Skip to content
This repository was archived by the owner on Jan 23, 2025. It is now read-only.

[TEST] Update dependency jinja2 to v3.1.3 #4

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

not7cd
Copy link
Contributor

@not7cd not7cd commented Jan 26, 2024

This PR contains the following updates:

Package Update Change
jinja2 (changelog) patch ==3.1.2 -> ==3.1.3

GitHub Vulnerability Alerts

CVE-2024-22195

The xmlattr filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the xmlattr filter, and an application doing so should already be verifying what keys are provided regardless of this fix.


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@not7cd not7cd changed the title Update dependency jinja2 to v3.1.3 [TEST] Update dependency jinja2 to v3.1.3 Jan 28, 2024
@not7cd not7cd force-pushed the rebobate/pypi-jinja2-vulnerability branch from 1304bbf to a29a9d8 Compare February 12, 2024 22:12
@not7cd
Copy link
Contributor Author

not7cd commented Feb 12, 2024

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: requirements-dev.txt
Command failed: pip-compile --no-emit-index-url requirements-dev.in --upgrade-package=jinja2==3.1.3
  ERROR: Cannot install jinja2==3.1.2 because these package versions have conflicting dependencies.
Traceback (most recent call last):
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/lib/python3.11/site-packages/pip/_vendor/resolvelib/resolvers.py", line 397, in resolve
    self._add_to_criteria(self.state.criteria, r, parent=None)
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/lib/python3.11/site-packages/pip/_vendor/resolvelib/resolvers.py", line 174, in _add_to_criteria
    raise RequirementsConflicted(criterion)
pip._vendor.resolvelib.resolvers.RequirementsConflicted: Requirements conflict: SpecifierRequirement('jinja2==3.1.2')

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/lib/python3.11/site-packages/pip/_internal/resolution/resolvelib/resolver.py", line 95, in resolve
    result = self._result = resolver.resolve(
                            ^^^^^^^^^^^^^^^^^
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/lib/python3.11/site-packages/pip/_vendor/resolvelib/resolvers.py", line 546, in resolve
    state = resolution.resolve(requirements, max_rounds=max_rounds)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/lib/python3.11/site-packages/pip/_vendor/resolvelib/resolvers.py", line 399, in resolve
    raise ResolutionImpossible(e.criterion.information)
pip._vendor.resolvelib.resolvers.ResolutionImpossible: [RequirementInformation(requirement=SpecifierRequirement('jinja2==3.1.2'), parent=None)]

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/bin/pip-compile", line 8, in <module>
    sys.exit(cli())
             ^^^^^
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/lib/python3.11/site-packages/click/core.py", line 1157, in __call__
    return self.main(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/lib/python3.11/site-packages/click/core.py", line 1078, in main
    rv = self.invoke(ctx)
         ^^^^^^^^^^^^^^^^
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/lib/python3.11/site-packages/click/core.py", line 1434, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/lib/python3.11/site-packages/click/core.py", line 783, in invoke
    return __callback(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/lib/python3.11/site-packages/click/decorators.py", line 33, in new_func
    return f(get_current_context(), *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/lib/python3.11/site-packages/piptools/scripts/compile.py", line 659, in cli
    results = resolver.resolve(max_rounds=max_rounds)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/lib/python3.11/site-packages/piptools/resolver.py", line 604, in resolve
    is_resolved = self._do_resolve(
                  ^^^^^^^^^^^^^^^^^
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/lib/python3.11/site-packages/piptools/resolver.py", line 636, in _do_resolve
    resolver.resolve(
  File "/Users/norbertszulc/.pyenv/versions/3.11.6/lib/python3.11/site-packages/pip/_internal/resolution/resolvelib/resolver.py", line 104, in resolve
    raise error from e
pip._internal.exceptions.DistributionNotFound: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants