chore(deps): update dependency zipp to v3.19.1 [security] - autoclosed
Metadata
Current evaluation
Renovate's zipp 3.17.0/3.18.1 -> 3.19.1 security bump (CVE-2024-5569) was autoclosed because Dependabot PR #4901 merged the identical update in commit de7f1d5ad.
Resolution: closed superseded
Reason: PR #4901 (build(deps): bump zipp from 3.17.0 to 3.19.1) was merged as commit de7f1d5adad, applying the same zipp 3.19.1 security fix for CVE-2024-5569. With the dependency already updated on main, this duplicate Renovate PR was closed without merge.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [zipp](https://togithub.com/jaraco/zipp) | `==3.17.0` -> `==3.19.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
| [zipp](https://togithub.com/jaraco/zipp) | `==3.18.1` -> `==3.19.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-5569](https://nvd.nist.gov/vuln/detail/CVE-2024-5569)
A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.
---
### Release Notes
<details>
<summary>jaraco/zipp (zipp)</summary>
### [`v3.19.1`](https://togithub.com/jaraco/zipp/compare/v3.19.0...v3.19.1)
[Compare Source](https://togithub.com/jaraco/zipp/compare/v3.19.0...v3.19.1)
### [`v3.19.0`](https://togithub.com/jaraco/zipp/compare/v3.18.2...v3.19.0)
[Compare Source](https://togithub.com/jaraco/zipp/compare/v3.18.2...v3.19.0)
### [`v3.18.2`](https://togithub.com/jaraco/zipp/compare/v3.18.1...v3.18.2)
[Compare Source](https://togithub.com/jaraco/zipp/compare/v3.18.1...v3.18.2)
### [`v3.18.1`](https://togithub.com/jaraco/zipp/compare/v3.18.0...v3.18.1)
[Compare Source](https://togithub.com/jaraco/zipp/compare/v3.18.0...v3.18.1)
### [`v3.18.0`](https://togithub.com/jaraco/zipp/compare/v3.17.0...v3.18.0)
[Compare Source](https://togithub.com/jaraco/zipp/compare/v3.17.0...v3.18.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC.
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MjUuMSIsInVwZGF0ZWRJblZlciI6IjM3LjQyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Renovate's zipp 3.17.0/3.18.1 -> 3.19.1 security bump (CVE-2024-5569) was autoclosed because Dependabot PR #4901 merged the identical update in commit de7f1d5ad. | |
| stealth/space-bunny-alpha | — | closed superseded | Renovate's zipp 3.19.1 security bump was autoclosed because the identical Dependabot bump (snapcraft#4901) was merged first, landing in commit de7f1d5ad. | |
| stealth/space-bunny-alpha | — | closed superseded | Renovate PR for zipp 3.19.1 was autoclosed after Dependabot PR #4901 merged the same security bump in commit de7f1d5ad. | |
| stealth/space-bunny-alpha | — | closed superseded | zipp 3.19.1 was updated via #4901 (commit de7f1d5ad), addressing CVE-2024-5569; duplicate Renovate PR #4902 was autoclosed unmerged. | |
| qwen/qwen3.6-35b-a3b | — | — | Renovate bot PR updating zipp to v3.19.1 for CVE-2024-5569 was autoclosed without merging. The security update was not applied via this pull request. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate autoclosed the security update PR for zipp to v3.19.1 without merging it. The dependency update was abandoned. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/snapcraft#4901
(confidence 95%)
Merged Dependabot bump of zipp 3.17.0 -> 3.19.1 in commit de7f1d5ad, covering the same CVE-2024-5569 fix
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1724 chore(deps): update dependency zipp to v3.19.1 [security] | charmcraft | merged | Merged PR #1724 in commit 4632f60f, upgrading zipp from 3.18.1 to 3.19.1 to address CVE-2024-5569. | |
| #1645 chore(deps): update dependency zipp to v3.18.1 | charmcraft | merged | Renovate's zipp 3.18.0-to-3.18.1 dependency update was approved and merged in commit 77d438c2, changing two dependency files. | |
| #1016 chore(deps): update dependency zipp to v3.15.0 | charmcraft | merged | Renovate PR #1016 bumped zipp from 3.11.0 to 3.15.0 and was merged to main in commit 656df82f (change commit 023a1dca). | |
| #1111 chore(deps): update dependency requests to v2.31.0 [security] - abandoned | charmcraft | closed | Renovate's requests 2.28.2 -> 2.31.0 security PR was closed empty (0 files) after autoclosing was skipped due to a modified branch; the identical CVE-2023-32681 upgrade landed via merged Dependabot PR #1110 (10d6d55a). | |
| #61 chore(deps): update dependency requests to v2.32.2 [security] - autoclosed | imagecraft | closed | Renovate's requests 2.32.2 update was autoclosed unmerged; requests was later updated to 2.33.0 by merged PR #308 (commit cbca1c1). | |
| #1689 chore(deps): update dependency requests to v2.32.0 [security] - autoclosed | charmcraft | closed | Renovate’s requests 2.32.0 security update was autoclosed unmerged after 864 days, with no reviews, comments, or CI checks. | |
| #4773 chore(deps): update dependency pip to v23 [security] - autoclosed | snapcraft | closed | Renovate PR #4773 was autoclosed without merge; Dependabot PR #4776 superseded it by merging the same pip 22.0.2→23.3 docs upgrade in commit 99387d281. | |
| #4812 chore(deps): update dependency requests to v2.32.0 [security] - autoclosed | snapcraft | closed | Renovate PR #4812 was autoclosed unmerged after 856 days; the security upgrade was later delivered by #5064 (commit ec4f9b16f), raising requests from 2.31.0 to 2.32.2. | |
| #968 chore(deps): update dependency filelock to v3.9.0 | charmcraft | merged | Renovate PR #968 updated filelock from 3.8.2 to 3.9.0 and merged via e4678923; implementation commit e3ccc132. | |
| #1056 chore(deps): update dependency cryptography to v39 [security] | charmcraft | closed | Renovate's cryptography 3.4.8->39.0.1 security bump was closed unmerged; maintainer lengau pointed to #1024, which merged as commit 96f6a183 upgrading to 39.0 (plus Rust build deps) and closing #991. |