Bump mistune from 3.3.0 to 3.3.3 in /python

[dependabot]

Bumps mistune from 3.3.0 to 3.3.3.

Release notes

Sourced from mistune's releases.

v3.3.3

   🐞 Bug Fixes

• Set prev token in render_list_item and add block_text to ignore_blocks  -  by @​gaoflow in lepture/mistune#456 (0799e)
• Improve nested bracket link input  -  by @​lepture (fe02f)
• Escape literal emphasis markers in MarkdownRenderer  -  by @​Sanjays2402 (b0429)
• Use SAFE_PROTOCOLS instead of HARMFUL_PROTOCOLS  -  by @​lepture (4009f)
• Add max_emphasis_depth  -  by @​lepture (0938f)
• Add image max depth  -  by @​lepture (cca5e)
• inline: Use original run length in emphasis multiple-of-3 rule  -  by @​greymoth-jp and Claude Opus 4.8 (1M context) (2d26b)

   🏎 Performance

• Improve link label parsing performance  -  by @​lepture (e001d)
• Improve performance for math and formatting plugins  -  by @​lepture (c2228)
• Improve for footnotes, ruby and spoiler  -  by @​lepture (ae7e9)

    View changes on GitHub

v3.3.2

   🐞 Bug Fixes

• Try to support python 3.8  -  by @​lepture (c9f1a)
• Resolve mypy issues for python 3.8 and 3.9+  -  by @​lepture (29b70)

    View changes on GitHub

v3.3.1

   🐞 Bug Fixes

• abbr: Update process_text method in abrr, adding parse_emphasis parameter  -  by @​lepture (ae850)
• directive: Use correct file path for include directive  -  by @​lepture (18c21)

    View changes on GitHub

Changelog

Sourced from mistune's changelog.

Version 3.3.3

Released on Jul 9, 2026

• Limit deeply nested emphasis and image parsing to avoid RecursionError.
• Fix repeated link suffix and unclosed formatting marker performance issues.
• Fix unclosed inline spoiler performance issues.
• Avoid recursive parsing for adjacent ruby tokens.
• Speed up footnote reference indexing.

Version 3.3.2

Released on Jun 23, 2026

• Fix Python 3.8 import compatibility in the inline parser.
• Fix mypy compatibility for list parsing on Python 3.8 and 3.9+.

Version 3.3.1

Released on Jun 22, 2026

• Fix abbr plugin compatibility with escaped inline text.
• Normalize included Markdown line endings before parsing directives.

Commits

• 060f73a chore: release 3.3.3
• ae7e9d5 perf: improve for footnotes, ruby and spoiler
• c2228a2 perf: improve performance for math and formatting plugins
• e001d51 perf: improve link label parsing performance
• cca5ee6 fix: add image max depth
• 0938fb7 fix: add max_emphasis_depth
• 9946c92 tests: update dealine time for pypy
• 4009f67 fix: use SAFE_PROTOCOLS instead of HARMFUL_PROTOCOLS
• 3025549 Merge pull request #462 from Sanjays2402/fix/markdown-renderer-escape-emphasis
• b042996 fix: escape literal emphasis markers in MarkdownRenderer
• Additional commits viewable in compare view

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 6f26642490b0
Model: claude-opus-4.8

Overview

This Dependabot PR bumps the transitively-pinned mistune package from 3.3.0 to 3.3.3 in python/uv.lock; the only meaningful change is a single version/hash update to the mistune block, and both the new sdist and wheel SHA256 hashes were verified byte-for-byte against the authentic upstream PyPI artifacts. The remaining ~829/829-line churn is a whole-file re-resolution that normalizes environment markers (dropping the sys_platform == 'darwin' or 'linux' or 'win32' disjunctions and collapsing compound python_full_version markers); this is provably semantically equivalent because the top-level supported-markers gate (python/uv.lock:24-28) and pyproject.toml [tool.uv].environments are unchanged, package parity is 328/328, and no other package version changed. uv lock --locked resolves the committed lock cleanly (exit 0). mistune is a dev-only transitive dependency via nbconvert, not imported in semantic_kernel source, so there is no untrusted-input reachability. The only residual concerns are process/reproducibility (a full re-resolve inside a one-line bump, and a lock format newer than the CI-pinned uv), neither of which demonstrates a concrete runtime, compatibility, or contract failure; both are captured as non-blocking Recommendations/Follow-up.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.