chore: pygments>=2.20.0 across all packages (CVE-2026-4539)

[John Kennedy (jkennedyvz)]

Summary

Bumps pygments to >=2.20.0 across all 21 affected packages to address CVE-2026-4539 — ReDoS via inefficient GUID regex in Pygments.

• Severity: Low
• Fixed in: 2.20.0 (was 2.19.2)
• Change: Added pygments>=2.20.0 to constraint-dependencies in [tool.uv] for each package, then ran uv lock --upgrade-package pygments to regenerate lock files.

Closes Dependabot alerts #3435–#3455.

Release Note

Patch deps

Test Plan

• CI Green 🙏

[codspeed-hq]

Merging this PR will not alter performance

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

✅ 30 untouched benchmarks
⏩ 10 skipped benchmarks¹

---

_{Comparing bump/pygments-2.20.0 (a54b343) with master (90d1365)²}

Footnotes

1. 10 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on master (e207685) during the generation of this report, so 90d1365 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