chore(deps): update dependency idna to v3.7 [security]
Metadata
Current evaluation
Renovate security bump of idna 3.6 -> 3.7 (CVE-2024-3651 DoS) merged into main via commit 2f38be1e, updating requirements.txt and the lock file; approved by 2 reviewers. Later superseded by #1938 (idna 3.10).
Resolution: closed resolved
Reason: The PR itself was merged into main as commit 2f38be1e ('chore(deps): update dependency idna to v3.7 [security] (#1644)'), pinning idna==3.7 in requirements.txt and the rye lock to remediate CVE-2024-3651.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [idna](https://togithub.com/kjd/idna) ([changelog](https://togithub.com/kjd/idna/blob/master/HISTORY.rst)) | `==3.6` -> `==3.7` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-3651](https://togithub.com/kjd/idna/security/advisories/GHSA-jjg7-2v4v-x38h)
### Impact
A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.
### Patches
The function has been refined to reject such strings without the associated resource consumption in version 3.7.
### Workarounds
Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.
### References
* https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb
---
### Release Notes
<details>
<summary>kjd/idna (idna)</summary>
### [`v3.7`](https://togithub.com/kjd/idna/compare/v3.6...v3.7)
[Compare Source](https://togithub.com/kjd/idna/compare/v3.6...v3.7)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Renovate security bump of idna 3.6 -> 3.7 (CVE-2024-3651 DoS) merged into main via commit 2f38be1e, updating requirements.txt and the lock file; approved by 2 reviewers. Later superseded by #1938 (idna 3.10). | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #1644 via commit 2f38be1e, upgrading idna 3.6 to 3.7 to address CVE-2024-3651 denial-of-service risk. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged automated dependency update upgrading idna from v3.6 to v3.7 to resolve CVE-2024-3651, a denial-of-service vulnerability in the encode function. Approved by reviewers and passed CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading idna from v3.6 to v3.7. This resolves CVE-2024-3651, a denial-of-service vulnerability in the encode function. Submitted by Renovate bot, the change passed validation and was merged. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/charmcraft#1938
(confidence 90%)
Commit afd3b394 'build(deps): update dependency idna to v3.10 (main) (#1938)' later raised the pin beyond 3.7; the constraint was eventually dropped with the uv migration/rye lock removal.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4726 chore(deps): update dependency idna to v3.7 [security] | snapcraft | merged | Renovate PR #4726 merged as commit 077ebbfff, pinning idna 3.4/3.6 -> 3.7 to fix CVE-2024-3651 (idna.encode() DoS). Later bumped to 3.10 in #5439. | |
| #545 chore(deps): update dependency idna to v3.7 | rockcraft | merged | Renovate PR #545 was merged, updating idna from 3.6 to 3.7 in commit 8432a136 after two approvals. | |
| #4789 chore(deps): update dependency jinja2 to v3.1.4 [security] | snapcraft | merged | Merged PR #4789 as commit 3869f7517, upgrading Jinja2 from 3.1.3 to 3.1.4 to remediate CVE-2024-34064. | |
| #1111 chore(deps): update dependency requests to v2.31.0 [security] - abandoned | charmcraft | closed | Renovate's requests 2.28.2 -> 2.31.0 security PR was closed empty (0 files) after autoclosing was skipped due to a modified branch; the identical CVE-2023-32681 upgrade landed via merged Dependabot PR #1110 (10d6d55a). | |
| #4902 chore(deps): update dependency zipp to v3.19.1 [security] - autoclosed | snapcraft | closed | Renovate's zipp 3.17.0/3.18.1 -> 3.19.1 security bump (CVE-2024-5569) was autoclosed because Dependabot PR #4901 merged the identical update in commit de7f1d5ad. | |
| #4727 build(deps): bump idna from 3.6 to 3.7 | snapcraft | closed | Dependabot PR bumping idna 3.6→3.7 was closed unmerged by mr-cal in favour of the Renovate security PR #4726, which updated idna and landed as commit 077ebbfff. | |
| #1938 build(deps): update dependency idna to v3.10 (main) | charmcraft | merged | Merged PR #1938 in commit afd3b394, updating idna from 3.7 to 3.10 after tests passed and maintainers approved it. | |
| #4812 chore(deps): update dependency requests to v2.32.0 [security] - autoclosed | snapcraft | closed | Renovate PR #4812 was autoclosed unmerged after 856 days; the security upgrade was later delivered by #5064 (commit ec4f9b16f), raising requests from 2.31.0 to 2.32.2. | |
| #1670 chore(deps): update dependency jinja2 to v3.1.4 [security] - autoclosed | charmcraft | closed | Renovate autoclosed unmerged Jinja2 3.1.4 PR #1670; it was superseded by merged Jinja2 3.1.5 PR #2064 (979176de). | |
| #4773 chore(deps): update dependency pip to v23 [security] - autoclosed | snapcraft | closed | Renovate PR #4773 was autoclosed without merge; Dependabot PR #4776 superseded it by merging the same pip 22.0.2→23.3 docs upgrade in commit 99387d281. |