build(deps): bump lxml from 4.6.2 to 4.6.3
Metadata
Current evaluation
Dependabot security bump of lxml 4.6.2 -> 4.6.3 (CVE-2021-28957 HTML cleaner fix) was approved and merged into snapcraft as commit d4d7721e3, updating requirements.txt.
Resolution: closed resolved
Reason: The PR was approved by 2 reviewers and merged to main as commit d4d7721e3 ('build(deps): bump lxml from 4.6.2 to 4.6.3 (#3485)'), which updated the lxml pin in requirements.txt to pick up the CVE-2021-28957 fix.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps [lxml](https://github.com/lxml/lxml) from 4.6.2 to 4.6.3.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/lxml/lxml/blob/master/CHANGES.txt">lxml's changelog</a>.</em></p>
<blockquote>
<h1>4.6.3 (2021-03-21)</h1>
<h2>Bugs fixed</h2>
<ul>
<li>A vulnerability (CVE-2021-28957) was discovered in the HTML Cleaner by Kevin Chung,
which allowed JavaScript to pass through. The cleaner now removes the HTML5
<code>formaction</code> attribute.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999"><code>a5f9cb5</code></a> Prepare release of lxml 4.6.3.</li>
<li><a href="https://github.com/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d"><code>2d01a1b</code></a> Add HTML-5 "formaction" attribute to "defs.link_attrs" (<a href="https://github-redirect.dependabot.com/lxml/lxml/issues/316">GH-316</a>)</li>
<li><a href="https://github.com/lxml/lxml/commit/e986a9cb5d54827c59aefa8803bc90954d67221e"><code>e986a9c</code></a> Fix reference in docs.</li>
<li>See full diff in <a href="https://github.com/lxml/lxml/compare/lxml-4.6.2...lxml-4.6.3">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/snapcore/snapcraft/network/alerts).
</details>
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Dependabot security bump of lxml 4.6.2 -> 4.6.3 (CVE-2021-28957 HTML cleaner fix) was approved and merged into snapcraft as commit d4d7721e3, updating requirements.txt. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged snapcore/snapcraft#3485 as commit d4d7721e3, upgrading lxml from 4.6.2 to 4.6.3 to address CVE-2021-28957 in the HTML cleaner. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged Dependabot update bumping lxml 4.6.2 to 4.6.3. Resolves CVE-2021-28957, patching an HTML Cleaner vulnerability allowing JavaScript injection. Approved by two reviewers, passed CI, and merged. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged Dependabot update bumping lxml from 4.6.2 to 4.6.3. The upgrade resolves CVE-2021-28957, a vulnerability in the HTML Cleaner that permitted JavaScript injection. The dependency is now patched and live. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/snapcraft#3606
(confidence 95%)
Later dependabot PR merged as 53b8cf7f1 (merge 4c78e5354) bumping lxml 4.6.3 -> 4.6.5, superseding this pin with further HTML-cleaner security fixes.
-
Related To:
canonical/snapcraft#3404
(confidence 85%)
Preceding dependabot bump of lxml 4.5.0 -> 4.6.2 (commit ebb14936e), the base version this PR upgraded.
-
Related To:
canonical/snapcraft#3829
(confidence 70%)
Subsequent dependabot bump lxml 4.9.0 -> 4.9.1 (commit a61c6032a), showing the dependency line continued to be maintained after this change.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #3404 build(deps): bump lxml from 4.5.0 to 4.6.2 | snapcraft | merged | Merged PR #3404 as commit ebb14936e, updating lxml from 4.5.0 to 4.6.2 and including HTML Cleaner JavaScript-pass-through fixes such as CVE-2020-27783. | |
| #3606 build(deps): bump lxml from 4.6.3 to 4.6.5 | snapcraft | merged | Dependabot PR merged (commit 53b8cf7f1, merge 4c78e5354), bumping lxml 4.6.3 -> 4.6.5 in requirements.txt, pulling in HTML-cleaner script-injection fixes GHSL-2021-1037/1038. | |
| #141 build(deps): update lxml to 6.1.0 | debcraft | merged | Renovate-style dependency bump of lxml from 6.0.2 to 6.1.0 merged into debcraft via commit 434c271 (PR #141), updating only uv.lock; all CI checks passed. | |
| #1072 build(deps): bump lxml | craft-application | merged | Merged #1072 via commit e8c8a384, updating lxml from v6.0.2 to v6.1.0 to resolve an OSV vulnerability. | |
| #6210 build(deps): bump lxml | snapcraft | merged | Merged PR #6210 and commit 76f9fdaca bumped lxml to resolve an OSV security advisory. | |
| #540 build(deps): bump lxml | starbase | merged | Merged #540, bumping lxml to resolve an OSV vulnerability. The update landed as commit 663c1b4 with all CI checks passing. | |
| #3829 build(deps): bump lxml from 4.9.0 to 4.9.1 | snapcraft | merged | Dependabot PR #3829 bumping lxml 4.9.0 -> 4.9.1 was approved and squash-merged into main as commit a61c6032a ('build(deps): bump lxml from 4.9.0 to 4.9.1 (#3829)'), updating requirements/setup pinning. | |
| #362 build(deps): bump lxml | craft-store | merged | Merged PR canonical/craft-store#362 in commit 4719100, upgrading lxml from 5.4.0 to 6.1.0 to resolve an OSV advisory. | |
| #86 build(deps): bump lxml | craft-artifacts | merged | Merged PR #86 via commit 3149b0b, updating lxml from 6.0.2 to 6.1.1 in uv.lock to resolve an OSV vulnerability. | |
| #331 build(deps): update lxml | imagecraft | merged | Merged as commit eae7ded: uv.lock-only bump of lxml to 6.1.1 clearing an OSV advisory. All CI passed, including OSV-scanner and Trivy scans; 2 approvals. Later superseded by lxml bump #540 (663c1b4). |