[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pymdown-extensions	~=11.0 → ~=13.1
python-box (changelog)	~=7.4.1 → ~=8.0.1

---

Release Notes

facelessuser/pymdown-extensions (pymdown-extensions)

v13.1

Compare Source

13.1

• NEW: Snippets: Respect the Retry-After header when a URL responds with a 429. The server's requested delay is
  used instead of our backoff, and the snippet fails right away if it is longer than the longest we would wait
  ourselves (backoff_factor times max_retries).
• NEW: Snippets: Split snippet processing into steps that an extension can override (parse_snippet_target,
  select_snippet_lines, and process_snippet_lines) to add notation or change included content, and add
  get_syntax_mask to find which lines are snippet notation so they can be left alone. (#​3040)
• FIX: Fix an issue where only our test environment required Python Markdown 3.10.3. Installs must require this.
• FIX: Snippets: Fix quadratic time complexity when parsing very long runs of ; or - in content, and very long
  snippet paths with line ranges.
• FIX: Quotes, Details (legacy), Tabbed (legacy), FancyLists, Blocks, and Snippets: Gracefully stop short of the
  recursion limit when content is nested too deeply, instead of raising a RecursionError. This includes content
  nested inside of a document structure that is already deep, such as a quote or tab inside of many nested lists.
  Content past the limit is no longer specially processed (Snippets skips includes past the limit, as it does for
  cyclic includes).

v13.0

Compare Source

13.0

• BREAK: Arithmatex: Generic mode is now the default mode as the old MathJax script approach has not been
  supported in MathJax for a long time now. We still provide script approach and have updated configuration to get it
  properly working in recent MathJax versions.
• BREAK: Arithmatex: Non-generic mode now escapes content in script to prevent closing </script> from causing
  unintended behavior. Guidance on configuration for non-generic mode has been updated in the documentation.
• NEW: Require at least Python Markdown 3.10.3 for performance improvements.
• NEW: Drop Python 3.10 and require Python >= 3.11.5 as possessive quantifiers are broken on lower versions.
• NEW: MagicLink: Bare http://, https://, and www. links now follow GFM's extended autolink rules for what
  is considered the end of a link (trailing punctuation, entities, unbalanced ) and ]) and what a link can follow.
  Links no longer start after arbitrary punctuation (quotes are still allowed), and http://host style links with a
  short host are allowed.
• FIX: Critic: Fix quadratic (and cubic for substitutions) time complexity when parsing a large number of unclosed
  CriticMarkup openers by replacing the regular expression with a linear time scanner.
• FIX: PathConverter, B64: Handle elements with unquoted attributes.
• FIX: Arithmatex: Fix generic mode output when tex_inline_wrap or tex_block_wrap contain braces.
• FIX: InlineHilite: Fix regression related to unmatched opening and closing.
• FIX: FancyLists: Keep i and I in alphabetical lists after a blank line.
• FIX: BracketSpan: Fix unwanted colon attributes with {: ...} syntax.
• FIX: Snippets: Fix escaped section markers starting or ending a section before its start.
• FIX: StripHTML: Fix crash when strip_comments is disabled.
• FIX: Quotes: Fix callouts in indented blockquotes.
• FIX: Details, Admonitions, SaneHeaders: Improve performance of header patterns.
• FIX: Blocks.HTML: Improve performance of HTML patterns.
• FIX: MagicLink: Fix URLs with balanced parentheses or brackets losing their closing character.
• FIX: MagicLink: Improve performance of link and email patterns by removing excessive backtracking.
• FIX: ProgressBar: Fix crash on malformed 100 percent values like [=100,0%].
• FIX: BracketSpan: Fix text being dropped or misplaced when an unpaired [ precedes a span that is returned from
  the cache, e.g. [[]{#a}[b[]{#c}.
• FIX: BetterEm, Tilde, Caret, Mark: Apply the CommonMark "rule of 3" so an ambiguous closing delimiter can skip
  an incompatible opener and pair with an earlier one, e.g. __[A](u){target="_blank"}__: x.
• FIX: BetterEm, Tilde, Caret, Mark: Better handling of Python Markdown placeholders when when evaluating
  CommonMark punctuation rules.
• FIX: Blocks.Caption: Fix crash when a numbered caption is nested inside a figure not created by the caption
  block.
• FIX: BetterEm, Tilde, Caret, Mark: Fix text being dropped when a stray delimiter that cannot open or close
  appears between delimiter pairs parsed together, e.g. ***l* * **e**.
• FIX: BetterEm, Tilde, Caret, Mark: Fix text being dropped or misplaced when unused delimiters inside a
  parsed span were reprocessed against delimiter pairs found later in the same text.
• FIX: Tilde, Caret: Fix a crash when a subscript or superscript with no space allowed starts inside emphasis,
  e.g. *a ~b~* with delete disabled.
• FIX: BetterEm, Tilde, Caret, Mark: Unusable delimiters dropped by another delimiter's region no longer leave
  stale space tracking that can reject valid pairs later.
• FIX: Blocks.Caption: Fix crash when a numbered caption is nested inside a figure not created by the caption
  block.

