build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/3.3) - autoclosed
Metadata
Current evaluation
Renovate's Jinja2 3.1.6 hotfix/3.3 update was autoclosed unmerged; dependency updates were later consolidated and merged in #2223 (e148af23).
Resolution: closed superseded
Reason: The branch-specific PR was autoclosed without reviews, CI, or a merge commit. The Jinja2 3.1.6 update was included in consolidated dependency PR #2223, merged as e148af23 to clear OSV security checks.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [jinja2](https://redirect.github.com/pallets/jinja) ([changelog](https://jinja.palletsprojects.com/changes/)) | `==3.1.5` -> `==3.1.6` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2025-27516](https://redirect.github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7)
An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.
To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.
Jinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to use the `|attr` filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment's attribute lookup.
---
### Release Notes
<details>
<summary>pallets/jinja (jinja2)</summary>
### [`v3.1.6`](https://redirect.github.com/pallets/jinja/releases/tag/3.1.6)
[Compare Source](https://redirect.github.com/pallets/jinja/compare/3.1.5...3.1.6)
This is the Jinja 3.1.6 security release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/Jinja2/3.1.6/
Changes: https://jinja.palletsprojects.com/en/stable/changes/#version-3-1-6
- The `|attr` filter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xODUuNCIsInVwZGF0ZWRJblZlciI6IjM5LjE4NS40IiwidGFyZ2V0QnJhbmNoIjoiaG90Zml4LzMuMyIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Renovate's Jinja2 3.1.6 hotfix/3.3 update was autoclosed unmerged; dependency updates were later consolidated and merged in #2223 (e148af23). | |
| stealth/space-bunny-alpha | — | closed stale | Jinja2 3.1.6 security update for hotfix/3.3 was autoclosed unmerged, with no reviews, CI checks, comments, or resolving commit recorded. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate autoclosed the Jinja2 3.1.6 security update for hotfix/3.3 without review or merge; no resolution was recorded for this PR. | |
| qwen/qwen3.6-35b-a3b | — | — | Renovate bot dependency update for jinja2 to v3.1.6 was autoclosed without review or merging. The security patch was abandoned. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate PR updating jinja2 to v3.1.6 for CVE-2025-27516 was autoclosed by the bot. The security update was not merged, likely due to branch deletion or an overlapping dependency change. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/charmcraft#2223
(confidence 92%)
Merged commit e148af23 included the Jinja2 3.1.6 dependency update alongside other dependency upgrades.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2065 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate's Jinja2 3.1.5 hotfix/2.7 update was autoclosed unmerged; the equivalent main-branch update merged in #2064 via 979176de. | |
| #2066 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/3.2) - autoclosed | charmcraft | closed | Renovate autoclosed #2066 unmerged; the equivalent Jinja2 3.1.5 security update landed on main via #2064 (979176de). | |
| #2208 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate's Jinja2 3.1.6 update for hotfix/2.7 was autoclosed unmerged with no review, CI, comments, or resolving commit. | |
| #5192 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/8.5) - autoclosed | snapcraft | closed | Renovate autoclosed the unmerged hotfix/8.5 Jinja2 3.1.5 update; the equivalent main-branch update merged in #5190 at 98511dc44. | |
| #5307 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Autoclosed unmerged as the hotfix/7.5 update aged out; Jinja2 3.1.6 later reached main through merged PR #5312 (8bc044979). | |
| #5191 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Jinja2 3.1.5 hotfix/7.5 PR #5191 was autoclosed unmerged; the equivalent main-branch security update merged via #5190 in commit 98511dc44. | |
| #2207 build(deps): update dependency jinja2 to v3.1.6 [security] (main) - autoclosed | charmcraft | closed | Jinja2 3.1.6 update was autoclosed unmerged; the same pin landed through #2223 in commit e148af23. | |
| #2210 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Jinja2 3.1.6 security bump for hotfix/3.4 was autoclosed unmerged, with no review, CI, comments, or resolving commit. | |
| #5306 build(deps): update dependency jinja2 to v3.1.6 [security] (main) - autoclosed | snapcraft | closed | Autoclosed unmerged after the Jinja2 3.1.6 security update landed through #5305; #5312 separately updated docs requirements. | |
| #5309 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/8.7) - autoclosed | snapcraft | closed | Renovate PR #5309 was autoclosed unmerged; Jinja2 3.1.6 reached Snapcraft 8.7.2 through merged hotfix PR #5311, backporting the update from #5305. |