chore(deps): update dependency idna to v3.7 [security]
Metadata
Current evaluation
Renovate PR #4726 merged as commit 077ebbfff, pinning idna 3.4/3.6 -> 3.7 to fix CVE-2024-3651 (idna.encode() DoS). Later bumped to 3.10 in #5439.
Resolution: closed resolved
Reason: The PR itself was merged into main as commit 077ebbfff ('chore(deps): update dependency idna to v3.7 [security] (#4726)') after approval from 2 reviewers, updating requirements.txt and requirements-dev.txt pins to address the CVE-2024-3651 resource-consumption advisory in idna.encode().
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [idna](https://togithub.com/kjd/idna) ([changelog](https://togithub.com/kjd/idna/blob/master/HISTORY.rst)) | `==3.6` -> `==3.7` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
| [idna](https://togithub.com/kjd/idna) ([changelog](https://togithub.com/kjd/idna/blob/master/HISTORY.rst)) | `==3.4` -> `==3.7` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-3651](https://togithub.com/kjd/idna/security/advisories/GHSA-jjg7-2v4v-x38h)
### Impact
A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.
### Patches
The function has been refined to reject such strings without the associated resource consumption in version 3.7.
### Workarounds
Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.
### References
* https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb
---
### Release Notes
<details>
<summary>kjd/idna (idna)</summary>
### [`v3.7`](https://togithub.com/kjd/idna/compare/v3.6...v3.7)
[Compare Source](https://togithub.com/kjd/idna/compare/v3.6...v3.7)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC.
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Renovate PR #4726 merged as commit 077ebbfff, pinning idna 3.4/3.6 -> 3.7 to fix CVE-2024-3651 (idna.encode() DoS). Later bumped to 3.10 in #5439. | |
| stealth/space-bunny-alpha | — | closed resolved | Renovate security bump merging idna 3.4/3.6 -> 3.7 to fix CVE-2024-3651 (idna.encode() DoS); merged to main as commit 077ebbfff. Later bumped to 3.10 in #5439. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 077ebbfff via #4726, updating idna from 3.4/3.6 to 3.7 to address the CVE-2024-3651 denial-of-service vulnerability. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #4726 via commit 077ebbfff, upgrading idna from 3.6/3.4 to 3.7 to address CVE-2024-3651. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged automated dependency update upgrading idna to v3.7 from v3.6 and v3.4. Resolves CVE-2024-3651 denial-of-service vulnerability in idna.encode(). Approved by reviewers, passed CI, and merged to main. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading idna to v3.7 to resolve CVE-2024-3651 denial-of-service vulnerability. The security patch was applied via Renovate bot and successfully integrated. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/snapcraft#5439
(confidence 88%)
Later merged (commit 1a4ddda70) bumping idna 3.7 -> 3.10; requirements files later removed entirely in commit 081a66d06
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1644 chore(deps): update dependency idna to v3.7 [security] | charmcraft | merged | Renovate security bump of idna 3.6 -> 3.7 (CVE-2024-3651 DoS) merged into main via commit 2f38be1e, updating requirements.txt and the lock file; approved by 2 reviewers. Later superseded by #1938 (idna 3.10). | |
| #545 chore(deps): update dependency idna to v3.7 | rockcraft | merged | Renovate PR #545 was merged, updating idna from 3.6 to 3.7 in commit 8432a136 after two approvals. | |
| #4789 chore(deps): update dependency jinja2 to v3.1.4 [security] | snapcraft | merged | Merged PR #4789 as commit 3869f7517, upgrading Jinja2 from 3.1.3 to 3.1.4 to remediate CVE-2024-34064. | |
| #1111 chore(deps): update dependency requests to v2.31.0 [security] - abandoned | charmcraft | closed | Renovate's requests 2.28.2 -> 2.31.0 security PR was closed empty (0 files) after autoclosing was skipped due to a modified branch; the identical CVE-2023-32681 upgrade landed via merged Dependabot PR #1110 (10d6d55a). | |
| #4727 build(deps): bump idna from 3.6 to 3.7 | snapcraft | closed | Dependabot PR bumping idna 3.6→3.7 was closed unmerged by mr-cal in favour of the Renovate security PR #4726, which updated idna and landed as commit 077ebbfff. | |
| #1724 chore(deps): update dependency zipp to v3.19.1 [security] | charmcraft | merged | Merged PR #1724 in commit 4632f60f, upgrading zipp from 3.18.1 to 3.19.1 to address CVE-2024-5569. | |
| #4902 chore(deps): update dependency zipp to v3.19.1 [security] - autoclosed | snapcraft | closed | Renovate's zipp 3.17.0/3.18.1 -> 3.19.1 security bump (CVE-2024-5569) was autoclosed because Dependabot PR #4901 merged the identical update in commit de7f1d5ad. | |
| #968 chore(deps): update dependency filelock to v3.9.0 | charmcraft | merged | Renovate PR #968 updated filelock from 3.8.2 to 3.9.0 and merged via e4678923; implementation commit e3ccc132. | |
| #4812 chore(deps): update dependency requests to v2.32.0 [security] - autoclosed | snapcraft | closed | Renovate PR #4812 was autoclosed unmerged after 856 days; the security upgrade was later delivered by #5064 (commit ec4f9b16f), raising requests from 2.31.0 to 2.32.2. | |
| #346 build(deps): bump idna | imagecraft | merged | Merged PR #346 in commit 4bf75c9, updating idna from 3.11 to 3.15 to resolve an OSV vulnerability. |