chore(deps): bump pygments from 2.19.2 to 2.20.0
What the developer wrote
Authored by dependabot[bot]
chore(deps): bump pygments from 2.19.2 to 2.20.0
Bumps [pygments](https://github.com/pygments/pygments) from 2.19.2 to 2.20.0.
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](https://github.com/pygments/pygments/compare/2.19.2...2.20.0)
---
updated-dependencies:
- dependency-name: pygments
dependency-version: 2.20.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is an automated dependency update by Dependabot that bumps the Python syntax-highlighting library Pygments from version 2.19.2 to 2.20.0 in the project's lock file. There is no indication in the commit that this fixes a security issue, and Pygments is an indirect development-only dependency used for documentation or code display, not for handling secrets, cryptography, or user input in the hardware wallet firmware itself. On its own, this change does not present a security concern.
No security action required. Treat as routine dependency maintenance. If the project tracks security advisories for indirect dependencies, monitor Pygments release notes for any future CVEs, but this commit itself does not address a known vulnerability.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit only modifies uv.lock, updating the pinned version, SHA-256 hashes, and metadata for the Pygments package. No source code, build scripts, or firmware logic is changed. Pygments is a syntax highlighter and is listed as an indirect dependency, meaning it is not a direct runtime dependency of Trezor firmware. The commit message is a routine chore(deps) bump with no security context or CVE reference.
Changed components
uv.lock (dependency lock file)Pygments 2.19.2 -> 2.20.0 (indirect development dependency)Inspect captured patch +3 / −3
diff --git a/uv.lock b/uv.lock
index c9790995..6578b010 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1427,11 +1427,11 @@ wheels = [
[[package]]
name = "pygments"
-version = "2.19.2"
+version = "2.20.0"
source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/b0/77/a5b8c569bf593b0140bde72ea885a803b82086995367bf2037de0159d924/pygments-2.19.2.tar.gz", hash = "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887", size = 4968631, upload-time = "2025-06-21T13:39:12.283Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c3/b2/bc9c9196916376152d655522fdcebac55e66de6603a76a02bca1b6414f6c/pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f", size = 4955991, upload-time = "2026-03-29T13:29:33.898Z" }
wheels = [
- { url = "https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b", size = 1225217, upload-time = "2025-06-21T13:39:07.939Z" },
+ { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" },
]
[[package]]
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.