Skip to content

Fix a CVE by using myst_parser instead of m2r2#153

Merged
dixonjoel merged 2 commits into
mainfrom
users/jdixon/fix-mistune-cve
Jun 24, 2026
Merged

Fix a CVE by using myst_parser instead of m2r2#153
dixonjoel merged 2 commits into
mainfrom
users/jdixon/fix-mistune-cve

Conversation

@dixonjoel

@dixonjoel dixonjoel commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

What does this Pull Request accomplish?

Fix
https://github.com/ni/datastore-python/security/dependabot/35
https://github.com/ni/datastore-python/security/dependabot/37
https://github.com/ni/datastore-python/security/dependabot/38

m2r2, which we were using for Sphinx docs build, pins mistune at 0.8.4, which has a CVE. We can use myst_parser instead.

Why should this Pull Request be merged?

CRA - Addressing CVEs

What testing has been done?

Built the docs locally and inspected the .md files to ensure the markdown files are still shown correctly.

Copilot AI review requested due to automatic review settings June 23, 2026 21:23

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the documentation build toolchain to address CVEs caused by m2r2 pinning mistune==0.8.4, switching the Sphinx Markdown integration over to myst-parser and updating the lockfile accordingly.

Changes:

  • Replace m2r2 with myst-parser in the docs dependency group.
  • Update Sphinx configuration to use the myst_parser extension.
  • Adjust one Markdown reference page formatting/anchors for MyST/Sphinx compatibility and refresh the dependency lockfile.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File Description
pyproject.toml Swaps docs dependency from m2r2 to myst-parser to eliminate the vulnerable mistune pin.
poetry.lock Updates resolved dependency graph (including newer mistune) consistent with the switch to myst-parser.
docs/conf.py Replaces the Sphinx extension m2r2 with myst_parser.
docs/reference/using-measurement-data-services.md Minor formatting tweaks and adds explicit section labels compatible with MyST/Sphinx linking.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@dixonjoel dixonjoel merged commit 5e10641 into main Jun 24, 2026
30 checks passed
@dixonjoel dixonjoel deleted the users/jdixon/fix-mistune-cve branch June 24, 2026 15:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants