← Back to issue list

Bump jinja2 from 2.11.2 to 2.11.3

View original Github issue

Metadata

Project
charmcraft
Number
#274
Type
pull request
State
merged
Author
dependabot[bot]
Labels
Created
Updated
Closed

Current evaluation

Merged an automated Dependabot update bumping jinja2 from 2.11.2 to 2.11.3. The release fixes a regex backtracking performance issue in the urlize filter. Approved by two reviewers and passed CI checks prior to merge.

Suggested action:

No scores available.

Issue body

Bumps [jinja2](https://github.com/pallets/jinja) from 2.11.2 to 2.11.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pallets/jinja/releases">jinja2's releases</a>.</em></p> <blockquote> <h2>2.11.3</h2> <p>This contains a fix for a speed issue with the <code>urlize</code> filter. <code>urlize</code> is likely to be called on untrusted user input. For certain inputs some of the regular expressions used to parse the text could take a very long time due to backtracking. As part of the fix, the email matching became slightly stricter. The various speedups apply to <code>urlize</code> in general, not just the specific input cases.</p> <ul> <li>PyPI: <a href="https://pypi.org/project/Jinja2/2.11.3/">https://pypi.org/project/Jinja2/2.11.3/</a></li> <li>Changes: <a href="https://jinja.palletsprojects.com/en/2.11.x/changelog/#version-2-11-3">https://jinja.palletsprojects.com/en/2.11.x/changelog/#version-2-11-3</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pallets/jinja/blob/master/CHANGES.rst">jinja2's changelog</a>.</em></p> <blockquote> <h2>Version 2.11.3</h2> <p>Released 2021-01-31</p> <ul> <li>Improve the speed of the <code>urlize</code> filter by reducing regex backtracking. Email matching requires a word character at the start of the domain part, and only word characters in the TLD. :pr:<code>1343</code></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pallets/jinja/commit/cf215390d4a4d6f0a4de27e2687eed176878f13d"><code>cf21539</code></a> release version 2.11.3</li> <li><a href="https://github.com/pallets/jinja/commit/15ef8f09b659f9100610583938005a7a10472d4d"><code>15ef8f0</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/pallets/jinja/issues/1343">#1343</a> from pallets/urlize-speedup</li> <li><a href="https://github.com/pallets/jinja/commit/ef658dc3b6389b091d608e710a810ce8b87995b3"><code>ef658dc</code></a> speed up urlize matching</li> <li><a href="https://github.com/pallets/jinja/commit/eeca0fecc3318d43f61bc340ad61db641b861ade"><code>eeca0fe</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/pallets/jinja/issues/1207">#1207</a> from mhansen/patch-1</li> <li><a href="https://github.com/pallets/jinja/commit/2dd769111cbb1a2637f805b3b4c652ec8096d371"><code>2dd7691</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/pallets/jinja/issues/1209">#1209</a> from mhansen/patch-3</li> <li><a href="https://github.com/pallets/jinja/commit/48929401db7228db04dfd8e88115dd5c30dc2d86"><code>4892940</code></a> do_dictsort: update example ready to copy/paste</li> <li><a href="https://github.com/pallets/jinja/commit/7db7d336ba12574e6205fdd929386fd529e3fad4"><code>7db7d33</code></a> api.rst: bugfix in docs, import PackageLoader</li> <li><a href="https://github.com/pallets/jinja/commit/9ec465baefe32e305bd4e61da49e6c39360c194e"><code>9ec465b</code></a> fix changelog header</li> <li>See full diff in <a href="https://github.com/pallets/jinja/compare/2.11.2...2.11.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=jinja2&package-manager=pip&previous-version=2.11.2&new-version=2.11.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/canonical/charmcraft/network/alerts). </details>

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b Merged an automated Dependabot update bumping jinja2 from 2.11.2 to 2.11.3. The release fixes a regex backtracking performance issue in the urlize filter. Approved by two reviewers and passed CI checks prior to merge.
qwen3.6-35b-a3b-mtp-q6 Merged Dependabot update bumping jinja2 from 2.11.2 to 2.11.3. The release resolves a regex backtracking performance issue in the urlize filter and was successfully integrated.
qwen3.6-35b-a3b-mtp-q6 Merged a Dependabot update bumping jinja2 from 2.11.2 to 2.11.3. The upgrade applies performance improvements to the urlize filter and enforces stricter email matching to prevent regex backtracking.

Update history

No update history recorded yet.

Related issues

Issue Project State Summary Similarity
#106 build(deps): bump jinja2 from 3.1.5 to 3.1.6 imagecraft merged Merged a dependency update bumping jinja2 from 3.1.5 to 3.1.6 to patch security vulnerability GHSA-cpwx-vrp4-4pq7. Approved by two reviewers, passed CI, and merged after coordinating with a related pull request.
76%
#5312 build(deps): bump jinja2 from 3.1.5 to 3.1.6 in /docs/.sphinx snapcraft merged Merged Dependabot update bumping jinja2 from 3.1.5 to 3.1.6 in /docs/.sphinx. The security patch fixes a sandbox attribute lookup bypass. Approved by reviewers and passed CI before automatic merge.
74%
#4518 build(deps): bump jinja2 from 3.1.2 to 3.1.3 in /docs/.sphinx snapcraft merged Dependabot PR bumping jinja2 from 3.1.2 to 3.1.3 in /docs/.sphinx was approved by two reviewers, passed CI checks, and successfully merged. The update resolves security vulnerabilities and compiler errors in the template engine.
72%
#155 chore: bump jinja2 craft-archives merged Merged a jinja2 dependency bump to resolve an OSV security vulnerability. The update passed all lint and test checks, received approval from two reviewers, and modified a single file with minimal changes.
72%
#5189 build(deps): bump jinja2 from 3.1.4 to 3.1.5 snapcraft closed PR closed because jinja2 is already up-to-date. Dependabot noted the update is no longer needed, so the dependency bump was abandoned without merging.
70%
#1034 chore: bump jinja2 craft-parts merged Merged a dependency update to bump jinja2, resolving an OSV CI error. The change was generated via uv lock --upgrade-package jinja2, approved by two reviewers, passed all CI checks, and modified two files.
70%