chore(deps): bump numba from 0.65.0 to 0.66.0

[dependabot]

Bumps numba from 0.65.0 to 0.66.0.

Release notes

Sourced from numba's releases.

0.66.0

Major Numba release. Numba now upgrades to llvmlite 0.48 with LLVM 22. For detailed release notes, please refer: https://numba.readthedocs.io/en/stable/release/0.66.0-notes.html

0.65.1

Numba patch release, please refer to the detailed release notes here - https://numba.readthedocs.io/en/stable/release/0.65.1-notes.html

Commits

• aacf444 Merge pull request #10674 from swap357/release0.66
• 701fcd7 update release notes and version support table 0.66
• 95516b7 Merge pull request #10665 from swap357/release0.66
• cafb1c8 remove redundant numpy version requirement from setup.py install_requires
• f7395f4 Merge pull request #10655 from swap357/release0.66
• 2710950 update release date for 0.66.0rc2
• b30e3b9 Merge pull request #10654 from swap357/cherry_pick_0.66.0rc2
• f20d837 update release notes for 0.66.0rc2 changes
• cf768a6 Merge pull request #10649 from swap357/fix_mean_issue_10647
• 5a7693a Merge pull request #10567 from kc611/kc/pseudo_broadcast
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: security. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🐦‍⬛ Muninn Security Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	0
🟢 Low	0
ℹ️ Info	10

ℹ️ Info Findings

[dependency] PYSEC-2026-2210

Package: mistune 3.2.2 (PyPI)
Advisory: PYSEC-2026-2210 (CVE-2026-59922)
Detected by: osv-scanner
File: /github/workspace/gitgalaxy/requirements.txt
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each...

[dependency] PYSEC-2026-2211

Package: mistune 3.2.2 (PyPI)
Advisory: PYSEC-2026-2211 (CVE-2026-59923)
Detected by: osv-scanner
File: /github/workspace/gitgalaxy/requirements.txt
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version 3....

[dependency] PYSEC-2026-2212

Package: mistune 3.2.2 (PyPI)
Advisory: PYSEC-2026-2212 (CVE-2026-59924)
Detected by: osv-scanner
File: /github/workspace/gitgalaxy/requirements.txt
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory whe...

[dependency] PYSEC-2026-2213

Package: mistune 3.2.2 (PyPI)
Advisory: PYSEC-2026-2213 (CVE-2026-59925)
Detected by: osv-scanner
File: /github/workspace/gitgalaxy/requirements.txt
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from eve...

[dependency] PYSEC-2026-2214

Package: mistune 3.2.2 (PyPI)
Advisory: PYSEC-2026-2214 (CVE-2026-59926)
Detected by: osv-scanner
File: /github/workspace/gitgalaxy/requirements.txt
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even...

[dependency] PYSEC-2026-2215

Package: mistune 3.2.2 (PyPI)
Advisory: PYSEC-2026-2215 (CVE-2026-59927)
Detected by: osv-scanner
File: /github/workspace/gitgalaxy/requirements.txt
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionErr...

[dependency] PYSEC-2026-2216

Package: mistune 3.2.2 (PyPI)
Advisory: PYSEC-2026-2216 (CVE-2026-59928)
Detected by: osv-scanner
File: /github/workspace/gitgalaxy/requirements.txt
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service throu...

[dependency] PYSEC-2026-2217

Package: mistune 3.2.2 (PyPI)
Advisory: PYSEC-2026-2217 (CVE-2026-59929)
Detected by: osv-scanner
File: /github/workspace/gitgalaxy/requirements.txt
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:,...

[dependency] PYSEC-2026-2218

Package: mistune 3.2.2 (PyPI)
Advisory: PYSEC-2026-2218 (CVE-2026-59930)
Detected by: osv-scanner
File: /github/workspace/gitgalaxy/requirements.txt
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id="toc_N" content to collide with generated anchors and red...

[dependency] Mistune: Potential DoS via quadratic-time parsing in parse_link_text

Package: mistune 3.2.2 (PyPI)
Advisory: PYSEC-2026-2652 (CVE-2026-49851)
Detected by: osv-scanner
File: /github/workspace/gitgalaxy/requirements.txt
### Summary Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. A relatively small input consisting of repeated [ characters causes significant parsing slowdown. ### Affected component mistune/inline_parser.py → parse_link_text...

🐦‍⬛ Powered by Muninn · Skald Lab