build(deps): bump idna from 3.6 to 3.7
Metadata
Current evaluation
Dependabot PR bumping idna 3.6→3.7 was closed unmerged by mr-cal in favour of the Renovate security PR #4726, which updated idna and landed as commit 077ebbfff.
Resolution: closed superseded
Reason: Maintainer mr-cal commented "Closing in favour of https://github.com/canonical/snapcraft/pull/4726" on 2024-04-12. That PR, which updated idna to v3.7 for the CVE-2024-3651 DoS fix, was merged as commit 077ebbfff, so the fix is in place via the other PR.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps [idna](https://github.com/kjd/idna) from 3.6 to 3.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/kjd/idna/releases">idna's releases</a>.</em></p>
<blockquote>
<h2>v3.7</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]</li>
</ul>
<p>Thanks to Guido Vranken for reporting the issue.</p>
<p><strong>Full Changelog</strong>: <a href="https://github.com/kjd/idna/compare/v3.6...v3.7">https://github.com/kjd/idna/compare/v3.6...v3.7</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/kjd/idna/blob/master/HISTORY.rst">idna's changelog</a>.</em></p>
<blockquote>
<p>3.7 (2024-04-11)
++++++++++++++++</p>
<ul>
<li>Fix issue where specially crafted inputs to encode() could
take exceptionally long amount of time to process. [CVE-2024-3651]</li>
</ul>
<p>Thanks to Guido Vranken for reporting the issue.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d"><code>1d365e1</code></a> Release v3.7</li>
<li><a href="https://github.com/kjd/idna/commit/c1b3154939907fab67c5754346afaebe165ce8e6"><code>c1b3154</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/172">#172</a> from kjd/optimize-contextj</li>
<li><a href="https://github.com/kjd/idna/commit/0394ec76ff022813e770ba1fd89658790ea35623"><code>0394ec7</code></a> Merge branch 'master' into optimize-contextj</li>
<li><a href="https://github.com/kjd/idna/commit/cd58a23173d2b0a40b95ee680baf3e59e8d33966"><code>cd58a23</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/152">#152</a> from elliotwutingfeng/dev</li>
<li><a href="https://github.com/kjd/idna/commit/5beb28b9dd77912c0dd656d8b0fdba3eb80222e7"><code>5beb28b</code></a> More efficient resolution of joiner contexts</li>
<li><a href="https://github.com/kjd/idna/commit/1b121483ed04d9576a1291758f537e1318cddc8b"><code>1b12148</code></a> Update ossf/scorecard-action to v2.3.1</li>
<li><a href="https://github.com/kjd/idna/commit/d516b874c3388047934938a500c7488d52c4e067"><code>d516b87</code></a> Update Github actions/checkout to v4</li>
<li><a href="https://github.com/kjd/idna/commit/c095c75943413c75ebf8ac74179757031b7f80b7"><code>c095c75</code></a> Merge branch 'master' into dev</li>
<li><a href="https://github.com/kjd/idna/commit/60a0a4cb61ec6834d74306bd8a1fa46daac94c98"><code>60a0a4c</code></a> Fix typo in GitHub Actions workflow key</li>
<li><a href="https://github.com/kjd/idna/commit/5918a0ef8034379c2e409ae93ee11d24295bb201"><code>5918a0e</code></a> Merge branch 'master' into dev</li>
<li>Additional commits viewable in <a href="https://github.com/kjd/idna/compare/v3.6...v3.7">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/canonical/snapcraft/network/alerts).