v12.3

Compare Source

12.3

• NEW: BetterEm: Expose a way to disable CommonMark punctuation rules in BetterEm if desired via a new
  punctuation option.

v12.2

Compare Source

12.2

• NEW: Add official support for Python 3.15.
• NEW: Tilde, Caret: For backwards compatibility, disable CommonMark punctuation rules by default. If subscript or
  superscript is disabled in the respective extension, CommonMark rules will be honored again. A new punctuation
  rule has been added to force CommonMark rules. When done, people will need to be aware of punctuation when subscript
  or superscript is enabled and escape any that violates CommonMark rules.
• NEW: Highlight: Highlight now allows in the auto_title_map specifying the title as a simple string or a
  dictionary containing the title and the title mode: either text or html, with text being the default. This
  allows a title to be specified and treated as HTML when the mode is html.
• NEW: SuperFences: Add new title_mode option for Pygments fenced blocks that allows a user to specify a title
  to be treated as HTML via title_mode="html".

v12.1

Compare Source

12.1

• NEW: SuperFences: Add optional reset function that can be specified for custom fences.
• FIX: Tilde, Caret: Fix performance for long invalid delimiters.

v12.0.1

Compare Source

12.0.1

• FIX: BetterEm: fix a case with new logic.

v12.0

Compare Source

12.0

• BREAK: BetterEm: Complete rewrite. There may be some subtle differences between legacy behavior and new
  CommonMark behavior.

  • * and _ emphasis are handled at the same time to provide more natural nesting.
  • More performant.
  • CommonMark compliant.

• BREAK: Tilde, Caret, Mark: Rewritten and now built upon the latest BetterEm logic.

  • When used with BetterEm, Tilde, Caret, and Mark will be added to the same delimiter processor under the hood and
    will be parsed at the same time as emphasis, allowing for better nesting logic.
  • More performant. Performance issues reported by (@​lexdotdev).
  • Tilde, Caret, Mark: Allow deletion, insertions, and marking mid-word by default. Set smart_delete,
    smart_insert, or smart_mark, respectively, to enable previous behavior, which prevented mid-word deletion.
  • Tilde, Caret: Add new option no_space to control whether the Pandoc style requirement of "no unescaped
    spaces" is enabled for subscript and superscript, respectively. no_space is enabled by default.

• NEW: Details, Blocks.Details, Blocks.Admonitions: Allow and handle headers specially in titles.

• NEW: Quotes: Allow and handle headers specially in callout titles.

• NEW: BracketSpan: New extension that allows for the creation of spans using a Pandoc style bracket notation.

• NEW: Arithmatex: Remove deprecated inline_mathjax_preview_format, inline_mathjax_format, and
  inline_generic_format. Use arithmatex_inline_format instead.

• NEW: Arithmatex: Remove deprecated fence_mathjax_preview_format, fence_mathjax_format, and
  fence_generic_format. Use arithmatex_fenced_format instead.

• NEW: Emoji: Remove undocumented and deprecated "old style" custom emoji index logic.

• NEW: Slugs: Remove deprecated uslugify, uslugify_encoded, uslugify_cased, uslugify_cased_encoded, gfm,
  and gfm_encoded. Use the documented slugify method with appropriate arguments instead.

cdgriffith/Box (python-box)

v8.0.1

Compare Source

Breaking changes

These change how Box.update (and the | and |= operators, which use it) store values. Code that relied on the old behavior may see different data after upgrading. See the "Box 8.0.1" section of the Major Version Breaking Changes wiki page for before / after examples.

• Fixing #​356 update() storing dotted keys literally with box_dots, they are now paths like box["a.b"] = 1 and the Box constructor. Every earlier version (6.x, 7.x, 8.0.0) stored them literally:

  • Box({"a": {"x": 1}}, box_dots=True).update({"a.b": 2}) now gives {"a": {"x": 1, "b": 2}}, previously {"a": {"x": 1}, "a.b": 2}
  • Box(box_dots=True).update({"a.b": 1}) now raises BoxKeyError because "a" does not exist (as box["a.b"] = 1 already did), previously it stored {"a.b": 1}. Add default_box=True to create the missing parents

  (thanks to rahul05ranjan)

• update() now applies the same rules as box[key] = value and the Box constructor, previously it skipped them (thanks to peterolkhov):

  • box_recast converts updated values, and raises BoxValueError when a value cannot be converted, e.g. update(n="12") with box_recast={"n": int} now stores 12, previously "12"
  • camel_killer_box converts updated keys, e.g. update(TimeOut=2) now replaces time_out, previously it added a second TimeOut key
  • box_duplicates checks updated keys, so "error" now raises BoxError and "warn" now warns for keys that collide on attribute access
  • Box subclasses that override setitem now have it called for every updated key

Changes

• Fixing #​358 BoxList + and * returning a plain list instead of a BoxList (thanks to rahul05ranjan)
• Fixing #​354 BoxList insert, pop, deletion and *= with an object with index raising TypeError after changing the list when the list has item comments (thanks to parijat1222q and Anish Pentyala)
• Fixing ConfigBox.merge_update consuming one-shot key/value pairs before merging them (thanks to alexbertho)
• Fixing BoxList in-place repetition by zero or a negative count leaving the removed items' comments behind for new items to inherit (thanks to Mrunmayee Daware)
• Fixing a BoxList in a frozen Box only being half frozen: append, extend, insert, pop, remove, clear, sort and reverse still changed it, and it was shared with the Box it came from. A frozen Box now gets its own frozen copy, and a BoxList checks frozen_box on every change
• Fixing copy.deepcopy of a frozen Box leaving the nested Boxes mutable
• Fixing BoxList slice assignment and slice deletion dropping the item comments of every item, comments now stay with the items they were on
• Fixing from_yaml(frozen_box=True) dropping the comments on list items, frozen lists (tuples) now keep comments, and box_dots list paths such as "l[0].x" now work in a frozen Box
• Fixing Box.pop(path, default) raising IndexError for an out of range list index in a box_dots path, it returns the default like get()
• Fixing a failed dotted del creating the parent key with default_box_create_on_get
• Fixing BoxList box_dots indexes such as "[x][1]" being accepted and acting on the wrong item, they now raise BoxTypeError
• BoxList + and * (and n * BoxList) keep the item comments, also those of the added BoxList, and *= repeats them
• Fixing #​349 BoxList item comments moving to the wrong items after a box_dots deletion, e.g. del bl["[0]"] (thanks to HocVoNgThai)
• Fixing #​349 BoxList.sort() calling the key function twice when the list has comments (thanks to HocVoNgThai)

