespace tokenization (#2929)

Python: Add t-string support (#2973, #3009, #3010)

Tablegen: Fix infinite loop (#2972, #2940)

Tera Term macro: Add commands introduced in v5.3 through v5.6 (#2951)

TOML: Support TOML 1.1.0 (#3026, #3027)

Turtle: Allow empty comment lines (#2980)

XML: Added .xbrl as file ending (#2890, #2891)

Drop Python 3.8, and add Python 3.14 as a supported version (#2987, #3012)

Various improvements to autopygmentize (#2894)

Update onedark style to support more token types (#2977)

Update rtt style to support more token types (#2895)

Cache entry points to improve performance (#2979)

Fix xterm-256 color table (#3043)

Fix kwargs dictionary getting mutated on each call (#3044)

2.19.2

Lua: Fix regression introduced in 2.19.0 (#2882, #2839)

Changelog

Sourced from pygments's changelog.

Version 2.20.0

(released March 29th, 2026)

New lexers:

Rell (#2914)

Updated lexers:

archetype: Fix catastrophic backtracking in GUID and ID patterns (#3064)

ASN.1: Recognize minus sign and fix range operator (#3014, #3060)

C++: Add C++26 keywords (#2955), add integer literal suffixes (#2966)

ComponentPascal: Fix analyse_text (#3028, #3032)

Coq renamed to Rocq (#2883, #2908)

Cython: Various improvements (#2932, #2933)

Debian control: Improve architecture parsing (#3052)

Devicetree: Add support for overlay/fragments (#3021), add bytestring support (#3022), fix catastrophic backtracking (#3057)

Fennel: Various improvements (#2911)

Haskell: Handle escape sequences in character literals (#3069, #1795)

Java: Add module keywords (#2955)

Lean4: Add operators ]', ]?, ]! (#2946)

LESS: Support single-line comments (#3005)

LilyPond: Update to 2.25.29 (#2974)

LLVM: Support C-style comments (#3023, #2978)

Lua(u): Fix catastrophic backtracking (#3047)

Macaulay2: Update to 1.25.05 (#2893), 1.25.11 (#2988)

Mathematica: Various improvements (#2957)

meson: Add additional operators (#2919)

MySQL: Update keywords (#2970)

org-Mode: Support both schedule and deadline (#2899)

PHP: Add __PROPERTY__ magic constant (#2924), add reserved keywords (#3002)

PostgreSQL: Add more keywords (#2985)

protobuf: Fix namespace tokenization (#2929)

Python: Add t-string support (#2973, #3009, #3010)

Tablegen: Fix infinite loop (#2972, #2940)

Tera Term macro: Add commands introduced in v5.3 through v5.6 (#2951)

TOML: Support TOML 1.1.0 (#3026, #3027)

Turtle: Allow empty comment lines (#2980)

XML: Added .xbrl as file ending (#2890, #2891)

Drop Python 3.8, and add Python 3.14 as a supported version (#2987, #3012)

Various improvements to autopygmentize (#2894)

Update onedark style to support more token types (#2977)

Update rtt style to support more token types (#2895)

Cache entry points to improve performance (#2979)

Fix xterm-256 color table (#3043)

Fix kwargs dictionary getting mutated on each call (#3044)

Version 2.19.2

... (truncated)

Commits

708197d Fix underline length.
1d4538a Prepare 2.20 release.
2ceaee4 Update CHANGES.
e3a3c54 Fix Haskell lexer: handle escape sequences in character literals (#3069)
d7c3453 Merge pull request #3071 from pygments/harden-html-formatter
0f97e7c Harden the HTML formatter against CSS.
9f981b2 Update CHANGES.
1d88915 Update CHANGES.
c3d93ad Fix ASN.1 lexer: recognize minus sign and fix range operator (#3060)
4f06bcf fix bad behaving backtracking regex in CommonLispLexer
Additional commits viewable in compare view

broly-code-security-scanner · 2026-10-08T04:32:19Z

Broly Security Scan

Warning

Latest baseline snapshot is stale. Broly is running in PR-only fallback mode until the next scheduled baseline refreshes. This does not block the PR.

Warning

Summary

13 actionable finding(s) in this PR

🔴 3 critical
🟠 5 high
🟡 5 medium

Main table: 13 shown, 0 omitted of 13 actionable finding(s) above the reporting threshold. See the repository Security tab for the full set.

Severity	Scanner	Issue	Location	Dismiss	Verdict
🔴 CRITICAL	SCA	black@25.9.0 — 3 vulnerabilities (worst: PYSEC-2026-2120)	poetry.lock:1	`d14`	🔺 TRUE_POSITIVE · Confidence: HIGH
🔴 CRITICAL	SCA	transformers@4.56.2 — 15 vulnerabilities (worst: PYSEC-2026-2290)	poetry.lock:1	`d16`	🔺 TRUE_POSITIVE · Confidence: HIGH
🔴 CRITICAL	SCA	pillow@11.3.0 — 45 vulnerabilities (worst: GHSA-8g5g-8vmr-9782)	poetry.lock:1	`d15`	🔺 TRUE_POSITIVE · Confidence: HIGH
🟠 HIGH	SCA	urllib3@2.4.0 — 16 vulnerabilities (worst: GHSA-2xpw-w6gg-jr37)	poetry.lock:1	`d12`	🔺 TRUE_POSITIVE · Confidence: HIGH
🟠 HIGH	SCA	fsspec@2025.3.0 — 2 vulnerabilities (worst: GHSA-27vj-qcqg-25rc) → fixed in 2026.6.0	poetry.lock:1	`d5`	🔺 TRUE_POSITIVE · Confidence: HIGH
🟠 HIGH	SCA	aiohttp@3.12.15 — 72 vulnerabilities (worst: GHSA-2g87-pp6c-29x5)	poetry.lock:1	`d17`	🔺 TRUE_POSITIVE · Confidence: HIGH
🟠 HIGH	SCA	virtualenv@20.34.0 — 14 vulnerabilities (worst: GHSA-5vjq-rrrf-7h2q)	poetry.lock:1	`d21`	🔺 TRUE_POSITIVE · Confidence: HIGH
🟠 HIGH	SCA	pyarrow@21.0.0 — 2 vulnerabilities (worst: GHSA-rgxp-2hwp-jwgg) → fixed in 23.0.1	poetry.lock:1	`d8`	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	SCA	datasets@4.1.1 — 2 vulnerabilities (worst: GHSA-379c-qx7v-6h59) → fixed in 5.0.1	poetry.lock:1	`d3`	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	SCA	idna@3.10 — 2 vulnerabilities (worst: GHSA-65pc-fj4g-8rjx) → fixed in 3.15	poetry.lock:1	`d6`	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	SCA	pytest@8.4.2 — 2 vulnerabilities (worst: GHSA-6w46-j5rx-g56g) → fixed in 9.0.3	poetry.lock:1	`d9`	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	SCA	filelock@3.19.1 — 4 vulnerabilities (worst: GHSA-w853-jp5j-5j7f)	poetry.lock:1	`d19`	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	SCA	requests@2.32.5 — 2 vulnerabilities (worst: PYSEC-2026-2275) → fixed in 2.33.0	poetry.lock:1	`d20`	🔺 TRUE_POSITIVE · Confidence: HIGH

Fix Suggestions

black@25.9.0 — 3 vulnerabilities (worst: PYSEC-2026-2120) — poetry.lock:1

Pin black to a patched version once available (e.g., poetry add black@latest --group dev) or, as a workaround, remove/upgrade black and run the formatter only in an isolated, untrusted-input-free CI environment; monitor PYSEC-2026-2120, PYSEC-2026-2121, and GHSA-3936-cmfr-pm3m for fixed releases.

transformers@4.56.2 — 15 vulnerabilities (worst: PYSEC-2026-2290) — poetry.lock:1

Upgrade to the latest transformers release that addresses the individual advisories (e.g., poetry add transformers@latest or poetry update transformers), and since no single fixed version covers all 15 advisories, review each advisory individually and pin to the newest available version while monitoring for patched releases; as an interim mitigation, avoid loading untrusted models/checkpoints and disable unsafe deserialization paths.

pillow@11.3.0 — 45 vulnerabilities (worst: GHSA-8g5g-8vmr-9782) — poetry.lock:1

Upgrade to the latest available Pillow release (e.g., poetry add pillow@latest or poetry update pillow) and monitor for patched releases addressing GHSA-8g5g-8vmr-9782; as an interim workaround, restrict or sandbox processing of untrusted image inputs.

Dismiss false positives

Tick a box to dismiss the finding; untick it to bring the finding back. That is the same as replying /broly dismiss d1 and /broly undismiss d1. To record why it is a false positive, reply with /broly dismiss d1: your reason instead — Broly reuses those reasons to triage similar findings across the org.

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (GLM-5.3-Flash) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Attack Hypotheses · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.

@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.


@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.


@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.


@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.


@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.


@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.


@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.


@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.


@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.


@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.


@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.


Bumps [pygments](https://github.com/pygments/pygments) from 2.19.1 to 2.20.0. - [Release notes](https://github.com/pygments/pygments/releases) - [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES) - [Commits](pygments/pygments@2.19.1...2.20.0) --- updated-dependencies: - dependency-name: pygments dependency-version: 2.20.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.


dependabot · 2026-10-22T21:01:48Z

Looks like pygments is up-to-date now, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 8, 2026

github-advanced-security Bot found potential problems Oct 8, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/pip/pygments-2.20.0 branch from 431f1ec to ab39a92 Compare October 21, 2026 16:52

github-advanced-security Bot found potential problems Oct 21, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/pip/pygments-2.20.0 branch from ab39a92 to e3086a1 Compare October 21, 2026 17:52

github-advanced-security Bot found potential problems Oct 21, 2026

View reviewed changes

Comment thread poetry.lock

@@ -1,4 +1,4 @@

# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.

# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.

dependabot Bot closed this Oct 22, 2026

dependabot Bot deleted the dependabot/pip/pygments-2.20.0 branch October 22, 2026 21:01

Navigation Menu

Repository navigation

Bump pygments from 2.19.1 to 2.20.0 - #468

Bump pygments from 2.19.1 to 2.20.0#468
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pygments-2.20.0

dependabot Bot commented on behalf of github Oct 8, 2026 •

edited

Loading

Uh oh!

broly-code-security-scanner Bot commented Oct 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github Oct 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		@@ -1,4 +1,4 @@
		# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
		# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.

Conversation

dependabot Bot commented on behalf of github Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2.20.0

2.19.2

Version 2.20.0

Uh oh!

broly-code-security-scanner Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Broly Security Scan

Fix Suggestions

Dismiss false positives

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github Oct 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 8, 2026 •

edited

Loading

broly-code-security-scanner Bot commented Oct 8, 2026 •

edited

Loading