Skip to content

chore(deps): bump ultimate-sitemap-parser from 1.8.0 to 1.8.1 in /scripts - #14

Merged
tgagor merged 1 commit into
mainfrom
dependabot/uv/scripts/ultimate-sitemap-parser-1.8.1
Jul 1, 2026
Merged

tgagor merged 1 commit into
mainfrom
dependabot/uv/scripts/ultimate-sitemap-parser-1.8.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 1, 2026

Copy link
Copy Markdown
Contributor

Bumps ultimate-sitemap-parser from 1.8.0 to 1.8.1.

Release notes

Sourced from ultimate-sitemap-parser's releases.

1.8.1

Security

  • Hardened XML parsing against the Billion Laughs attack by refusing to parse XML documents containing DOCTYPE or ENTITY declarations (which should not be present in valid sitemaps) (GHSA-p5wc-9w9r-m232 by @​EQSTLab)
  • Hardened GZIP compression against decompression bomb attacks by decompressing only up to the configured maximum sitemap size (GHSA-8823-qg2x-pv9f by @​EQSTLab)
Changelog

Sourced from ultimate-sitemap-parser's changelog.

v1.8.1 (2026-06-16)

Security

  • Hardened XML parsing against the Billion Laughs attack by refusing to parse XML documents containing DOCTYPE or ENTITY declarations (which should not be present in valid sitemaps) (:ghsa:GHSA-p5wc-9w9r-m232 by :user:EQSTLab)
  • Hardened GZIP compression against decompression bomb attacks by decompressing only up to the configured maximum sitemap size (:ghsa:GHSA-8823-qg2x-pv9f by :user:EQSTLab)
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [ultimate-sitemap-parser](https://github.com/GateNLP/ultimate-sitemap-parser) from 1.8.0 to 1.8.1.
- [Release notes](https://github.com/GateNLP/ultimate-sitemap-parser/releases)
- [Changelog](https://github.com/GateNLP/ultimate-sitemap-parser/blob/main/docs/changelog.rst)
- [Commits](GateNLP/ultimate-sitemap-parser@1.8.0...1.8.1)

---
updated-dependencies:
- dependency-name: ultimate-sitemap-parser
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 1, 2026
@tgagor
tgagor merged commit 288bf38 into main Jul 1, 2026
1 check passed
@dependabot
dependabot Bot deleted the dependabot/uv/scripts/ultimate-sitemap-parser-1.8.1 branch July 1, 2026 06:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant