This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.
The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. GHSA-h75v-3vvj-5mfj
The xmlattr filter does not allow keys with / solidus, >
greater-than sign, or = equals sign, in addition to disallowing spaces.
Regardless of any validation done by Jinja, user input should never be used
as keys to this filter, or must be separately validated first.
:ghsa:h75v-3vvj-5mfj
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the dependencies group in /.config with 5 updates:
2.19.1
2.20.0
0.44.0
0.45.0
3.1.3
3.1.4
9.5.21
9.5.22
2024.4.28
2024.5.10
Updates
pipdeptree
from 2.19.1 to 2.20.0Release notes
Sourced from pipdeptree's releases.
Commits
e88356f
Mimic pip when handling --user-only in a virtual environment (#364)1476bf7
[pre-commit.ci] pre-commit autoupdate (#363)4c832b5
Remove publish job from the check workflow (#361)a1bf845
[pre-commit.ci] pre-commit autoupdate (#360)Updates
griffe
from 0.44.0 to 0.45.0Release notes
Sourced from griffe's releases.
Changelog
Sourced from griffe's changelog.
Commits
587346e
chore: Prepare release 0.45.0eeb497f
refactor: Improve stats code and performance721ce7d
docs: Fix example in SetMembersMixin docstringbc0f74b
fix: Pass down modules collection when inspecting776063d
feat: Implement-x
,--force-inspection
CLI option3266f22
feat: Implementforce_inspection
option in the loader API02b2d7c
tests: Moveclear_sys_modules
helper in a helper moduled0b7a1d
refactor: Recurse immediately into non-discoverable submodules (no path on di...fc794c2
refactor: Simplify the code that checks if an object should be aliased or not...a6bfcfd
refactor: Avoid side-effect in inspector by checking early if an object is a ...Updates
jinja2
from 3.1.3 to 3.1.4Release notes
Sourced from jinja2's releases.
Changelog
Sourced from jinja2's changelog.
Commits
dd4a8b5
release version 3.1.40668239
Merge pull request from GHSA-h75v-3vvj-5mfjd655030
disallow invalid characters in keys to xmlattr filtera7863ba
add ghsa linksb5c98e7
start version 3.1.4da3a9f0
update project files (#1968)0ee5eb4
satisfy formatter, linter, and strict mypy20477c6
update project files (#5457)e491223
update pyyaml dev dependency36f9885
fix pr linkUpdates
mkdocs-material
from 9.5.21 to 9.5.22Release notes
Sourced from mkdocs-material's releases.
Changelog
Sourced from mkdocs-material's changelog.
... (truncated)
Commits
b2b6571
Prepare 9.5.22 release78fd41a
Updated dependenciesceacfe5
Fixed stay on same page for version selector (9.5.5 regression)937d7cc
Fixed empty lines when copying (9.5.18 regression)bd708f1
Documentation (#7166)c1336ae
Added missing validation/links/anchors to validation.json schema (#7158)1c7e954
Updated dependenciesb1185aa
Fixed JSON parse error in schema.json (#7152)0de8be2
Documentation (#6937)05661a1
Added underline to nodes with links in Mermaid diagramsUpdates
regex
from 2024.4.28 to 2024.5.10Commits
be139ff
Updated for Python 3.13.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show