build(deps): bump idna from 3.6 to 3.7
Metadata
Current evaluation
Closed and superseded by pull request #4726. Dependabot proposed bumping idna from 3.6 to 3.7 to address CVE-2024-3651. The dependency update was handled through the referenced PR instead.
Suggested action: —
No scores available.
Issue body
Bumps [idna](https://github.com/kjd/idna) from 3.6 to 3.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/kjd/idna/releases">idna's releases</a>.</em></p>
<blockquote>
<h2>v3.7</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]</li>
</ul>
<p>Thanks to Guido Vranken for reporting the issue.</p>
<p><strong>Full Changelog</strong>: <a href="https://github.com/kjd/idna/compare/v3.6...v3.7">https://github.com/kjd/idna/compare/v3.6...v3.7</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/kjd/idna/blob/master/HISTORY.rst">idna's changelog</a>.</em></p>
<blockquote>
<p>3.7 (2024-04-11)
++++++++++++++++</p>
<ul>
<li>Fix issue where specially crafted inputs to encode() could
take exceptionally long amount of time to process. [CVE-2024-3651]</li>
</ul>
<p>Thanks to Guido Vranken for reporting the issue.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d"><code>1d365e1</code></a> Release v3.7</li>
<li><a href="https://github.com/kjd/idna/commit/c1b3154939907fab67c5754346afaebe165ce8e6"><code>c1b3154</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/172">#172</a> from kjd/optimize-contextj</li>
<li><a href="https://github.com/kjd/idna/commit/0394ec76ff022813e770ba1fd89658790ea35623"><code>0394ec7</code></a> Merge branch 'master' into optimize-contextj</li>
<li><a href="https://github.com/kjd/idna/commit/cd58a23173d2b0a40b95ee680baf3e59e8d33966"><code>cd58a23</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/152">#152</a> from elliotwutingfeng/dev</li>
<li><a href="https://github.com/kjd/idna/commit/5beb28b9dd77912c0dd656d8b0fdba3eb80222e7"><code>5beb28b</code></a> More efficient resolution of joiner contexts</li>
<li><a href="https://github.com/kjd/idna/commit/1b121483ed04d9576a1291758f537e1318cddc8b"><code>1b12148</code></a> Update ossf/scorecard-action to v2.3.1</li>
<li><a href="https://github.com/kjd/idna/commit/d516b874c3388047934938a500c7488d52c4e067"><code>d516b87</code></a> Update Github actions/checkout to v4</li>
<li><a href="https://github.com/kjd/idna/commit/c095c75943413c75ebf8ac74179757031b7f80b7"><code>c095c75</code></a> Merge branch 'master' into dev</li>
<li><a href="https://github.com/kjd/idna/commit/60a0a4cb61ec6834d74306bd8a1fa46daac94c98"><code>60a0a4c</code></a> Fix typo in GitHub Actions workflow key</li>
<li><a href="https://github.com/kjd/idna/commit/5918a0ef8034379c2e409ae93ee11d24295bb201"><code>5918a0e</code></a> Merge branch 'master' into dev</li>
<li>Additional commits viewable in <a href="https://github.com/kjd/idna/compare/v3.6...v3.7">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/canonical/snapcraft/network/alerts).
</details>
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Closed and superseded by pull request #4726. Dependabot proposed bumping idna from 3.6 to 3.7 to address CVE-2024-3651. The dependency update was handled through the referenced PR instead. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed in favor of pull request #4726 to bump the idna dependency from 3.6 to 3.7, addressing CVE-2024-3651. The update was superseded by a consolidated change. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed in favor of PR #4726. The idna dependency bump from 3.6 to 3.7 to patch CVE-2024-3651 was superseded by an alternative pull request. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4725 build(deps): bump idna from 3.4 to 3.7 in /docs/.sphinx | snapcraft | closed | Dependabot PR to update idna to 3.7 for CVE-2024-3651 was closed and superseded by pull request #4726. The security patch was applied in the alternative branch instead. | |
| #346 build(deps): bump idna | imagecraft | merged | Merged dependency update bumping idna from 3.11 to 3.15 to resolve an OSV vulnerability. Approved by two reviewers with all CI checks passing. Single file change with minimal modifications. | |
| #1938 build(deps): update dependency idna to v3.10 (main) | charmcraft | merged | Merged automated dependency update upgrading idna from v3.7 to v3.10. The change passed CI checks, received two approvals, and was merged into the main branch. | |
| #1615 build(deps): bump idna + urllib3 | craft-parts | merged | Merged dependency update bumping idna to v3.18 and urllib3 to v2.7.0 to resolve open source vulnerabilities. Approved by two reviewers and passed CI checks. | |
| #1076 build(deps): bump idna, urllib3 | craft-application | merged | Merged dependency update bumping idna and urllib3 to resolve OSV security vulnerabilities. Approved by one reviewer with all CI checks passing. The change modifies a single file with minimal adjustments. | |
| #5439 build(deps): update dependency idna to v3.10 (main) | snapcraft | merged | Merged automated idna dependency update from v3.7 to v3.10 into main. Approved by two reviewers and passed CI checks before successful integration. | |
| #6265 build(deps): bump idna, urllib3 | snapcraft | merged | Merged a dependency update bumping idna and urllib3 to resolve OSV security vulnerabilities. Approved by two reviewers and successfully passed CI checks. | |
| #4726 chore(deps): update dependency idna to v3.7 [security] | snapcraft | merged | Merged automated dependency update upgrading idna to v3.7 from v3.6 and v3.4. Resolves CVE-2024-3651 denial-of-service vulnerability in idna.encode(). Approved by reviewers, passed CI, and merged to main. | |
| #1644 chore(deps): update dependency idna to v3.7 [security] | charmcraft | merged | Merged automated dependency update upgrading idna from v3.6 to v3.7 to resolve CVE-2024-3651, a denial-of-service vulnerability in the encode function. Approved by reviewers and passed CI checks. | |
| #545 chore(deps): update dependency idna to v3.7 | rockcraft | merged | Merged automated dependency update upgrading idna from v3.6 to v3.7. Approved by two reviewers, passed CI checks, and merged into the main branch. |