fix: allow lower Pygments for pythons 3.7-3.8, pending LTS patches

Modified:
  • pyproject.toml (+3/-2 lines)

[gitship-generated]

Author: 1minds3t

pyproject.toml

@@ -45,8 +45,9 @@ dependencies = [
     "typer>=0.4.0",
     "rich>=10.0.0",
 
-    # Pygments - ReDoS CVE in AdlLexer, fixed in 2.20.0
-    "pygments>=2.20.0",
+    # Pygments - ReDoS CVE in AdlLexer, fixed in 2.20.0 (2.19.x is last for py37/py38)
+    "pygments>=2.20.0 ; python_version >= '3.9'",
+    "pygments>=2.19.0,<2.20.0 ; python_version < '3.9'",
 
     # werkzeug - pinned to last available per Python, CVEs unresolved due to Python constraints
     # TODO: werkzeug-lts needed for py37/py38 to backport CVE-2026-27199, CVE-2026-21860, CVE-2025-66221