chore(deps): update dependency idna to v3.7 [security]
Metadata
Current evaluation
Merged automated dependency update upgrading idna from v3.6 to v3.7 to resolve CVE-2024-3651, a denial-of-service vulnerability in the encode function. Approved by reviewers and passed CI checks.
Suggested action: —
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [idna](https://togithub.com/kjd/idna) ([changelog](https://togithub.com/kjd/idna/blob/master/HISTORY.rst)) | `==3.6` -> `==3.7` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-3651](https://togithub.com/kjd/idna/security/advisories/GHSA-jjg7-2v4v-x38h)
### Impact
A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.
### Patches
The function has been refined to reject such strings without the associated resource consumption in version 3.7.
### Workarounds
Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.
### References
* https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb
---
### Release Notes
<details>
<summary>kjd/idna (idna)</summary>
### [`v3.7`](https://togithub.com/kjd/idna/compare/v3.6...v3.7)
[Compare Source](https://togithub.com/kjd/idna/compare/v3.6...v3.7)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged automated dependency update upgrading idna from v3.6 to v3.7 to resolve CVE-2024-3651, a denial-of-service vulnerability in the encode function. Approved by reviewers and passed CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading idna from v3.6 to v3.7. This resolves CVE-2024-3651, a denial-of-service vulnerability in the encode function. Submitted by Renovate bot, the change passed validation and was merged. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading idna from v3.6 to v3.7 to patch CVE-2024-3651, a denial-of-service vulnerability in the encode function. Applied via Renovate bot. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4726 chore(deps): update dependency idna to v3.7 [security] | snapcraft | merged | Merged automated dependency update upgrading idna to v3.7 from v3.6 and v3.4. Resolves CVE-2024-3651 denial-of-service vulnerability in idna.encode(). Approved by reviewers, passed CI, and merged to main. | |
| #545 chore(deps): update dependency idna to v3.7 | rockcraft | merged | Merged automated dependency update upgrading idna from v3.6 to v3.7. Approved by two reviewers, passed CI checks, and merged into the main branch. | |
| #1724 chore(deps): update dependency zipp to v3.19.1 [security] | charmcraft | merged | Merged a security update upgrading zipp from 3.18.1 to 3.19.1 to resolve CVE-2024-5569. Approved by two reviewers, passed CI checks, and merged into the main branch. | |
| #4789 chore(deps): update dependency jinja2 to v3.1.4 [security] | snapcraft | merged | Merged automated dependency update upgrading Jinja2 from 3.1.3 to 3.1.4 to patch CVE-2024-34064, addressing an XSS vulnerability in the xmlattr filter. Approved and auto-merged by Renovate. | |
| #1181 chore(deps): update dependency certifi to v2023.7.22 [security] - autoclosed | charmcraft | closed | Renovate bot PR updating certifi to v2023.7.22 for CVE-2023-37920 was autoclosed due to inactivity. Automerge was disabled by configuration, and the request received no reviews or CI checks before automatic closure. | |
| #976 chore(deps): update dependency charset-normalizer to v3 | charmcraft | merged | Merged automated dependency update from charset-normalizer v2.1.1 to v3.0.1. Approved by one reviewer, passed CI checks, and modified two files with a two-line change. | |
| #1720 chore(deps): update dependency certifi to v2024.7.4 [security] | charmcraft | merged | Merged a security update upgrading certifi from v2024.6.2 to v2024.7.4 to address CVE-2024-39689. Approved by two reviewers, passed CI checks, and merged into main. | |
| #4902 chore(deps): update dependency zipp to v3.19.1 [security] - autoclosed | snapcraft | closed | Renovate bot PR updating zipp to v3.19.1 for CVE-2024-5569 was autoclosed without merging. The security update was not applied via this pull request. | |
| #4812 chore(deps): update dependency requests to v2.32.0 [security] - autoclosed | snapcraft | closed | Renovate pull request updating requests to v2.32.0 to address CVE-2024-35195 was autoclosed without merging. The dependency update was likely handled separately or the branch expired. | |
| #1289 chore(deps): update dependencies | charmcraft | merged | Approved by two reviewers and merged, the dependency update modified three files with 45 additions and 34 deletions to refresh project packages. |