[delphix-devops-bot]

Auto-generated by dependency-bump. Tracked in DLPX-100047.

TL;DR

Bumps mkdocs-material from 9.7.7 to 9.8.0 (latest-stable) in docs/Pipfile/docs/Pipfile.lock, consolidating Mend PR #722. Build verified green before and after (all 5 Python modules + the docs mkdocs build --strict); no breaking changes or in-range CVEs found. LOW risk.

Batch risk tier: LOW

✅ dependency-bump verified: every dependency in this batch is LOW risk (build passes, no exploitable CVEs).

Dependencies in this batch (1)

Dependency	From → To	Risk	CVEs	Breaking changes
mkdocs-material	9.7.7 → 9.8.0	LOW	0 (in range)	0 (applicable)

mkdocs-material: 9.7.7 → 9.8.0 — risk: LOW

Note on the source PR: #722 (Mend) is stale — its diff targets 9.1.7 → 9.1.8 (its title mentions v9.8.0 but that's not what the diff actually changes; bot PR titles/diffs are never trusted for version facts per dependency-bump's own rules). develop had already moved on to 9.7.7 by the time this batch ran (a prior, separate update), so this PR bumps from the real current pin (9.7.7) to the policy-resolved latest-stable target (9.8.0), which happens to match what #722's title claimed, coincidentally.

Manifests affected:

• docs/Pipfile
• docs/Pipfile.lock

CVE findings (0 in this version range):
No CVE-tagged commits between 9.7.7 and 9.8.0. One GHSA advisory exists for this package (GHSA-xvg9-69gf-fjrf / CVE-2026-73295, medium severity, DOM XSS in search suggestions via query parameter) but its fixed_in version is 9.7.7 — already the batch's starting version on develop — so it predates this transition and isn't a CVE this PR introduces or fixes. Included here for transparency since the search plugin is enabled in this repo's mkdocs.yml.

One commit in range (0f72ad6, Merge pull request #8615 from squidfunk/fix/security, landed as part of preparing the 9.8.0 release) is branch-named as a security fix but has no GHSA advisory yet — a known coverage gap (GHSA can lag a release). Flagging for visibility; not scored into the risk tier since there's no CVSS/advisory data to score against.

Commit breakdown (23 commits):

• 4 security/CVE fixes (2 "updated dependencies to fix vulnerabilities", 1 Node build-time dep security bump, 1 unlabeled fix/security merge — see note above)
• 0 bug fixes
• 0 features
• 1 breaking change
• 18 refactor / docs / tests / project-status

Breaking changes (need attention):

• Updated Python dependency minimums and required Python 3.11 — raises mkdocs-material's own minimum supported Python to 3.11.
  • Changed: packaging metadata (requires-python), not a function
  • Your usage: ✅ NOT CALLED / not applicable — this repo already requires Python 3.11 only (see CLAUDE.md), so this floor-raise has no effect here.

Project-health note: this release's changelog signals Material for MkDocs is moving to "critical maintenance" (security/critical fixes only) ahead of end-of-life on 2027-05-05, with a successor project ("Zensical") being promoted. Not a blocker for this bump, but worth knowing for future docs-tooling planning.

Version note: source PR #722 proposed mkdocs-material 9.1.8 (per its stale diff). dependency-bump resolved to 9.8.0 (policy: latest-stable) — bringing the repo to the real current latest rather than the source PR's (already superseded) target.

Source PRs consolidated (1)

dependency-bump does not close these. Once this PR merges and dep versions match the manifests, the bot that opened each one is responsible for auto-closing it on its own next scan.

• Update dependency mkdocs-material to v9.8.0 #722 — Update dependency mkdocs-material to v9.8.0

Build verification

Phase	Result	Summary
Baseline (pre-change)	✅ PASS	All 5 modules built clean (bin/build_project.sh -b); mkdocs build --clean --strict built in 3.31s with no warnings/errors
Post-change	✅ PASS	Same commands, same result, with mkdocs-material==9.8.0 installed; mkdocs build --clean --strict built in 4.46s (only a non-fatal EOL/Zensical notice printed, no errors)

Commands run (per .claude/dependency-bump.md), against all manifests touched by this batch:

• sh bin/build_project.sh -b (all 5 modules, unscoped — always runs regardless of what changed)
• cd docs && pipenv sync && pipenv run mkdocs build --clean --strict (this batch only touches docs/Pipfile; no Python module's pyproject.toml changed, so the module-scoped test/lint pass (-ctf) has nothing to scope to and was not run)

Additional automations

Run against the pushed batch branch, after this PR was opened — see the PR's edit history if you're reading this before they've landed.

