[mortyops]

This PR contains the following updates:

Package	Update	Change
squidfunk/mkdocs-material	minor	9.7.7 → 9.8.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

squidfunk/mkdocs-material (squidfunk/mkdocs-material)

v9.8.0: mkdocs-material-9.8.0

Compare Source

[!WARNING]

Material for MkDocs reaches end of life on May 5, 2027. Critical fixes and security updates continue until that date.

We're continuing our work with Zensical, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.

You can evaluate Zensical alongside MkDocs using your existing mkdocs.yml. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The classic theme variant preserves the appearance of Material for MkDocs. See the migration guide for the steps and current compatibility details.

Upcoming changes on November 5

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

• Updated Node build-time dependencies to fix vulnerabilities
• Updated Python dependency minimums and required Python 3.11
• Removed RSS from recommended dependencies
• Updated project status and maintenance links
• Updated CLI notice with end-of-life and migration guidance
• Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide. It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Dependency	Affected versions	New minimum	Advisory
Jinja2	<=3.1.5	3.1.6	CVE-2025-27516
Markdown	<3.8.1	3.8.1	CVE-2025-69534
Pygments	<2.20.0	2.20.0	CVE-2026-4539
PyMdown Extensions	<=11.0.0	11.0.1	CVE-2026-67422
Requests	<2.33.0	2.33.0	CVE-2026-25645
Pillow	<13.0.0	13.0.0	CVE-2026-96636
CairoSVG	<=2.9.0	2.9.1	CVE-2026-107378
GitPython	<=3.2.0	3.2.1	CVE-2026-114145

Pillow and CairoSVG apply to the imaging extra; GitPython applies to the git extra.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

✅ Automated recommendation: APPROVE

Analysis engine: pr-review-local (openai) · pr-reviewer-action v3.7.0

Recommendation

Approve. This is a single-image bump (squidfunk/mkdocs-material 9.7.7 → 9.8.0) in the repo-wiki HelmRelease. The change is a pure digest/patch bump with no other diff lines, no new resources, no config changes, and no secrets. It is safe to merge.

Change-by-Change Findings

kubernetes/apps/base/ai/repo-wiki/app/helmrelease.yaml — image tag bump

• What changed: tag: 9.7.7@sha256:51b87149d227691486b5f08993d28c65ca7e4990010664b697265b8e6fcd5287 → tag: 9.8.0@sha256:dc3b5de76c6e30d18dc0922d4c4a7bed817e5e155f9ff0e594a53eb56e537e64 (line 42).
• Risk: Low. This is a minor version bump of a static-site generator image. The release notes state it is "primarily a security release" raising dependency minimums (Python ≥ 3.11, Jinja2 ≥ 3.1.6, Markdown ≥ 3.8.1, Pygments ≥ 2.20.0, PyMdown Extensions ≥ 11.0.1). The image is consumed by a cronjob (repo-wiki-gen) and a serving pod (mkdocs), neither of which is a security boundary for the cluster.
• No new resources, no new env vars, no new routes, no new secrets. The diff is exactly one line.

Required Checks Disposition

Check	Status	Rationale
validate manifest against target cluster version	satisfied	The manifest is a HelmRelease with chartRef.kind: OCIRepository pointing to app-template. No cluster-version-specific API versions are introduced; helm.toolkit.fluxcd.io/v2 is stable across Flux v2 releases. The image tag is a container image, not a K8s API version.
check for resource quota / limit changes	satisfied	No resources.requests or resources.limits lines were modified. The diff touches only the tag field.

Standards Compliance

• No plaintext secrets: Confirmed — no secrets in the diff.
• Flux schema comment present: # yaml-language-server: $schema=... is present at line 1.
• Naming convention: helmrelease.yaml is kebab-case; repo-wiki is lowercase kebab-case. ✓
• No postRenderer with bash: Not present. ✓
• No secrets under **/resources/**: Not applicable — this is a helmrelease.yaml, not a resources/ path. ✓
• No allowPrivilegeEscalation: true: Both containers set allowPrivilegeEscalation: false. ✓
• securityContext with runAsNonRoot: true, runAsUser: 1000, fsGroup: 1000: Present and consistent. ✓
• seccompProfile: { type: RuntimeDefault }: Present. ✓
• capabilities: { drop: ["ALL"] }: Present on both containers. ✓
• Route annotation external-dns.alpha.kubernetes.io/target: "internal.${SECRET_DOMAIN}": Present — this is an internal-only route (parentRefs: envoy-internal), consistent with the repo-wiki being an internal service. ✓
• No ${...} literal substitution risk: The diff contains no new ${...} tokens. The existing KOPIUR_CLAIM and SECRET_DOMAIN are Flux variables, not literal substitutions. ✓

Unknowns / Needs Verification

• Python 3.11 minimum: The release notes state "Python 3.11 or newer is now required." The repo-wiki-gen cronjob uses python:3.14 (line 108), which satisfies this. The mkdocs serving container uses squidfunk/mkdocs-material:9.8.0 which bundles its own Python — no host Python dependency. No action needed.
• No host-platform compatibility matrix needed: This is a container image bump, not a platform-coupled dependency. No matrix fetch required.

Tool Harness Findings

No tool harness findings are present in the corpus.

Summary

A clean, low-risk Renovate dependency bump. The diff is one line. No new resources, no secrets, no route changes, no resource limit changes. Approved.

[mortyops]

--- HelmRelease ai/repo-wiki
+++ HelmRelease ai/repo-wiki
@@ -53,7 +53,7 @@
             - -c
             image:
               repository: squidfunk/mkdocs-material
-              tag: 9.7.7@sha256:51b87149d227691486b5f08993d28c65ca7e4990010664b697265b8e6fcd5287
+              tag: 9.8.0@sha256:dc3b5de76c6e30d18dc0922d4c4a7bed817e5e155f9ff0e594a53eb56e537e64
             resources:
               limits:
                 memory: 512Mi

[mortyops]

--- Deployment ai/repo-wiki-mkdocs
+++ Deployment ai/repo-wiki-mkdocs
@@ -42,7 +42,7 @@
         command:
         - /bin/sh
         - -c
-        image: squidfunk/mkdocs-material:9.7.7@sha256:51b87149d227691486b5f08993d28c65ca7e4990010664b697265b8e6fcd5287
+        image: squidfunk/mkdocs-material:9.8.0@sha256:dc3b5de76c6e30d18dc0922d4c4a7bed817e5e155f9ff0e594a53eb56e537e64
         name: app
         resources:
           limits: