build(deps): bump jinja2 from 3.1.5 to 3.1.6
Metadata
Current evaluation
Merged as commit 4844f1d, upgrading Jinja2 from 3.1.5 to 3.1.6 to address GHSA-cpwx-vrp4-4pq7.
Resolution: closed resolved
Reason: PR #106 was approved and merged as commit 4844f1d after its prerequisite, PR #105, was merged. The change updates Jinja2 to the patched 3.1.6 release.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
---
Addresses https://osv.dev/vulnerability/GHSA-cpwx-vrp4-4pq7
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 4844f1d, upgrading Jinja2 from 3.1.5 to 3.1.6 to address GHSA-cpwx-vrp4-4pq7. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #106 as commit 4844f1d, upgrading Jinja2 from 3.1.5 to 3.1.6 to address GHSA-cpwx-vrp4-4pq7 after the prerequisite #105 merge. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a dependency update bumping jinja2 from 3.1.5 to 3.1.6 to patch security vulnerability GHSA-cpwx-vrp4-4pq7. Approved by two reviewers, passed CI, and merged after coordinating with a related pull request. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged dependency update bumping jinja2 from 3.1.5 to 3.1.6 to address security vulnerability GHSA-cpwx-vrp4-4pq7. Initially held pending PR #105, then merged after that dependency was resolved. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/imagecraft#105
(confidence 100%)
Required prerequisite merge that had to land before the dependency update.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #5312 build(deps): bump jinja2 from 3.1.5 to 3.1.6 in /docs/.sphinx | snapcraft | merged | Dependabot PR merged as commit 8bc04497, bumping Jinja2 3.1.5 to 3.1.6 in the Sphinx docs requirements to fix sandbox bypass GHSA-cpwx-vrp4-4pq7. | |
| #4788 build(deps): bump jinja2 from 3.1.3 to 3.1.4 in /docs/.sphinx | snapcraft | closed | Closed unmerged as redundant: commit 3869f7517 had already upgraded Jinja2 to 3.1.4; Dependabot confirmed the proposed bump was no longer needed. | |
| #2206 build(deps-dev): bump jinja2 from 3.1.5 to 3.1.6 | charmcraft | closed | Jinja2 was already upgraded to 3.1.6 by #2189 (commit bba6a32e), so Dependabot closed unmerged PR #2206 as unnecessary. | |
| #2064 build(deps): update dependency jinja2 to v3.1.5 [security] (main) | charmcraft | merged | Merged PR #2064 via commit 979176de, upgrading Jinja2 from 3.1.4 to 3.1.5 to fix CVE-2024-56326 and CVE-2024-56201. | |
| #4518 build(deps): bump jinja2 from 3.1.2 to 3.1.3 in /docs/.sphinx | snapcraft | merged | Merged in #4518 via commit 9fc449a66, updating Jinja2 from 3.1.2 to 3.1.3 in /docs/.sphinx and including the xmlattr security fix. | |
| #5189 build(deps): bump jinja2 from 3.1.4 to 3.1.5 | snapcraft | closed | Closed as obsolete: Jinja2 was already updated; a later bump to 3.1.6 merged via snapcraft#5312 (8bc04497). | |
| #1038 build(deps): update jinja2 to 3.1.6 | craft-parts | merged | Merged PR #1038 via commit 4af3a08b, upgrading Jinja2 to 3.1.6 to address CVE-2025-27516, a sandbox breakout through the attr filter. | |
| #5308 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/8.6) | snapcraft | closed | Merged into hotfix/8.6, upgrading Jinja2 from 3.1.5 to 3.1.6 to address CVE-2025-27516. | |
| #4790 build(deps): bump jinja2 from 3.1.3 to 3.1.4 in /docs | snapcraft | closed | Dependabot's jinja2 3.1.3→3.1.4 bump for /docs was closed unmerged as redundant; PR #4789 already merged as 3869f7517 and Dependabot later confirmed jinja2 was up to date. | |
| #5190 build(deps): update dependency jinja2 to v3.1.5 [security] (main) | snapcraft | merged | Merged PR #5190 (commit 98511dc44), upgrading Jinja2 from 3.1.4 to 3.1.5 to address CVE-2024-56326 and CVE-2024-56201. |