build(deps): bump jinja2 from 3.1.3 to 3.1.4 in /docs/.sphinx
Metadata
Current evaluation
Closed unmerged as redundant: commit 3869f7517 had already upgraded Jinja2 to 3.1.4; Dependabot confirmed the proposed bump was no longer needed.
Resolution: closed superseded
Reason: Commit 3869f7517 had already applied the Jinja2 3.1.4 security update. Dependabot closed PR #4788 after confirming the dependency was up to date.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps [jinja2](https://github.com/pallets/jinja) from 3.1.3 to 3.1.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/pallets/jinja/releases">jinja2's releases</a>.</em></p>
<blockquote>
<h2>3.1.4</h2>
<p>This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.</p>
<p>PyPI: <a href="https://pypi.org/project/Jinja2/3.1.4/">https://pypi.org/project/Jinja2/3.1.4/</a>
Changes: <a href="https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-4">https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-4</a></p>
<ul>
<li>The <code>xmlattr</code> filter does not allow keys with <code>/</code> solidus, <code>></code> greater-than sign, or <code>=</code> equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. GHSA-h75v-3vvj-5mfj</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pallets/jinja/blob/main/CHANGES.rst">jinja2's changelog</a>.</em></p>
<blockquote>
<h2>Version 3.1.4</h2>
<p>Released 2024-05-05</p>
<ul>
<li>The <code>xmlattr</code> filter does not allow keys with <code>/</code> solidus, <code>></code>
greater-than sign, or <code>=</code> equals sign, in addition to disallowing spaces.
Regardless of any validation done by Jinja, user input should never be used
as keys to this filter, or must be separately validated first.
:ghsa:<code>h75v-3vvj-5mfj</code></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pallets/jinja/commit/dd4a8b5466d8790540c181590b14db4d4d889d57"><code>dd4a8b5</code></a> release version 3.1.4</li>
<li><a href="https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb"><code>0668239</code></a> Merge pull request from GHSA-h75v-3vvj-5mfj</li>
<li><a href="https://github.com/pallets/jinja/commit/d655030770081e2dfe46f90e27620472a502289d"><code>d655030</code></a> disallow invalid characters in keys to xmlattr filter</li>
<li><a href="https://github.com/pallets/jinja/commit/a7863ba9d3521f1450f821119c50d19d7ecea329"><code>a7863ba</code></a> add ghsa links</li>
<li><a href="https://github.com/pallets/jinja/commit/b5c98e78c2ee7d2bf0aa06d29ed9bf7082de9cf4"><code>b5c98e7</code></a> start version 3.1.4</li>
<li><a href="https://github.com/pallets/jinja/commit/da3a9f0b804199845fcb76f2e08748bdaeba93ee"><code>da3a9f0</code></a> update project files (<a href="https://redirect.github.com/pallets/jinja/issues/1968">#1968</a>)</li>
<li><a href="https://github.com/pallets/jinja/commit/0ee5eb41d1a2d7d9a05a02dc26dd70e63aaaeeb1"><code>0ee5eb4</code></a> satisfy formatter, linter, and strict mypy</li>
<li><a href="https://github.com/pallets/jinja/commit/20477c63575175196bfc8103f223cc9f5642595d"><code>20477c6</code></a> update project files (<a href="https://redirect.github.com/pallets/jinja/issues/5457">#5457</a>)</li>
<li><a href="https://github.com/pallets/jinja/commit/e491223739dedbb1f4fc6a71340c1484e149d947"><code>e491223</code></a> update pyyaml dev dependency</li>
<li><a href="https://github.com/pallets/jinja/commit/36f98854c721f98ba103f97f65a8a098da5af0d7"><code>36f9885</code></a> fix pr link</li>
<li>Additional commits viewable in <a href="https://github.com/pallets/jinja/compare/3.1.3...3.1.4">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/canonical/snapcraft/network/alerts).
</details>
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged as redundant: commit 3869f7517 had already upgraded Jinja2 to 3.1.4; Dependabot confirmed the proposed bump was no longer needed. | |
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged as redundant: Jinja2 was already 3.1.4 after commit 3869f7517, so Dependabot said the proposed docs dependency bump was no longer needed. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed and superseded because jinja2 is already at version 3.1.4. The dependency update is no longer needed, so the pull request was abandoned without merging. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed as superseded. Dependabot proposed updating jinja2 to 3.1.4, but the bot noted the dependency is already current, making the PR redundant. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
snapcraft#3869f7517
(confidence 99%)
Merged commit updating Jinja2 to v3.1.4 for security, making the Dependabot PR redundant.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4790 build(deps): bump jinja2 from 3.1.3 to 3.1.4 in /docs | snapcraft | closed | Dependabot's jinja2 3.1.3→3.1.4 bump for /docs was closed unmerged as redundant; PR #4789 already merged as 3869f7517 and Dependabot later confirmed jinja2 was up to date. | |
| #5312 build(deps): bump jinja2 from 3.1.5 to 3.1.6 in /docs/.sphinx | snapcraft | merged | Dependabot PR merged as commit 8bc04497, bumping Jinja2 3.1.5 to 3.1.6 in the Sphinx docs requirements to fix sandbox bypass GHSA-cpwx-vrp4-4pq7. | |
| #4518 build(deps): bump jinja2 from 3.1.2 to 3.1.3 in /docs/.sphinx | snapcraft | merged | Merged in #4518 via commit 9fc449a66, updating Jinja2 from 3.1.2 to 3.1.3 in /docs/.sphinx and including the xmlattr security fix. | |
| #2206 build(deps-dev): bump jinja2 from 3.1.5 to 3.1.6 | charmcraft | closed | Jinja2 was already upgraded to 3.1.6 by #2189 (commit bba6a32e), so Dependabot closed unmerged PR #2206 as unnecessary. | |
| #106 build(deps): bump jinja2 from 3.1.5 to 3.1.6 | imagecraft | merged | Merged as commit 4844f1d, upgrading Jinja2 from 3.1.5 to 3.1.6 to address GHSA-cpwx-vrp4-4pq7. | |
| #5189 build(deps): bump jinja2 from 3.1.4 to 3.1.5 | snapcraft | closed | Closed as obsolete: Jinja2 was already updated; a later bump to 3.1.6 merged via snapcraft#5312 (8bc04497). | |
| #5306 build(deps): update dependency jinja2 to v3.1.6 [security] (main) - autoclosed | snapcraft | closed | Autoclosed unmerged after the Jinja2 3.1.6 security update landed through #5305; #5312 separately updated docs requirements. | |
| #2210 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Jinja2 3.1.6 security bump for hotfix/3.4 was autoclosed unmerged, with no review, CI, comments, or resolving commit. | |
| #2066 build(deps): update dependency jinja2 to v3.1.5 [security] (hotfix/3.2) - autoclosed | charmcraft | closed | Renovate autoclosed #2066 unmerged; the equivalent Jinja2 3.1.5 security update landed on main via #2064 (979176de). | |
| #2207 build(deps): update dependency jinja2 to v3.1.6 [security] (main) - autoclosed | charmcraft | closed | Jinja2 3.1.6 update was autoclosed unmerged; the same pin landed through #2223 in commit e148af23. |