</details>
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Dependabot PR bumping idna 3.6→3.7 was closed unmerged by mr-cal in favour of the Renovate security PR #4726, which updated idna and landed as commit 077ebbfff. | |
| stealth/space-bunny-alpha | — | closed superseded | Dependabot idna 3.6→3.7 bump PR closed unmerged by @mr-cal on 2024-04-12 in favour of canonical/snapcraft#4726, which was merged as commit 077ebbfff updating idna to 3.7 (CVE-2024-3651). | |
| stealth/space-bunny-alpha | — | closed superseded | Dependabot idna 3.6→3.7 bump closed unmerged by @mr-cal in favour of PR #4726, which merged as commit 077ebbfff updating idna to 3.7 for CVE-2024-3651. | |
| stealth/space-bunny-alpha | — | closed superseded | Dependabot's idna 3.6→3.7 bump was closed unused; maintainer @mr-cal closed it in favour of the companion security PR #4726, which merged the same idna 3.7 update as commit 077ebbfff. | |
| stealth/space-bunny-alpha | — | closed superseded | Closed as superseded by canonical/snapcraft#4726, which merged the idna 3.7 security update in commit 077ebbfff to address CVE-2024-3651. | |
| stealth/space-bunny-alpha | — | closed superseded | Closed as superseded by canonical/snapcraft#4726, which merged the idna 3.7 security update addressing CVE-2024-3651. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed and superseded by pull request #4726. Dependabot proposed bumping idna from 3.6 to 3.7 to address CVE-2024-3651. The dependency update was handled through the referenced PR instead. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed in favor of pull request #4726 to bump the idna dependency from 3.6 to 3.7, addressing CVE-2024-3651. The update was superseded by a consolidated change. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/snapcraft#4726
(confidence 98%)
Explicitly cited in the closing maintainer comment; merged as commit 077ebbfff updating idna to v3.7 [security].
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4725 build(deps): bump idna from 3.4 to 3.7 in /docs/.sphinx | snapcraft | closed | Dependabot PR to bump idna 3.4->3.7 in /docs/.sphinx was closed by @mr-cal on 2024-04-12 in favour of PR #4726, which landed the same upgrade as commit 077ebbfff fixing CVE-2024-3651. | |
| #346 build(deps): bump idna | imagecraft | merged | Merged PR #346 in commit 4bf75c9, updating idna from 3.11 to 3.15 to resolve an OSV vulnerability. | |
| #1938 build(deps): update dependency idna to v3.10 (main) | charmcraft | merged | Merged PR #1938 in commit afd3b394, updating idna from 3.7 to 3.10 after tests passed and maintainers approved it. | |
| #4726 chore(deps): update dependency idna to v3.7 [security] | snapcraft | merged | Renovate PR #4726 merged as commit 077ebbfff, pinning idna 3.4/3.6 -> 3.7 to fix CVE-2024-3651 (idna.encode() DoS). Later bumped to 3.10 in #5439. | |
| #545 chore(deps): update dependency idna to v3.7 | rockcraft | merged | Renovate PR #545 was merged, updating idna from 3.6 to 3.7 in commit 8432a136 after two approvals. | |
| #951 Update dependency idna to v3.4 - autoclosed | charmcraft | closed | Renovate's idna 3.3-to-3.4 PR was closed unmerged (autoclosed, no reviews/CI). The same bump landed in the bulk dependency update commit c545a05f (PR #1493); idna has since moved to 3.18 via uv.lock. | |
| #1615 build(deps): bump idna + urllib3 | craft-parts | merged | Merged #1615 in commit dd195de9, updating idna 3.11→3.18 and urllib3 2.6.3→2.7.0 to address reported OSV findings. | |
| #1644 chore(deps): update dependency idna to v3.7 [security] | charmcraft | merged | Renovate security bump of idna 3.6 -> 3.7 (CVE-2024-3651 DoS) merged into main via commit 2f38be1e, updating requirements.txt and the lock file; approved by 2 reviewers. Later superseded by #1938 (idna 3.10). | |
| #1076 build(deps): bump idna, urllib3 | craft-application | merged | Merged idna and urllib3 dependency bumps to address OSV findings; commit 80a58477 records the accepted change. | |
| #5439 build(deps): update dependency idna to v3.10 (main) | snapcraft | merged | Merged #5439 via commit 1a4ddda70, updating Snapcraft's pinned idna dependency from 3.7 to 3.10. |