chore(deps): bump mako from 1.3.10 to 1.3.11
What the developer wrote
Authored by dependabot[bot]
chore(deps): bump mako from 1.3.10 to 1.3.11
Bumps [mako](https://github.com/sqlalchemy/mako) from 1.3.10 to 1.3.11.
- [Release notes](https://github.com/sqlalchemy/mako/releases)
- [Changelog](https://github.com/sqlalchemy/mako/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/mako/commits)
---
updated-dependencies:
- dependency-name: mako
dependency-version: 1.3.11
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine automated update by Dependabot that raises the minimum allowed version of a Python template library called Mako from 1.0.7 to 1.3.11. The change only affects build/development dependency files and does not alter Trezor firmware source code. There is no direct evidence in the commit that this fixes a security problem, but keeping dependencies current is generally good maintenance practice.
Treat as routine maintenance. Review Mako 1.3.11 release notes and changelog for any security advisories before merging, but no urgent security action is indicated by this commit alone.
Security signals we found
Dependency version bump of a build-time Python package
No CVE, advisory, or security rationale mentioned in commit message
No code changes to firmware, crypto, or device-interfaces
Mako 1.3.11 release is not referenced as a security fix in the supplied materials
Evidence from the diff
The commit modifies pyproject.toml and uv.lock to bump the direct production dependency mako from >=1.0.7,<2 to >=1.3.11,<2 and pins the resolved version to 1.3.11. Mako is a Python templating engine used in the Trezor build/development toolchain. The diff contains only version metadata and lock-file hash/url changes; no firmware code, no template logic, and no vulnerability description are present.
Changed components
pyproject.toml dependency specificationuv.lock lockfileMako Python templating library (development/build dependency)Inspect captured patch +5 / −5
diff --git a/pyproject.toml b/pyproject.toml
index 337d3e9b..c9d9b90b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -28,7 +28,7 @@ dependencies = [
"isort>=5,<6",
"flake8>=7",
"black>=24.2",
- "mako>=1.0.7,<2",
+ "mako>=1.3.11,<2",
"munch>=4,<5",
"autoflake",
"flake8-requirements>=2.1.0",
diff --git a/uv.lock b/uv.lock
index 8815775a..f142f43e 100644
--- a/uv.lock
+++ b/uv.lock
@@ -982,14 +982,14 @@ wheels = [
[[package]]
name = "mako"
-version = "1.3.10"
+version = "1.3.11"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "markupsafe" },
]
-sdist = { url = "https://files.pythonhosted.org/packages/9e/38/bd5b78a920a64d708fe6bc8e0a2c075e1389d53bef8413725c63ba041535/mako-1.3.10.tar.gz", hash = "sha256:99579a6f39583fa7e5630a28c3c1f440e4e97a414b80372649c0ce338da2ea28", size = 392474, upload-time = "2025-04-10T12:44:31.16Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/59/8a/805404d0c0b9f3d7a326475ca008db57aea9c5c9f2e1e39ed0faa335571c/mako-1.3.11.tar.gz", hash = "sha256:071eb4ab4c5010443152255d77db7faa6ce5916f35226eb02dc34479b6858069", size = 399811, upload-time = "2026-04-14T20:19:51.493Z" }
wheels = [
- { url = "https://files.pythonhosted.org/packages/87/fb/99f81ac72ae23375f22b7afdb7642aba97c00a713c217124420147681a2f/mako-1.3.10-py3-none-any.whl", hash = "sha256:baef24a52fc4fc514a0887ac600f9f1cff3d82c61d4d700a1fa84d597b88db59", size = 78509, upload-time = "2025-04-10T12:50:53.297Z" },
+ { url = "https://files.pythonhosted.org/packages/68/a5/19d7aaa7e433713ffe881df33705925a196afb9532efc8475d26593921a6/mako-1.3.11-py3-none-any.whl", hash = "sha256:e372c6e333cf004aa736a15f425087ec977e1fcbd2966aae7f17c8dc1da27a77", size = 78503, upload-time = "2026-04-14T20:19:53.233Z" },
]
[[package]]
@@ -2243,7 +2243,7 @@ requires-dist = [
{ name = "inotify" },
{ name = "intelhex", specifier = "==2.3.0" },
{ name = "isort", specifier = ">=5,<6" },
- { name = "mako", specifier = ">=1.0.7,<2" },
+ { name = "mako", specifier = ">=1.3.11,<2" },
{ name = "mnemonic", specifier = ">=0.21,<0.22" },
{ name = "munch", specifier = ">=4,<5" },
{ name = "nanopb", specifier = ">=0.4.3,<0.5" },
Why this scored 13/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.