chore(deps): update dependency jinja2 to v3.1.4 [security] - autoclosed
Metadata
Current evaluation
Renovate autoclosed unmerged Jinja2 3.1.4 PR #1670; it was superseded by merged Jinja2 3.1.5 PR #2064 (979176de).
Resolution: closed superseded
Reason: Renovate closed #1670 without merging the 3.1.4 update. The newer Jinja2 3.1.5 security update in #2064 was merged as commit 979176de, superseding it.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [Jinja2](https://palletsprojects.com/p/jinja/) ([source](https://togithub.com/pallets/jinja), [changelog](https://jinja.palletsprojects.com/changes/)) | `==3.1.3` -> `==3.1.4` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-34064](https://togithub.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj)
The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.
Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.
---
### Release Notes
<details>
<summary>pallets/jinja (Jinja2)</summary>
### [`v3.1.4`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-314)
[Compare Source](https://togithub.com/pallets/jinja/compare/3.1.3...3.1.4)
Released 2024-05-05
- The `xmlattr` filter does not allow keys with `/` solidus, `>`
greater-than sign, or `=` equals sign, in addition to disallowing spaces.
Regardless of any validation done by Jinja, user input should never be used
as keys to this filter, or must be separately validated first.
:ghsa:`h75v-3vvj-5mfj`
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zNDAuMTAiLCJ1cGRhdGVkSW5WZXIiOiIzNy4zNDAuMTAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Renovate autoclosed unmerged Jinja2 3.1.4 PR #1670; it was superseded by merged Jinja2 3.1.5 PR #2064 (979176de). | |
| stealth/space-bunny-alpha | — | closed superseded | Jinja2 3.1.4 update was autoclosed unmerged, then landed through broader dependency update #1675 (commit d52e064e). | |
| stealth/space-bunny-alpha | — | closed stale | Renovate autoclosed charmcraft#1670 without merging its Jinja2 3.1.4 security update, despite two approvals and no reported CI checks. | |
| stealth/space-bunny-alpha | — | closed stale | Jinja2 3.1.4 security update was autoclosed without merging; the project later updated to 3.1.5 in commit 979176de. | |
| qwen/qwen3.6-35b-a3b | — | — | Renovate autoclosed the Jinja2 v3.1.4 security update without merging. The branch became obsolete and was likely superseded by another dependency update or abandoned. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Automatically merged and autoclosed by Renovate to update Jinja2 to v3.1.4, resolving CVE-2024-34064. The security dependency update was processed via automerge. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/charmcraft#2064
(confidence 98%)
The later Jinja2 3.1.5 security update merged via commit 979176de.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4789 chore(deps): update dependency jinja2 to v3.1.4 [security] | snapcraft | merged | Merged PR #4789 as commit 3869f7517, upgrading Jinja2 from 3.1.3 to 3.1.4 to remediate CVE-2024-34064. | |
| #2066 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/3.2) - autoclosed | charmcraft | closed | Renovate autoclosed #2066 unmerged; the equivalent Jinja2 3.1.5 security update landed on main via #2064 (979176de). | |
| #275 chore(autogen): bump jinja2 | craft-store | merged | Merged PR #275 (commit c9378f7) bumped jinja2 to 3.1.6 in uv.lock to resolve an OSV advisory. Unrelated minimum-deps test failure fixed separately in #276. | |
| #5191 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Jinja2 3.1.5 hotfix/7.5 PR #5191 was autoclosed unmerged; the equivalent main-branch security update merged via #5190 in commit 98511dc44. | |
| #5307 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Autoclosed unmerged as the hotfix/7.5 update aged out; Jinja2 3.1.6 later reached main through merged PR #5312 (8bc044979). | |
| #2209 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/3.3) - autoclosed | charmcraft | closed | Renovate's Jinja2 3.1.6 hotfix/3.3 update was autoclosed unmerged; dependency updates were later consolidated and merged in #2223 (e148af23). | |
| #678 chore(autogen): bump jinja2 | craft-application | merged | Merged PR #678 updated Jinja2 to 3.1.6 to address an OSV; resolving commit: 2832f51f. | |
| #5306 build(deps): update dependency jinja2 to v3.1.6 [security] (main) - autoclosed | snapcraft | closed | Autoclosed unmerged after the Jinja2 3.1.6 security update landed through #5305; #5312 separately updated docs requirements. | |
| #5192 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/8.5) - autoclosed | snapcraft | closed | Renovate autoclosed the unmerged hotfix/8.5 Jinja2 3.1.5 update; the equivalent main-branch update merged in #5190 at 98511dc44. | |
| #2207 build(deps): update dependency jinja2 to v3.1.6 [security] (main) - autoclosed | charmcraft | closed | Jinja2 3.1.6 update was autoclosed unmerged; the same pin landed through #2223 in commit e148af23. |