v8.0.0

Compare Source

Breaking changes

• Box.popitem() now removes the most recently inserted item (LIFO) like dict.popitem(), instead of the first inserted item (thanks to machines-6657)
• Removing support for Python 3.10 as it is EOL, Python 3.11+ is now required
• merge_update now raises BoxValueError for an unrecognized box_merge_lists value instead of silently replacing the list
• Box.copy() / copy.copy() / copy.deepcopy() now return the same class as the original (subclasses of Box, ConfigBox, SBox and DDBox were previously turned into a plain Box / ConfigBox / SBox)
• ConfigBox string keys are now case-insensitive for every kind of access (not only attribute lookups), and a ConfigBox no longer holds keys that differ only by case: the latest write wins, keeping its value and spelling, so ConfigBox({'Foo': 1, 'foo': 2}) is ConfigBox({'foo': 2})
• default_box_create_on_get now defaults to False (#​262): looking up a missing key returns the default without storing it, so tools that probe attributes (IPython, Spyder) no longer add keys. Assigning through a missing key still creates it (box.a.b = 1). Changing a default value in place, such as box.tags.append(1) with default_box_attr=[], is no longer kept, pass default_box_create_on_get=True for the old behavior (thanks to wtld for reporting)
• to_yaml writes keys in insertion order with PyYAML and the ruamel safe / unsafe dumpers too (the default ruamel round trip dumper already did), pass sort_keys=True to sort them (#​104, thanks to philipsd6 for reporting)
• Box options are no longer named parameters of Box.new / Box.init, they are read from keyword arguments (behavior is the same, the type stubs still list them)
• DDBox options can now be overridden, e.g. DDBox(default_box=False)
• to_yaml now writes the comments of YAML loaded with ruamel.yaml's default round trip loader (#​184), and get_comment, set_comment and del_comment are new protected key names
• Build and development tooling changed (see below): installing from an sdist now needs setuptools>=77, and building the Cython version from source requires --no-build-isolation

