chore(deps): update dependency zipp to v3.19.1 [security]
Metadata
Current evaluation
Merged a security update upgrading zipp from 3.18.1 to 3.19.1 to resolve CVE-2024-5569. Approved by two reviewers, passed CI checks, and merged into the main branch.
Suggested action: —
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [zipp](https://togithub.com/jaraco/zipp) | `==3.18.1` -> `==3.19.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-5569](https://nvd.nist.gov/vuln/detail/CVE-2024-5569)
A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.
---
### Release Notes
<details>
<summary>jaraco/zipp (zipp)</summary>
### [`v3.19.1`](https://togithub.com/jaraco/zipp/compare/v3.19.0...v3.19.1)
[Compare Source](https://togithub.com/jaraco/zipp/compare/v3.19.0...v3.19.1)
### [`v3.19.0`](https://togithub.com/jaraco/zipp/compare/v3.18.2...v3.19.0)
[Compare Source](https://togithub.com/jaraco/zipp/compare/v3.18.2...v3.19.0)
### [`v3.18.2`](https://togithub.com/jaraco/zipp/compare/v3.18.1...v3.18.2)
[Compare Source](https://togithub.com/jaraco/zipp/compare/v3.18.1...v3.18.2)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MjUuMSIsInVwZGF0ZWRJblZlciI6IjM3LjQyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged a security update upgrading zipp from 3.18.1 to 3.19.1 to resolve CVE-2024-5569. Approved by two reviewers, passed CI checks, and merged into the main branch. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading zipp from 3.18.1 to 3.19.1 to resolve CVE-2024-5569, a denial-of-service vulnerability. The security patch was successfully applied and merged by Renovate bot. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update via Renovate, upgrading zipp from 3.18.1 to 3.19.1 to patch CVE-2024-5569, a denial-of-service vulnerability triggered by crafted zip files. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1016 chore(deps): update dependency zipp to v3.15.0 | charmcraft | merged | Merged dependency update for zipp from v3.11.0 to v3.15.0. Approved by two reviewers, passed CI checks, and successfully merged. | |
| #4902 chore(deps): update dependency zipp to v3.19.1 [security] - autoclosed | snapcraft | closed | Renovate bot PR updating zipp to v3.19.1 for CVE-2024-5569 was autoclosed without merging. The security update was not applied via this pull request. | |
| #1645 chore(deps): update dependency zipp to v3.18.1 | charmcraft | merged | Merged automated dependency update for zipp from v3.18.0 to v3.18.1. The change was generated by Renovate, approved by two reviewers, passed CI checks, and auto-merged into the main branch. | |
| #4726 chore(deps): update dependency idna to v3.7 [security] | snapcraft | merged | Merged automated dependency update upgrading idna to v3.7 from v3.6 and v3.4. Resolves CVE-2024-3651 denial-of-service vulnerability in idna.encode(). Approved by reviewers, passed CI, and merged to main. | |
| #1644 chore(deps): update dependency idna to v3.7 [security] | charmcraft | merged | Merged automated dependency update upgrading idna from v3.6 to v3.7 to resolve CVE-2024-3651, a denial-of-service vulnerability in the encode function. Approved by reviewers and passed CI checks. | |
| #545 chore(deps): update dependency idna to v3.7 | rockcraft | merged | Merged automated dependency update upgrading idna from v3.6 to v3.7. Approved by two reviewers, passed CI checks, and merged into the main branch. | |
| #1289 chore(deps): update dependencies | charmcraft | merged | Approved by two reviewers and merged, the dependency update modified three files with 45 additions and 34 deletions to refresh project packages. | |
| #1353 chore(deps): update all dependencies | charmcraft | merged | Merged dependency update across three files, changing 23 additions and 24 deletions. Approved by two reviewers with zero unresolved comments. Changes integrated successfully. | |
| #1172 chore(deps): update dependency platformdirs to v3.9.1 | charmcraft | merged | Merged a dependency update that upgraded platformdirs from v3.2.0 to v3.9.1. The pull request was approved by a reviewer, passed CI checks, and modified two files with minimal changes. | |
| #1648 chore(deps): update dependency referencing to v0.34.0 | charmcraft | merged | Merged automated dependency update for referencing from v0.33.0 to v0.34.0. Approved by three reviewers, passed CI checks, and applied with minimal changes across two files. |