• ⚠ sh bin/build_project.sh -f [sync] — not applicable: no Python module (common/libs/platform/tools/dvp) was touched by this batch, only docs/Pipfile
• ✅ [sync] dvp init --root-dir . && dvp build --dev — passed: ran in an isolated temp dir, artifact.json produced (~1 MB) with no errors
• ✅ [async] trigger_blackbox.sh ... virtualization_sdk APPDATA_SDK_UBUNTU20_STAGED_CENTOS73 — SUCCESS, not factored into risk tier
  → Tracking URL: https://selfservice-jenkins.eng-tools-prd.aws.delphixcloud.com/job/blackbox-self-service/237037/
• ✅ [async] trigger_blackbox.sh ... appdata_basic APPDATA_PYTHON_STAGED_RHEL93 — SUCCESS, not factored into risk tier
  → Tracking URL: https://selfservice-jenkins.eng-tools-prd.aws.delphixcloud.com/job/blackbox-self-service/237038/

Installed package changes (pip freeze diff)

The diff below shows the full effect of this batch — including transitive deps that updated as a side effect (docs venv only; the 5 Python modules' own dependency sets are untouched by this batch).

2c2
< Markdown==3.11
---
> Markdown==3.11.2
8,9c8,9
< backrefs==8.0
< bracex==3.0.1
---
> backrefs==8.1
> bracex==3.2
11c11
< certifi==2026.7.22
---
> certifi==2026.10.23
37c37
< mkdocs-material==9.7.7
---
> mkdocs-material==9.8.0
48c48
< platformdirs==4.12.3
---
> platformdirs==4.13.7
53c53
< pymdown-extensions==12.1
---
> pymdown-extensions==12.3
57c57
< python-dateutil==2.9.0.post0
---
> python-dateutil==3.0.0
64a65
> tzdata==2026.5
68c69
< wcmatch==11.0.1
---
> wcmatch==11.2

1 explicit + 8 transitive package version changes. Note: python-dateutil moved 2.x → 3.x (a major-version jump) as a side effect of the lock re-resolve, not something explicitly bumped — expected per dependency-bump's lock-file-refresh behavior. The post-change mkdocs build --strict passed cleanly with it installed, which is the empirical evidence this transitive jump didn't break anything for our docs build.

---

Generated by dependency-bump · policy: latest-stable

[Copilot]

🟢 Approval recommended

No active review issues are reported for the documentation tooling dependency update.

No open issues 🎉

What changed in this PR

Updates the SDK’s documentation tooling to mkdocs-material 9.8.0, consolidating dependency PR #722 without changing the five Python packages.

Changes:

• Bumps mkdocs-material from 9.7.7 to 9.8.0.
• Refreshes locked transitive dependencies, hashes, and Python compatibility markers, including a python-dateutil major-version update.

File	Description
docs/​Pipfile.lock	Locks the updated theme and transitive dependencies.
docs/​Pipfile	Pins mkdocs-material to 9.8.0.

_{Review effort: Balanced}

[delphix-devops-bot]

🔁 dependency-bump reconcile status

Last reconcile pass: 2026-10-29

• PyPI drift: none — mkdocs-material 9.8.0 is still latest-stable (re-resolved, unchanged).
• Review threads: none open.
• Top-level feedback: the automated Copilot review (recommending approval, no issues) is already acknowledged from a prior pass; no new comments or threads since.
• Build verification: already verified for commit 1743259 — not rerun (no code change this pass).
• Async automations: both blackbox runs already succeeded for this commit —
  • virtualization_sdk (APPDATA_SDK_UBUNTU20_STAGED_CENTOS73): ✅ SUCCESS
  • appdata_basic (APPDATA_PYTHON_STAGED_RHEL93): ✅ SUCCESS

No code changes this pass. Risk tier unchanged: LOW.

[delphix-devops-bot]

Addressing feedback from @copilot-pull-request-reviewer: this is an automated review recommending approval with no issues found and no change requested — nothing to address.