Changes

• Fixing #​274 default_box_create_on_get=False not creating missing parent keys on assignment, e.g. box.a.b = 1 (thanks to gyanu2507 for the fix and wrdls for reporting)
• Adding #​263 "merge" option for box_merge_lists to merge lists of dictionaries element by element (thanks to ChrisJr404)
• Adding #​314 case-insensitive ConfigBox keys for [] access, in, del, update, merge_update and box_dots paths, matching configparser (thanks to binggao1230)
• Adding #​184 comments on keys and list items: from_yaml keeps the comments of the document and to_yaml writes them back, and get_comment / set_comment / del_comment manage them on any Box or BoxList (thanks to philipsd6 for the request and michaelaye for the push)
• Adding #​296 _box_defaults class attribute so subclasses can change Box option defaults without overriding init (also #​223, #​210, thanks to marcelloromani, 12rambau and miversen33 for reporting)
• Adding #​279 camel_killer_box_keep_keys to keep the original CamelCase keys and only add snake_case attribute aliases (thanks to jacobtomlinson for the suggestion)
• Adding #​123 box_dots path segments made of digits also match integer keys, e.g. box['servers.2'] for {'servers': {2: ...}} (thanks to richieadler for reporting)
• Fixing in and get() returning False / None for box_dots paths through lists, e.g. 'a[0].x' in box, and in treating substrings of string values as keys ('a.b' in Box(a='xbz'))
• Fixing IndexError setting a box_dots key ending with a dot on a default_box
• Fixing AttributeError instead of BoxKeyError when setting to_msgpack, from_msgpack, to_toon or from_toon as attributes (now protected), and setting other non property class attributes
• Fixing frozen BoxList copy.deepcopy and pickle leaving the contained Boxes unfrozen
• Fixing unpickled BoxList re-creating its Boxes with default options (box_dots, box_class, default_box and so on were lost). BoxList pickles made by earlier versions still load
• Removing the tomli and toml read fallbacks, TOML is always read with tomllib (part of Python 3.11+). Writing still uses tomli-w, or the toml package if installed
• Fixing dict | Box and dict + Box returning a Box without the right side's options (box_dots, default_box, box_class and so on)
• Fixing default_box_attr with classes such as list, int or set raising an error, they now work like defaultdict factories (list gives a BoxList). Only required parameters of a default_box_attr function have to be named key or box_instance
• Fixing ConfigBox.bool treating "off" as True, it now matches the configparser false values
• Reaching 100% line and branch test coverage, enforced in CI
• Updating development dependencies to their latest versions (pytest 9, pytest-cov 7, mypy 2, twine 7, Cython 3.3.1, pre-commit-hooks 6)
• Fixing Box(default_box=True) pop() of a missing key and argparse namespaces (hasattr then delattr) with default_box_create_on_get=False
• Adding #​269 internal-only attributes for Box subclasses via _box_internal_attrs (thanks to bwanshoom and gtkacz for the suggestion)
• Adding support for Python 3.15
• Adding manylinux Cython wheels for Python 3.14 and 3.15
• Fixing python_requires to match supported versions
• Updating GitHub Actions to latest major versions
• Fixing #​260 nested boxes losing box_dots after pickle (thanks to DSeaStar)
• Fixing #​265 unclear error for malformed BoxList bracket indices with box_dots (thanks to Arindam Sikder)
• Fixing #​272 frozen_box with lists could not be serialized to YAML / JSON (thanks to apoorvdarshan)
• Fixing #​300 CamelCase keys in dotted lookups with camel_killer_box (thanks to Guo Jiarui)
• Fixing #​305 dotted keys lost with box_dots when a non-dotted key with the same prefix follows (thanks to J vanBemmel)
• Fixing #​308 subclass of Box not preserved for nested boxes after unpickling (thanks to koriyoshi2041)
• Fixing #​344 frozen BoxList instances could not be pickled (thanks to Abhinav Maurya)
• Fixing frozen BoxList could be mutated via clear, += and *= (thanks to Vitaliy Voloshin)
• Fixing BoxList.deepcopy not preserving box options (thanks to chuenchen309)
• Fixing second dotted write into an existing BoxList element discarding data (thanks to binggao1230)
• Fixing dicts and lists assigned to BoxList items and slices not being converted (thanks to x0Lazarus)
• Fixing dicts and lists added with BoxList += not being converted (thanks to lin)
• Fixing BoxList.extend(self) revisiting its own appended values (thanks to x0Lazarus)
• Fixing BoxList construction testing the truth value of the iterable (thanks to fhgffy)
• Fixing BoxList to_json / from_json multiline not working with strings (thanks to shguild)
• Fixing explicit ensure_ascii option being ignored in JSON output (thanks to fhgffy)
• Fixing Box.pop with an explicit default creating missing values with default_box (thanks to Huanyi Xie)
• Fixing Box.update not accepting a positional source and keyword overrides together like dict.update (thanks to AryanRG)
• Fixing duplicate conversion check raising when re-assigning the same key (thanks to Muneeb Sheikh)
• Fixing deleted keys not releasing their converted attribute alias (thanks to Gary)
• Fixing Box.copy() (and copy.copy / copy.deepcopy) returning a plain Box, ConfigBox or SBox instead of the same subclass
• Moving package metadata from setup.py to pyproject.toml (PEP 621), setup.py now only handles the optional Cython build
• Moving development and CI to uv (dependency groups and uv.lock replace the requirements files) and ruff (replaces black)
• Fixing optional dependency installation examples in README (thanks to Likio3000)
• Fixing #​264 ruamel.yaml ScalarFloat / ScalarInt / ScalarBoolean values left as non-builtin types after from_yaml, which broke libraries expecting float / int / bool (thanks to tan_unique)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coveralls]

coverage: 96.572%. remained the same — renovate/major-pip-deps into dev