build(deps): update jinja2 to 3.1.6
Metadata
Current evaluation
Merged PR #1038 via commit 4af3a08b, upgrading Jinja2 to 3.1.6 to address CVE-2025-27516, a sandbox breakout through the attr filter.
Resolution: closed resolved
Reason: The dependency update was merged into the main project in commit 4af3a08b, upgrading Jinja2 to 3.1.6 and resolving the cited sandbox-escape vulnerability.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Address CVE-2025-27516: Jinja2 vulnerable to sandbox breakout through
attr filter selecting format method.
See https://osv.dev/vulnerability/GHSA-cpwx-vrp4-4pq7 for details.
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)?
-----
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1038 via commit 4af3a08b, upgrading Jinja2 to 3.1.6 to address CVE-2025-27516, a sandbox breakout through the attr filter. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1038 updated Jinja2 to 3.1.6 in commit 4af3a08b, addressing CVE-2025-27516, a sandbox escape through the attr filter's format method. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged to update jinja2 to 3.1.6, resolving CVE-2025-27516 sandbox breakout vulnerability. Approved by two reviewers, passed CI, and applied with a minimal five-line change across two files. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged to update jinja2 to 3.1.6, resolving CVE-2025-27516 sandbox breakout vulnerability. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2064 build(deps): update dependency jinja2 to v3.1.5 [security] (main) | charmcraft | merged | Merged PR #2064 via commit 979176de, upgrading Jinja2 from 3.1.4 to 3.1.5 to fix CVE-2024-56326 and CVE-2024-56201. | |
| #5190 build(deps): update dependency jinja2 to v3.1.5 [security] (main) | snapcraft | merged | Merged PR #5190 (commit 98511dc44), upgrading Jinja2 from 3.1.4 to 3.1.5 to address CVE-2024-56326 and CVE-2024-56201. | |
| #5308 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/8.6) | snapcraft | closed | Merged into hotfix/8.6, upgrading Jinja2 from 3.1.5 to 3.1.6 to address CVE-2025-27516. | |
| #106 build(deps): bump jinja2 from 3.1.5 to 3.1.6 | imagecraft | merged | Merged as commit 4844f1d, upgrading Jinja2 from 3.1.5 to 3.1.6 to address GHSA-cpwx-vrp4-4pq7. | |
| #5191 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Jinja2 3.1.5 hotfix/7.5 PR #5191 was autoclosed unmerged; the equivalent main-branch security update merged via #5190 in commit 98511dc44. | |
| #5312 build(deps): bump jinja2 from 3.1.5 to 3.1.6 in /docs/.sphinx | snapcraft | merged | Dependabot PR merged as commit 8bc04497, bumping Jinja2 3.1.5 to 3.1.6 in the Sphinx docs requirements to fix sandbox bypass GHSA-cpwx-vrp4-4pq7. | |
| #2066 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/3.2) - autoclosed | charmcraft | closed | Renovate autoclosed #2066 unmerged; the equivalent Jinja2 3.1.5 security update landed on main via #2064 (979176de). | |
| #5307 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Autoclosed unmerged as the hotfix/7.5 update aged out; Jinja2 3.1.6 later reached main through merged PR #5312 (8bc044979). | |
| #4518 build(deps): bump jinja2 from 3.1.2 to 3.1.3 in /docs/.sphinx | snapcraft | merged | Merged in #4518 via commit 9fc449a66, updating Jinja2 from 3.1.2 to 3.1.3 in /docs/.sphinx and including the xmlattr security fix. | |
| #2210 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Jinja2 3.1.6 security bump for hotfix/3.4 was autoclosed unmerged, with no review, CI, comments, or resolving commit. |