build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/3.4) - autoclosed
Metadata
Current evaluation
Dependency update PR for jinja2 v3.1.6 addressing CVE-2025-27516 was autoclosed without merging. No reviews or CI checks ran.
Suggested action: —
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [jinja2](https://redirect.github.com/pallets/jinja) ([changelog](https://jinja.palletsprojects.com/changes/)) | `==3.1.5` -> `==3.1.6` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2025-27516](https://redirect.github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7)
An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.
To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.
Jinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to use the `|attr` filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment's attribute lookup.
---
### Release Notes
<details>
<summary>pallets/jinja (jinja2)</summary>
### [`v3.1.6`](https://redirect.github.com/pallets/jinja/releases/tag/3.1.6)
[Compare Source](https://redirect.github.com/pallets/jinja/compare/3.1.5...3.1.6)
This is the Jinja 3.1.6 security release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/Jinja2/3.1.6/
Changes: https://jinja.palletsprojects.com/en/stable/changes/#version-3-1-6
- The `|attr` filter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xODUuNCIsInVwZGF0ZWRJblZlciI6IjM5LjE4NS40IiwidGFyZ2V0QnJhbmNoIjoiaG90Zml4LzMuNCIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Dependency update PR for jinja2 v3.1.6 addressing CVE-2025-27516 was autoclosed without merging. No reviews or CI checks ran. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Automatically closed by Renovate bot without merging. The jinja2 v3.1.6 security update was autoclosed, indicating the branch became obsolete or was superseded by another dependency update. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate autoclosed this security update for jinja2 to v3.1.6 without merging. The pull request was automatically closed, likely due to target branch deletion or an alternative resolution. No manual review or activity occurred. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #5307 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | The Jinja2 v3.1.6 security update was autoclosed without merging. The pull request received no reviews or CI checks and was automatically closed, leaving the dependency update unapplied. | |
| #2208 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Automatically closed without merging. The dependency update to jinja2 v3.1.6 for CVE-2025-27516 was superseded or abandoned before review. | |
| #5309 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/8.7) - autoclosed | snapcraft | closed | The Jinja2 v3.1.6 security update was autoclosed without review, CI checks, or merge. Renovate automatically closed the branch. | |
| #2209 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/3.3) - autoclosed | charmcraft | closed | Renovate bot dependency update for jinja2 to v3.1.6 was autoclosed without review or merging. The security patch was abandoned. | |
| #5306 build(deps): update dependency jinja2 to v3.1.6 [security] (main) - autoclosed | snapcraft | closed | Renovate PR updating Jinja2 to v3.1.6 to fix CVE-2025-27516 passed CI and received approval but was autoclosed without merging, likely superseded by a newer dependency update. | |
| #2066 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/3.2) - autoclosed | charmcraft | closed | Renovate bot pull request updating jinja2 to v3.1.5 for security fixes was automatically closed without review or merge. The update was abandoned by the bot. | |
| #5191 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Automatically closed without merging. The Renovate PR updated Jinja2 to v3.1.5 to patch CVE-2024-56326 and CVE-2024-56201. Despite approvals and passing CI, the branch was autoclosed. | |
| #2064 build(deps): update dependency jinja2 to v3.1.5 [security] (main) | charmcraft | merged | Merged an automated dependency update upgrading jinja2 from 3.1.4 to 3.1.5 to patch CVE-2024-56326 and CVE-2024-56201. The change passed CI, received reviewer approval, and was auto-merged to main. | |
| #2065 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | The Renovate-generated pull request updating Jinja2 to v3.1.5 for security patches was automatically closed without merging. The dependency update was abandoned by the system. | |
| #5192 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/8.5) - autoclosed | snapcraft | closed | Automated PR updating Jinja2 to v3.1.5 for security vulnerabilities was approved and passed CI but was autoclosed by Renovate, indicating it was superseded by a newer update or became stale. |