chore(deps): update dependency jinja2 to v3.1.4 [security] - autoclosed
Metadata
Current evaluation
Renovate autoclosed the Jinja2 v3.1.4 security update without merging. The branch became obsolete and was likely superseded by another dependency update or abandoned.
Suggested action: —
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [Jinja2](https://palletsprojects.com/p/jinja/) ([source](https://togithub.com/pallets/jinja), [changelog](https://jinja.palletsprojects.com/changes/)) | `==3.1.3` -> `==3.1.4` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-34064](https://togithub.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj)
The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.
Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.
---
### Release Notes
<details>
<summary>pallets/jinja (Jinja2)</summary>
### [`v3.1.4`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-314)
[Compare Source](https://togithub.com/pallets/jinja/compare/3.1.3...3.1.4)
Released 2024-05-05
- The `xmlattr` filter does not allow keys with `/` solidus, `>`
greater-than sign, or `=` equals sign, in addition to disallowing spaces.
Regardless of any validation done by Jinja, user input should never be used
as keys to this filter, or must be separately validated first.
:ghsa:`h75v-3vvj-5mfj`
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zNDAuMTAiLCJ1cGRhdGVkSW5WZXIiOiIzNy4zNDAuMTAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Renovate autoclosed the Jinja2 v3.1.4 security update without merging. The branch became obsolete and was likely superseded by another dependency update or abandoned. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Automatically merged and autoclosed by Renovate to update Jinja2 to v3.1.4, resolving CVE-2024-34064. The security dependency update was processed via automerge. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Automated PR to update Jinja2 to v3.1.4 for CVE-2024-34064 was autoclosed. Renovate automatically closed the request, indicating the dependency update was already applied or superseded. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4789 chore(deps): update dependency jinja2 to v3.1.4 [security] | snapcraft | merged | Merged automated dependency update upgrading Jinja2 from 3.1.3 to 3.1.4 to patch CVE-2024-34064, addressing an XSS vulnerability in the xmlattr filter. Approved and auto-merged by Renovate. | |
| #5306 build(deps): update dependency jinja2 to v3.1.6 [security] (main) - autoclosed | snapcraft | closed | Renovate PR updating Jinja2 to v3.1.6 to fix CVE-2025-27516 passed CI and received approval but was autoclosed without merging, likely superseded by a newer dependency update. | |
| #2065 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | The Renovate-generated pull request updating Jinja2 to v3.1.5 for security patches was automatically closed without merging. The dependency update was abandoned by the system. | |
| #5192 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/8.5) - autoclosed | snapcraft | closed | Automated PR updating Jinja2 to v3.1.5 for security vulnerabilities was approved and passed CI but was autoclosed by Renovate, indicating it was superseded by a newer update or became stale. | |
| #2209 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/3.3) - autoclosed | charmcraft | closed | Renovate bot dependency update for jinja2 to v3.1.6 was autoclosed without review or merging. The security patch was abandoned. | |
| #5309 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/8.7) - autoclosed | snapcraft | closed | The Jinja2 v3.1.6 security update was autoclosed without review, CI checks, or merge. Renovate automatically closed the branch. | |
| #2066 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/3.2) - autoclosed | charmcraft | closed | Renovate bot pull request updating jinja2 to v3.1.5 for security fixes was automatically closed without review or merge. The update was abandoned by the bot. | |
| #5191 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Automatically closed without merging. The Renovate PR updated Jinja2 to v3.1.5 to patch CVE-2024-56326 and CVE-2024-56201. Despite approvals and passing CI, the branch was autoclosed. | |
| #2207 build(deps): update dependency jinja2 to v3.1.6 [security] (main) - autoclosed | charmcraft | closed | Renovate's jinja2 v3.1.6 security update was autoclosed without merging. The branch was likely superseded or expired, leaving the CVE-2025-27516 fix unapplied. | |
| #2208 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Automatically closed without merging. The dependency update to jinja2 v3.1.6 for CVE-2025-27516 was superseded or abandoned before review. |