build(deps): update Jinja2
Metadata
Current evaluation
Merged to update the Jinja2 dependency, resolving a failing pipeline and addressing a CVE scan result. The change also disabled a false-positive S105 security check. Approved by two reviewers and passed all CI checks.
Suggested action: —
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
Fixes currently failing pipeline in `craft-store`.
* Update Jinja2 dependency to address CVE scanning result.
* Disable `S105` false-positive for the `TOKEN_TYPE`
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged to update the Jinja2 dependency, resolving a failing pipeline and addressing a CVE scan result. The change also disabled a false-positive S105 security check. Approved by two reviewers and passed all CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged. Updated Jinja2 dependency to fix a failing pipeline and address a CVE scan result. Also disabled the S105 false-positive for TOKEN_TYPE. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1038 build(deps): update jinja2 to 3.1.6 | craft-parts | merged | Merged to update jinja2 to 3.1.6, resolving CVE-2025-27516 sandbox breakout vulnerability. Approved by two reviewers, passed CI, and applied with a minimal five-line change across two files. | |
| #106 build(deps): bump jinja2 from 3.1.5 to 3.1.6 | imagecraft | merged | Merged a dependency update bumping jinja2 from 3.1.5 to 3.1.6 to patch security vulnerability GHSA-cpwx-vrp4-4pq7. Approved by two reviewers, passed CI, and merged after coordinating with a related pull request. | |
| #5305 build(deps): update jinja to 3.1.6 | snapcraft | merged | Merged update to jinja 3.1.6 to resolve security vulnerability GHSA-cpwx-vrp4-4pq7. Approved by two reviewers, passed CI, and integrated without comments. | |
| #2064 build(deps): update dependency jinja2 to v3.1.5 [security] (main) | charmcraft | merged | Merged an automated dependency update upgrading jinja2 from 3.1.4 to 3.1.5 to patch CVE-2024-56326 and CVE-2024-56201. The change passed CI, received reviewer approval, and was auto-merged to main. | |
| #5190 build(deps): update dependency jinja2 to v3.1.5 [security] (main) | snapcraft | merged | Merged automated dependency update upgrading Jinja2 from 3.1.4 to 3.1.5 to patch CVE-2024-56326 and CVE-2024-56201. The change passed CI, received two approvals, and was auto-merged into main by Renovate bot. | |
| #5306 build(deps): update dependency jinja2 to v3.1.6 [security] (main) - autoclosed | snapcraft | closed | Renovate PR updating Jinja2 to v3.1.6 to fix CVE-2025-27516 passed CI and received approval but was autoclosed without merging, likely superseded by a newer dependency update. | |
| #2210 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Dependency update PR for jinja2 v3.1.6 addressing CVE-2025-27516 was autoclosed without merging. No reviews or CI checks ran. | |
| #5308 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/8.6) | snapcraft | closed | Automatically merged via Renovate to update Jinja2 to v3.1.6, resolving CVE-2025-27516. Applied to hotfix/8.6 without manual review. | |
| #5309 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/8.7) - autoclosed | snapcraft | closed | The Jinja2 v3.1.6 security update was autoclosed without review, CI checks, or merge. Renovate automatically closed the branch. | |
| #5312 build(deps): bump jinja2 from 3.1.5 to 3.1.6 in /docs/.sphinx | snapcraft | merged | Merged Dependabot update bumping jinja2 from 3.1.5 to 3.1.6 in /docs/.sphinx. The security patch fixes a sandbox attribute lookup bypass. Approved by reviewers and passed CI before automatic merge. |