chore(deps): update dependency idna to v3.7 [security]
Metadata
Current evaluation
Merged automated dependency update upgrading idna to v3.7 from v3.6 and v3.4. Resolves CVE-2024-3651 denial-of-service vulnerability in idna.encode(). Approved by reviewers, passed CI, and merged to main.
Suggested action: —
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [idna](https://togithub.com/kjd/idna) ([changelog](https://togithub.com/kjd/idna/blob/master/HISTORY.rst)) | `==3.6` -> `==3.7` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
| [idna](https://togithub.com/kjd/idna) ([changelog](https://togithub.com/kjd/idna/blob/master/HISTORY.rst)) | `==3.4` -> `==3.7` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-3651](https://togithub.com/kjd/idna/security/advisories/GHSA-jjg7-2v4v-x38h)
### Impact
A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.
### Patches
The function has been refined to reject such strings without the associated resource consumption in version 3.7.
### Workarounds
Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.
### References
* https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb
---
### Release Notes
<details>
<summary>kjd/idna (idna)</summary>
### [`v3.7`](https://togithub.com/kjd/idna/compare/v3.6...v3.7)
[Compare Source](https://togithub.com/kjd/idna/compare/v3.6...v3.7)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC.
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged automated dependency update upgrading idna to v3.7 from v3.6 and v3.4. Resolves CVE-2024-3651 denial-of-service vulnerability in idna.encode(). Approved by reviewers, passed CI, and merged to main. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading idna to v3.7 to resolve CVE-2024-3651 denial-of-service vulnerability. The security patch was applied via Renovate bot and successfully integrated. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated update upgrading idna to v3.7 to resolve CVE-2024-3651, a denial-of-service vulnerability in the encode function. The dependency bump was applied via Renovate to patch the security risk. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1644 chore(deps): update dependency idna to v3.7 [security] | charmcraft | merged | Merged automated dependency update upgrading idna from v3.6 to v3.7 to resolve CVE-2024-3651, a denial-of-service vulnerability in the encode function. Approved by reviewers and passed CI checks. | |
| #545 chore(deps): update dependency idna to v3.7 | rockcraft | merged | Merged automated dependency update upgrading idna from v3.6 to v3.7. Approved by two reviewers, passed CI checks, and merged into the main branch. | |
| #1938 build(deps): update dependency idna to v3.10 (main) | charmcraft | merged | Merged automated dependency update upgrading idna from v3.7 to v3.10. The change passed CI checks, received two approvals, and was merged into the main branch. | |
| #5439 build(deps): update dependency idna to v3.10 (main) | snapcraft | merged | Merged automated idna dependency update from v3.7 to v3.10 into main. Approved by two reviewers and passed CI checks before successful integration. | |
| #1724 chore(deps): update dependency zipp to v3.19.1 [security] | charmcraft | merged | Merged a security update upgrading zipp from 3.18.1 to 3.19.1 to resolve CVE-2024-5569. Approved by two reviewers, passed CI checks, and merged into the main branch. | |
| #1720 chore(deps): update dependency certifi to v2024.7.4 [security] | charmcraft | merged | Merged a security update upgrading certifi from v2024.6.2 to v2024.7.4 to address CVE-2024-39689. Approved by two reviewers, passed CI checks, and merged into main. | |
| #4789 chore(deps): update dependency jinja2 to v3.1.4 [security] | snapcraft | merged | Merged automated dependency update upgrading Jinja2 from 3.1.3 to 3.1.4 to patch CVE-2024-34064, addressing an XSS vulnerability in the xmlattr filter. Approved and auto-merged by Renovate. | |
| #976 chore(deps): update dependency charset-normalizer to v3 | charmcraft | merged | Merged automated dependency update from charset-normalizer v2.1.1 to v3.0.1. Approved by one reviewer, passed CI checks, and modified two files with a two-line change. | |
| #4727 build(deps): bump idna from 3.6 to 3.7 | snapcraft | closed | Closed and superseded by pull request #4726. Dependabot proposed bumping idna from 3.6 to 3.7 to address CVE-2024-3651. The dependency update was handled through the referenced PR instead. | |
| #1337 chore(deps): update dependency urllib3 to v1.26.18 [security] | charmcraft | merged | Merged automated update upgrading urllib3 from 1.26.17 to 1.26.18 to patch CVE-2023-45803, fixing HTTP request body leakage on 303 redirects. Approved and merged after passing CI checks. |