← Back to issue list

build(deps): update jinja to 3.1.6

View original Github issue

Metadata

Project
snapcraft
Number
#5305
Type
pull request
State
merged
Author
mr-cal
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #5305 upgraded Snapcraft's main Jinja dependency to 3.1.6 to address GHSA-cpwx-vrp4-4pq7; PR #5312 separately updated the Sphinx docs dependency.

Resolution: closed resolved

Reason: PR #5305 was merged with two approvals and no unresolved comments, updating Jinja to the patched 3.1.6 release specifically to address GHSA-cpwx-vrp4-4pq7.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [x] Have you followed the [guidelines for contributing](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md)? - [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [x] Have you successfully run `make lint`? - [x] Have you successfully run `make test`? --- Addresses https://osv.dev/vulnerability/GHSA-cpwx-vrp4-4pq7

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #5305 upgraded Snapcraft's main Jinja dependency to 3.1.6 to address GHSA-cpwx-vrp4-4pq7; PR #5312 separately updated the Sphinx docs dependency.
stealth/space-bunny-alpha — closed resolved Merged canonical/snapcraft#5305, upgrading Jinja to 3.1.6 to address vulnerability GHSA-cpwx-vrp4-4pq7.
stealth/space-bunny-alpha — closed resolved Merged PR #5305 updated Jinja to 3.1.6, addressing security vulnerability GHSA-cpwx-vrp4-4pq7.
stealth/space-bunny-alpha — closed resolved Merged PR #5305, updating Jinja to 3.1.6 to address GHSA-cpwx-vrp4-4pq7. The change landed in commit 14f156ea9.
stealth/space-bunny-alpha — closed resolved Merged #5305 updates Jinja to 3.1.6, addressing security vulnerability GHSA-cpwx-vrp4-4pq7.
qwen/qwen3.6-35b-a3b — — Merged update to jinja 3.1.6 to resolve security vulnerability GHSA-cpwx-vrp4-4pq7. Approved by two reviewers, passed CI, and integrated without comments.
qwen3.6-35b-a3b-mtp-q6 — — Merged dependency update upgrading Jinja2 to 3.1.6 to patch security vulnerability GHSA-cpwx-vrp4-4pq7. Code passed lint and test checks prior to integration.

Update history

No update history recorded yet.

Related work

  • Related To: snapcraft#5312 (confidence 99%)

    Merged as 8bc04497; bumped Jinja2 from 3.1.5 to 3.1.6 in the Sphinx docs environment for the same advisory.

Related issues

Issue Project State Summary Similarity
#5309 build(deps): update dependency jinja2 to v3.1.6 [security] (hotfix/8.7) - autoclosed snapcraft closed Renovate PR #5309 was autoclosed unmerged; Jinja2 3.1.6 reached Snapcraft 8.7.2 through merged hotfix PR #5311, backporting the update from #5305.
84%
#5189 build(deps): bump jinja2 from 3.1.4 to 3.1.5 snapcraft closed Closed as obsolete: Jinja2 was already updated; a later bump to 3.1.6 merged via snapcraft#5312 (8bc04497).
81%
#106 build(deps): bump jinja2 from 3.1.5 to 3.1.6 imagecraft merged Merged as commit 4844f1d, upgrading Jinja2 from 3.1.5 to 3.1.6 to address GHSA-cpwx-vrp4-4pq7.
81%
#5312 build(deps): bump jinja2 from 3.1.5 to 3.1.6 in /docs/.sphinx snapcraft merged Dependabot PR merged as commit 8bc04497, bumping Jinja2 3.1.5 to 3.1.6 in the Sphinx docs requirements to fix sandbox bypass GHSA-cpwx-vrp4-4pq7.
80%
#5190 build(deps): update dependency jinja2 to v3.1.5 [security] (main) snapcraft merged Merged PR #5190 (commit 98511dc44), upgrading Jinja2 from 3.1.4 to 3.1.5 to address CVE-2024-56326 and CVE-2024-56201.
78%
#2064 build(deps): update dependency jinja2 to v3.1.5 [security] (main) charmcraft merged Merged PR #2064 via commit 979176de, upgrading Jinja2 from 3.1.4 to 3.1.5 to fix CVE-2024-56326 and CVE-2024-56201.
78%
#4518 build(deps): bump jinja2 from 3.1.2 to 3.1.3 in /docs/.sphinx snapcraft merged Merged in #4518 via commit 9fc449a66, updating Jinja2 from 3.1.2 to 3.1.3 in /docs/.sphinx and including the xmlattr security fix.
75%
#4788 build(deps): bump jinja2 from 3.1.3 to 3.1.4 in /docs/.sphinx snapcraft closed Closed unmerged as redundant: commit 3869f7517 had already upgraded Jinja2 to 3.1.4; Dependabot confirmed the proposed bump was no longer needed.
75%
#1038 build(deps): update jinja2 to 3.1.6 craft-parts merged Merged PR #1038 via commit 4af3a08b, upgrading Jinja2 to 3.1.6 to address CVE-2025-27516, a sandbox breakout through the attr filter.
74%
#2206 build(deps-dev): bump jinja2 from 3.1.5 to 3.1.6 charmcraft closed Jinja2 was already upgraded to 3.1.6 by #2189 (commit bba6a32e), so Dependabot closed unmerged PR #2206 as unnecessary.
74%