Fix Read the Docs build (pin sphinx <9) and close the remaining mistune advisory

[aaronspring]

Description

Two related fixes to the docs toolchain.

1. Read the Docs has been failing since Sphinx 9

RTD has failed on every PR for months (e.g. #455 in July, #465 last week), and it is the only job that builds the full docs, so nothing else caught it.

Root cause: ci/doc.yml asks for sphinx >=6.0.0 and leaves Python open (python >=3.10,<3.14), so mamba resolves Python 3.13 + Sphinx 9. Importing sphinx_autosummary_accessors in docs/source/conf.py then aborts the build before any page is read:

AttributeError: type object 'Autosummary' has no attribute 'create_documenter'

Autosummary.create_documenter was removed in Sphinx 9 (released 2025-11-30); sphinx-autosummary-accessors 2025.3.1 — still the latest release — patches it at import time.

Why CI stayed green: the docs_notebooks job pins Python 3.10, and both Sphinx 8 and 9 require Python >= 3.11, so that env resolves Sphinx 7 and never sees the incompatibility.

Fix: pin sphinx >=6.0.0,<9 in ci/doc.yml, ci/dev.yml, ci/docs_notebooks.yml and the complete extra, with a comment pointing at the reason, until the extension supports Sphinx 9. uv.lock is refreshed accordingly (it carried sphinx 9.0.4/9.1.0 for Python >= 3.11).

2. mistune 3.3.0 is itself vulnerable

Dependabot's #455 only went as far as mistune 3.3.0, which is affected by GHSA-6m44-fpc8-c3rq (fixed in 3.3.3), leaving one open high-severity alert on main. Re-locking picks 3.3.4. Checking every registry-sourced package in uv.lock against the PyPI advisory data now reports no known vulnerabilities (147 packages scanned, 0 affected).

mistune is a docs-only transitive dependency (nbsphinx → nbconvert → mistune), not a runtime dependency of xskillscore.

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

Reproduced and verified locally, outside conda, in an environment resolved from .[complete]:

• Python 3.13 + Sphinx 9.0.4 (pre-fix resolution): build aborts at conf.py with the create_documenter AttributeError above.
• Python 3.13 + Sphinx 8.2.3 (post-fix resolution): python -m sphinx -T -b html … → build succeeded, 12 warnings, including the sphinx-llm pass (llms.txt, llms-full.txt, 58 context files). The warnings are pre-existing nbsphinx node-type warnings, and RTD runs with fail_on_warning: false.

Notebook execution was disabled for the local run only (-D nbsphinx_execute=never), because tabular-data.ipynb downloads the California-housing dataset and this sandbox has no egress for it; notebook execution is already covered by the docs_notebooks CI job.

The RTD check on this PR is the real verification.

Pre-Merge Checklist (final steps)

• Branched off current main; no conflicts.
• Commits are squashed on merge (the branch carries a pre-commit.ci autofix commit that reverts stray autosummary churn from a local docs build).

References

• Sphinx 9 removed Autosummary.create_documenter
• sphinx-autosummary-accessors latest release 2025.3.1 declares sphinx>=5.3 with no upper bound
• GHSA-6m44-fpc8-c3rq (mistune, fixed in 3.3.3)

🤖 Generated with Claude Code

https://claude.ai/code/session_01LxD6E7Wj42YJXQ9GxyAJLV

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.52%. Comparing base (e457985) to head (5daf506).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #467      +/-   ##
==========================================
- Coverage   94.57%   94.52%   -0.06%     
==========================================
  Files          27       27              
  Lines        2841     2847       +6     
==========================================
+ Hits         2687     2691       +4     
- Misses        154      156       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.