Update dependency mkdocs-material to v9.7.7 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mkdocs-material (changelog)	9.7.6 → 9.7.7

---

Material for MkDocs: DOM XSS in search suggestions via query parameter

CVE-2026-73295 / GHSA-xvg9-69gf-fjrf

More information

Details

Impact

Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction.

Patches

The issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later.

Workarounds

Sites unable to upgrade should disable the search.suggest feature.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

• https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf
• https://nvd.nist.gov/vuln/detail/CVE-2026-73295
• https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25
• https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7
• https://github.com/advisories/GHSA-xvg9-69gf-fjrf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

squidfunk/mkdocs-material (mkdocs-material)

v9.7.7: mkdocs-material-9.7.7

Compare Source

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. After this date, the project will remain available on PyPI and GitHub, but no further maintenance is planned except in exceptional circumstances.

For users looking for a long-term, actively developed successor, we're building Zensical – a next-generation static site generator designed for technical documentation. If you're planning a new documentation project or evaluating your long-term options, we invite you to take a look.

Organizations requiring support beyond this date are welcome to get in touch to discuss available options.

Read the full announcement on our blog

Changes

• Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.