build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/2.7) - autoclosed
Metadata
Current evaluation
Renovate's Jinja2 3.1.6 update for hotfix/2.7 was autoclosed unmerged with no review, CI, comments, or resolving commit.
Resolution: closed stale
Reason: PR #2208 was autoclosed while review was still pending, with no CI checks, comments, or merge commit recorded. Main later received Jinja2 3.1.6 through #2189 (bba6a32e), but that did not resolve this hotfix/2.7 PR.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [jinja2](https://redirect.github.com/pallets/jinja) ([changelog](https://jinja.palletsprojects.com/changes/)) | `==3.1.5` -> `==3.1.6` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2025-27516](https://redirect.github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7)
An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.
To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.
Jinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to use the `|attr` filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment's attribute lookup.
---
### Release Notes
<details>
<summary>pallets/jinja (jinja2)</summary>
### [`v3.1.6`](https://redirect.github.com/pallets/jinja/releases/tag/3.1.6)
[Compare Source](https://redirect.github.com/pallets/jinja/compare/3.1.5...3.1.6)
This is the Jinja 3.1.6 security release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/Jinja2/3.1.6/
Changes: https://jinja.palletsprojects.com/en/stable/changes/#version-3-1-6
- The `|attr` filter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xODUuNCIsInVwZGF0ZWRJblZlciI6IjM5LjE4NS40IiwidGFyZ2V0QnJhbmNoIjoiaG90Zml4LzIuNyIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Renovate's Jinja2 3.1.6 update for hotfix/2.7 was autoclosed unmerged with no review, CI, comments, or resolving commit. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate’s Jinja2 3.1.6 security update for hotfix/2.7 was autoclosed without review, CI, or merge. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate PR #2208 was autoclosed without merging, so its Jinja2 3.1.6 security update for CVE-2025-27516 was not delivered by this PR. | |
| qwen/qwen3.6-35b-a3b | — | — | Automatically closed without merging. The dependency update to jinja2 v3.1.6 for CVE-2025-27516 was superseded or abandoned before review. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Security update PR for jinja2 v3.1.6 was autoclosed without merging. The change on the hotfix/2.7 branch was abandoned or superseded by Renovate. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/charmcraft#2189
(confidence 90%)
Merged main dependency rollup bba6a32e carried Jinja2 3.1.6, but was not a hotfix/2.7 resolution.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2065 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate's Jinja2 3.1.5 hotfix/2.7 update was autoclosed unmerged; the equivalent main-branch update merged in #2064 via 979176de. | |
| #2209 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/3.3) - autoclosed | charmcraft | closed | Renovate's Jinja2 3.1.6 hotfix/3.3 update was autoclosed unmerged; dependency updates were later consolidated and merged in #2223 (e148af23). | |
| #2210 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Jinja2 3.1.6 security bump for hotfix/3.4 was autoclosed unmerged, with no review, CI, comments, or resolving commit. | |
| #2066 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/3.2) - autoclosed | charmcraft | closed | Renovate autoclosed #2066 unmerged; the equivalent Jinja2 3.1.5 security update landed on main via #2064 (979176de). | |
| #5307 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Autoclosed unmerged as the hotfix/7.5 update aged out; Jinja2 3.1.6 later reached main through merged PR #5312 (8bc044979). | |
| #5191 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Jinja2 3.1.5 hotfix/7.5 PR #5191 was autoclosed unmerged; the equivalent main-branch security update merged via #5190 in commit 98511dc44. | |
| #5192 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/8.5) - autoclosed | snapcraft | closed | Renovate autoclosed the unmerged hotfix/8.5 Jinja2 3.1.5 update; the equivalent main-branch update merged in #5190 at 98511dc44. | |
| #2207 build(deps): update dependency jinja2 to v3.1.6 [security] (main) - autoclosed | charmcraft | closed | Jinja2 3.1.6 update was autoclosed unmerged; the same pin landed through #2223 in commit e148af23. | |
| #5306 build(deps): update dependency jinja2 to v3.1.6 [security] (main) - autoclosed | snapcraft | closed | Autoclosed unmerged after the Jinja2 3.1.6 security update landed through #5305; #5312 separately updated docs requirements. | |
| #5309 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/8.7) - autoclosed | snapcraft | closed | Renovate PR #5309 was autoclosed unmerged; Jinja2 3.1.6 reached Snapcraft 8.7.2 through merged hotfix PR #5311, backporting the update from #5305. |