chore: release v10.36.7 — security: bump pygments to 2.20.0 (CVE-2026-4539)

[doobidoo]

Summary

• Bump pygments to 2.20.0 to fix CVE-2026-4539 (GHSA-5239-wwwm-4pmq): ReDoS via inefficient regex for GUID matching, transitive dependency via rich
• Version bumped: 10.36.6 → 10.36.7 in _version.py, pyproject.toml, uv.lock
• CHANGELOG, README Latest Release, and CLAUDE.md version callout updated

Test plan

• CI passes (PyPI publish triggered by tag push)
• 1,537 tests continue to pass
• No landing page update needed (PATCH release)

Ref: CVE-2026-4539, GHSA-5239-wwwm-4pmq, PR #698

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request increments the project version to 10.36.7 and updates the pygments dependency to 2.20.0 in the lock file to resolve a ReDoS vulnerability (CVE-2026-4539). Feedback suggests explicitly adding pygments>=2.20.0 to the project dependencies in pyproject.toml to ensure protection for users who do not utilize the lock file.

[gemini-code-assist]

While updating the lock file addresses the security vulnerability for environments using it, pygments is a transitive dependency (via rich). To ensure that all users—including those installing via pip without the lock file—are protected from CVE-2026-4539, consider adding an explicit version constraint for pygments (e.g., pygments>=2.20.0) to the dependencies section of pyproject.toml.