Python-jobspy 1.1.82 pins "markdownify<0.14.0,>=0.13.1" markdownify 0.14.0 contains the fix for CVE-2025-46656 (arbitrary JavaScript execution via crafted HTML input). Any project that depends on both python-jobspy and a security-conscious pinning of "markdownify>=0.14.1" cannot be installed; pip cannot satisfy both constraints simultaneously and enters unbounded backtracking across alljobspy versions until it fails entirely.
Requested change: Relax the upper bound to "markdownify>=0.13.1" (or ">=0.14.0" to require the CVE fix), removing the "<0.14.0" cap. Markdownify 0.14.x does not appear to contain any breaking API changes that would affect jobspy's usage of it (it uses only basic "markdownify()" calls). If there is a specific compatibility issue with 0.14.x please document it so downstream projects can work around it.
Impact: Any project combining python-jobspy with "markdownify>=0.14.1" (required for the CVE fix) hits this conflict. Pip backtracking eventually falls to versions requiring numpy==1.24.x which has no pre-built wheels for Python 3.12+, causing the install to fail with a C compiler error on most users's machines.
Python-jobspy 1.1.82 pins "markdownify<0.14.0,>=0.13.1" markdownify 0.14.0 contains the fix for CVE-2025-46656 (arbitrary JavaScript execution via crafted HTML input). Any project that depends on both python-jobspy and a security-conscious pinning of "markdownify>=0.14.1" cannot be installed; pip cannot satisfy both constraints simultaneously and enters unbounded backtracking across alljobspy versions until it fails entirely.
Requested change: Relax the upper bound to "markdownify>=0.13.1" (or ">=0.14.0" to require the CVE fix), removing the "<0.14.0" cap. Markdownify 0.14.x does not appear to contain any breaking API changes that would affect jobspy's usage of it (it uses only basic "markdownify()" calls). If there is a specific compatibility issue with 0.14.x please document it so downstream projects can work around it.
Impact: Any project combining python-jobspy with "markdownify>=0.14.1" (required for the CVE fix) hits this conflict. Pip backtracking eventually falls to versions requiring numpy==1.24.x which has no pre-built wheels for Python 3.12+, causing the install to fail with a C compiler error on most users's machines.