Update dependency mkdocs-material to v9.7.7 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mkdocs-material (changelog)	9.7.6 → 9.7.7

---

Material for MkDocs: DOM XSS in search suggestions via query parameter

CVE-2026-73295 / GHSA-xvg9-69gf-fjrf

More information

Details

Impact

Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction.

Patches

The issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later.

Workarounds

Sites unable to upgrade should disable the search.suggest feature.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

• https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf
• https://nvd.nist.gov/vuln/detail/CVE-2026-73295
• https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25
• https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7
• https://github.com/advisories/GHSA-xvg9-69gf-fjrf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

squidfunk/mkdocs-material (mkdocs-material)

v9.7.7: mkdocs-material-9.7.7

Compare Source

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates.

The path forward is Zensical, our next-generation static site generator built from first principles. If you’re planning a new documentation project or thinking about your long-term setup, we encourage you to start exploring Zensical.

Organizations requiring support beyond this date can get in touch to discuss options.

Read the full announcement on our blog

Changes

• Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

🟢 Coverage ∅ diff coverage

Metric	Results
Coverage variation	Report missing for 02ba8581
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (02ba858)	Report Missing	Report Missing	Report Missing
Head commit (70f9a19)	6491	6491	100.00%

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#161)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

¹ Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}