build(deps): update dependency jinja2 to v3.1.6 [security] (main) - autoclosed
Metadata
Current evaluation
Jinja2 3.1.6 update was autoclosed unmerged; the same pin landed through #2223 in commit e148af23.
Resolution: closed superseded
Reason: PR #2207 was auto-closed without merge, CI, or review. Commit e148af23 in PR #2223 updated dependencies to Jinja2 3.1.6, superseding this PR.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [jinja2](https://redirect.github.com/pallets/jinja) ([changelog](https://jinja.palletsprojects.com/changes/)) | `==3.1.5` -> `==3.1.6` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2025-27516](https://redirect.github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7)
An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.
To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.
Jinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to use the `|attr` filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment's attribute lookup.
---
### Release Notes
<details>
<summary>pallets/jinja (jinja2)</summary>
### [`v3.1.6`](https://redirect.github.com/pallets/jinja/releases/tag/3.1.6)
[Compare Source](https://redirect.github.com/pallets/jinja/compare/3.1.5...3.1.6)
This is the Jinja 3.1.6 security release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/Jinja2/3.1.6/
Changes: https://jinja.palletsprojects.com/en/stable/changes/#version-3-1-6
- The `|attr` filter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xODUuNCIsInVwZGF0ZWRJblZlciI6IjM5LjE4NS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Jinja2 3.1.6 update was autoclosed unmerged; the same pin landed through #2223 in commit e148af23. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate’s Jinja2 3.1.5→3.1.6 security update for main was auto-closed unmerged, with no CI, review, or documented replacement. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate’s Jinja2 3.1.6 security update for main (#2207) was autoclosed without merging; no replacement PR or commit was identified. | |
| qwen/qwen3.6-35b-a3b | — | — | Renovate's jinja2 v3.1.6 security update was autoclosed without merging. The branch was likely superseded or expired, leaving the CVE-2025-27516 fix unapplied. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Automatically closed by Renovate as a security update for jinja2 to v3.1.6. The branch was superseded by another dependency update or merged automatically, requiring no manual intervention. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/charmcraft#2223
(confidence 95%)
Commit e148af23 contains the Jinja2 3.1.6 dependency update after #2207 was closed.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #5306 build(deps): update dependency jinja2 to v3.1.6 [security] (main) - autoclosed | snapcraft | closed | Autoclosed unmerged after the Jinja2 3.1.6 security update landed through #5305; #5312 separately updated docs requirements. | |
| #2066 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/3.2) - autoclosed | charmcraft | closed | Renovate autoclosed #2066 unmerged; the equivalent Jinja2 3.1.5 security update landed on main via #2064 (979176de). | |
| #5191 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Jinja2 3.1.5 hotfix/7.5 PR #5191 was autoclosed unmerged; the equivalent main-branch security update merged via #5190 in commit 98511dc44. | |
| #5307 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Autoclosed unmerged as the hotfix/7.5 update aged out; Jinja2 3.1.6 later reached main through merged PR #5312 (8bc044979). | |
| #2209 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/3.3) - autoclosed | charmcraft | closed | Renovate's Jinja2 3.1.6 hotfix/3.3 update was autoclosed unmerged; dependency updates were later consolidated and merged in #2223 (e148af23). | |
| #2065 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate's Jinja2 3.1.5 hotfix/2.7 update was autoclosed unmerged; the equivalent main-branch update merged in #2064 via 979176de. | |
| #5192 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/8.5) - autoclosed | snapcraft | closed | Renovate autoclosed the unmerged hotfix/8.5 Jinja2 3.1.5 update; the equivalent main-branch update merged in #5190 at 98511dc44. | |
| #2210 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Jinja2 3.1.6 security bump for hotfix/3.4 was autoclosed unmerged, with no review, CI, comments, or resolving commit. | |
| #2208 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate's Jinja2 3.1.6 update for hotfix/2.7 was autoclosed unmerged with no review, CI, comments, or resolving commit. | |
| #2064 build(deps): update dependency jinja2 to v3.1.5 [security] (main) | charmcraft | merged | Merged PR #2064 via commit 979176de, upgrading Jinja2 from 3.1.4 to 3.1.5 to fix CVE-2024-56326 and CVE-2024-56201. |