chore: combine canonical security fixes on strict-floor lock base

CHANGELOG.md

@@ -23,6 +23,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - MinerU subprocess argv 생성 시 `-`로 시작하는 option-like 인자를 거부하여 argument injection 위험을 낮춤
 - API 에러 응답 생성 시 내부 예외 체인을 억제하여 의존성 오류나 내부 경로가 노출될 가능성을 줄임
 - API 응답 미들웨어에 `Cache-Control: no-store, max-age=0` 헤더를 추가하여 민감한 파싱 데이터의 브라우저 및 중간 캐싱을 방지
+- `uv.lock`의 의존성을 재잠금하여 실제 `pip-audit`/`trivy-fs` CVE를 제거: 런타임 경로의 `pillow` 12.2.0→12.3.0 (PYSEC-2026-3451/3452/3453/3454/3493/3494/3495/3496, 이미지 파서 취약점 8건), `pypdf` 6.13.3→6.14.2 (CVE-2026-59935/59936/59937/59938, PDF 파싱 경로), `click` 8.3.2→8.4.2 (PYSEC-2026-2132) — 모두 스캔 PDF/이미지 파싱 런타임에 직접 관련되며 `pyproject.toml` 기존 범위 내 해석. 빌드 도구 `setuptools` 81.0.0→83.0.0 (CVE-2026-59890). 문서 툴체인의 `pymdown-extensions` 10.21.3→11.0.1 (CVE-2026-61632, MEDIUM)은 `mkdocs-material` 9.6.x의 `pymdown-extensions~=10.2`(`<11`) 상한 때문에 막혀 있었으므로, docs extra 핀을 `mkdocs-material>=9.7,<9.8`로 올려(9.7.x는 상한을 `>=10.2`로 완화) 해소함. `uv run mkdocs build --strict` 통과 확인. 조치 후 전체 잠금(런타임+extras) `pip-audit`: 취약점 0건.
 
 ### Performance
 - `newsdom_api.dom_builder._html_safe_text` 함수에 early return과 타입 체크를 도입하여 불필요한 `str()` 캐스팅을 제거함으로써 처리 속도를 개선했습니다.

CONTRIBUTING.md

@@ -39,11 +39,16 @@ The GitHub Pages workflow installs documentation tooling from
 sync all extras so the docs build does not drop the test toolchain
 from the active environment.
 
-The supported docs toolchain stays on the MkDocs 1.x line for now.
-Keep `mkdocs<2.0` and `mkdocs-material<9.7` in place until the
-upstream Material team publishes a workable migration path or this
-repository validates a replacement docs stack. `uv.lock` is the source
-of truth for the currently supported docs build.
+The supported docs core stays on the MkDocs 1.x line for now.
+Keep `mkdocs<2.0` in place until the upstream Material team publishes
+a workable migration path or this repository validates a replacement
+docs stack. `mkdocs-material` tracks the `>=9.7,<9.8` line: 9.6.x pinned
+`pymdown-extensions~=10.2` (`<11`), which blocked the fix for
+CVE-2026-61632, so the theme is held at 9.7.x to pull
+`pymdown-extensions>=11` and clear that advisory. The 9.7 line prints an
+informational MkDocs 2.0 banner on build but still builds cleanly under
+`--strict` on the MkDocs 1.x core. `uv.lock` is the source of truth for
+the currently supported docs build.
 
 ```bash
 uv sync --frozen --all-extras

pyproject.toml

@@ -31,7 +31,7 @@ dev = [
 ]
 docs = [
     "mkdocs>=1.6,<2.0",
-    "mkdocs-material>=9.6,<9.7",
+    "mkdocs-material>=9.7,<9.8",
 ]
 fuzz = [
   "atheris==3.0.0 ; platform_system == 'Linux' and python_version >= '3.11'",

tests/test_project_metadata.py

@@ -113,9 +113,12 @@ def test_uv_lock_tracks_project_version() -> None:
     assert lock_version.group(1) == pyproject_version
 
 
-def test_docs_theme_range_stays_below_warning_release():
+def test_docs_theme_range_tracks_pymdownx_cve_fix():
     text = Path("pyproject.toml").read_text(encoding="utf-8")
-    assert '"mkdocs-material>=9.6,<9.7"' in text
+    # 9.6.x capped pymdown-extensions~=10.2 (<11), blocking the CVE-2026-61632
+    # fix; the theme is held at the 9.7.x line so the docs build can pull
+    # pymdown-extensions>=11. The MkDocs core stays on the 1.x line.
+    assert '"mkdocs-material>=9.7,<9.8"' in text
 
 
 def test_docs_core_range_stays_below_mkdocs_two():
@@ -128,7 +131,8 @@ def test_contributing_documents_docs_toolchain_hold():
     expected_phrases = [
         "MkDocs 1.x",
         "mkdocs<2.0",
-        "mkdocs-material<9.7",
+        "mkdocs-material",
+        "CVE-2026-61632",
         "uv.lock",
         "migration path",
     ]