search

ghc-automation-staging-parallel-4-p1 / 13463163_25

0 stars 0 forks source link

Update dependency Jinja2 to v2.11.3 - autoclosed #14

Closed staging-whitesource-for-github-com[bot] closed 4 hours ago

staging-whitesource-for-github-com[bot] commented 4 hours ago

This PR contains the following updates:

Package Update Change
Jinja2 (changelog) minor ==2.8 -> ==2.11.3

By merging this PR, the below issues will be automatically resolved and closed:

Severity CVSS Score CVE GitHub Issue
High 8.6 CVE-2016-10745 #6
High 8.6 CVE-2019-10906 #5
Medium 5.3 CVE-2020-28493 #13

Release Notes

pallets/jinja (Jinja2) ### [`v2.11.3`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-2113) [Compare Source](https://togithub.com/pallets/jinja/compare/2.11.2...2.11.3) Released 2021-01-31 - Improve the speed of the `urlize` filter by reducing regex backtracking. Email matching requires a word character at the start of the domain part, and only word characters in the TLD. :pr:`1343` ### [`v2.11.2`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-2112) [Compare Source](https://togithub.com/pallets/jinja/compare/2.11.1...2.11.2) Released 2020-04-13 - Fix a bug that caused callable objects with `__getattr__`, like :class:`~unittest.mock.Mock` to be treated as a :func:`contextfunction`. :issue:`1145` - Update `wordcount` filter to trigger :class:`Undefined` methods by wrapping the input in :func:`soft_str`. :pr:`1160` - Fix a hang when displaying tracebacks on Python 32-bit. :issue:`1162` - Showing an undefined error for an object that raises `AttributeError` on access doesn't cause a recursion error. :issue:`1177` - Revert changes to :class:`~loaders.PackageLoader` from 2.10 which removed the dependency on setuptools and pkg_resources, and added limited support for namespace packages. The changes caused issues when using Pytest. Due to the difficulty in supporting Python 2 and :pep:`451` simultaneously, the changes are reverted until 3.0. :pr:`1182` - Fix line numbers in error messages when newlines are stripped. :pr:`1178` - The special `namespace()` assignment object in templates works in async environments. :issue:`1180` - Fix whitespace being removed before tags in the middle of lines when `lstrip_blocks` is enabled. :issue:`1138` - :class:`~nativetypes.NativeEnvironment` doesn't evaluate intermediate strings during rendering. This prevents early evaluation which could change the value of an expression. :issue:`1186` ### [`v2.11.1`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-2111) [Compare Source](https://togithub.com/pallets/jinja/compare/2.11.0...2.11.1) Released 2020-01-30 - Fix a bug that prevented looking up a key after an attribute (`{{ data.items[1:] }}`) in an async template. :issue:`1141` ### [`v2.11.0`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-2110) [Compare Source](https://togithub.com/pallets/jinja/compare/2.10.3...2.11.0) Released 2020-01-27 - Drop support for Python 2.6, 3.3, and 3.4. This will be the last version to support Python 2.7 and 3.5. - Added a new `ChainableUndefined` class to support getitem and getattr on an undefined object. :issue:`977` - Allow `{%+` syntax (with NOP behavior) when `lstrip_blocks` is disabled. :issue:`748` - Added a `default` parameter for the `map` filter. :issue:`557` - Exclude environment globals from :func:`meta.find_undeclared_variables`. :issue:`931` - Float literals can be written with scientific notation, like 2.56e-3. :issue:`912`, :pr:`922` - Int and float literals can be written with the '\_' separator for legibility, like 12\_345. :pr:`923` - Fix a bug causing deadlocks in `LRUCache.setdefault`. :pr:`1000` - The `trim` filter takes an optional string of characters to trim. :pr:`828` - A new `jinja2.ext.debug` extension adds a `{% debug %}` tag to quickly dump the current context and available filters and tests. :issue:`174`, :pr:`798, 983` - Lexing templates with large amounts of whitespace is much faster. :issue:`857`, :pr:`858` - Parentheses around comparisons are preserved, so `{{ 2 * (3 < 5) }}` outputs "2" instead of "False". :issue:`755`, :pr:`938` - Add new `boolean`, `false`, `true`, `integer` and `float` tests. :pr:`824` - The environment's `finalize` function is only applied to the output of expressions (constant or not), not static template data. :issue:`63` - When providing multiple paths to `FileSystemLoader`, a template can have the same name as a directory. :issue:`821` - Always return :class:`Undefined` when omitting the `else` clause in a `{{ 'foo' if bar }}` expression, regardless of the environment's `undefined` class. Omitting the `else` clause is a valid shortcut and should not raise an error when using :class:`StrictUndefined`. :issue:`710`, :pr:`1079` - Fix behavior of `loop` control variables such as `length` and `revindex0` when looping over a generator. :issue:`459, 751, 794`, :pr:`993` - Async support is only loaded the first time an environment enables it, in order to avoid a slow initial import. :issue:`765` - In async environments, the `|map` filter will await the filter call if needed. :pr:`913` - In for loops that access `loop` attributes, the iterator is not advanced ahead of the current iteration unless `length`, `revindex`, `nextitem`, or `last` are accessed. This makes it less likely to break `groupby` results. :issue:`555`, :pr:`1101` - In async environments, the `loop` attributes `length` and `revindex` work for async iterators. :pr:`1101` - In async environments, values from attribute/property access will be awaited if needed. :pr:`1101` - :class:`~loader.PackageLoader` doesn't depend on setuptools or pkg_resources. :issue:`970` - `PackageLoader` has limited support for :pep:`420` namespace packages. :issue:`1097` - Support :class:`os.PathLike` objects in :class:`~loader.FileSystemLoader` and :class:`~loader.ModuleLoader`. :issue:`870` - :class:`~nativetypes.NativeTemplate` correctly handles quotes between expressions. `"'{{ a }}', '{{ b }}'"` renders as the tuple `('1', '2')` rather than the string `'1, 2'`. :issue:`1020` - Creating a :class:`~nativetypes.NativeTemplate` directly creates a :class:`~nativetypes.NativeEnvironment` instead of a default :class:`Environment`. :issue:`1091` - After calling `LRUCache.copy()`, the copy's queue methods point to the correct queue. :issue:`843` - Compiling templates always writes UTF-8 instead of defaulting to the system encoding. :issue:`889` - `|wordwrap` filter treats existing newlines as separate paragraphs to be wrapped individually, rather than creating short intermediate lines. :issue:`175` - Add `break_on_hyphens` parameter to `|wordwrap` filter. :issue:`550` - Cython compiled functions decorated as context functions will be passed the context. :pr:`1108` - When chained comparisons of constants are evaluated at compile time, the result follows Python's behavior of returning `False` if any comparison returns `False`, rather than only the last one. :issue:`1102` - Tracebacks for exceptions in templates show the correct line numbers and source for Python >= 3.7. :issue:`1104` - Tracebacks for template syntax errors in Python 3 no longer show internal compiler frames. :issue:`763` - Add a `DerivedContextReference` node that can be used by extensions to get the current context and local variables such as `loop`. :issue:`860` - Constant folding during compilation is applied to some node types that were previously overlooked. :issue:`733` - `TemplateSyntaxError.source` is not empty when raised from an included template. :issue:`457` - Passing an `Undefined` value to `get_template` (such as through `extends`, `import`, or `include`), raises an `UndefinedError` consistently. `select_template` will show the undefined message in the list of attempts rather than the empty string. :issue:`1037` - `TemplateSyntaxError` can be pickled. :pr:`1117` ### [`v2.10.3`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-2103) [Compare Source](https://togithub.com/pallets/jinja/compare/2.10.2...2.10.3) Released 2019-10-04 - Fix a typo in Babel entry point in `setup.py` that was preventing installation. ### [`v2.10.2`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-2102) [Compare Source](https://togithub.com/pallets/jinja/compare/2.10.1...2.10.2) Released 2019-10-04 - Fix Python 3.7 deprecation warnings. - Using `range` in the sandboxed environment uses `xrange` on Python 2 to avoid memory use. :issue:`933` - Use Python 3.7's better traceback support to avoid a core dump when using debug builds of Python 3.7. :issue:`1050` ### [`v2.10.1`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-2101) [Compare Source](https://togithub.com/pallets/jinja/compare/2.10...2.10.1) Released 2019-04-06 - `SandboxedEnvironment` securely handles `str.format_map` in order to prevent code execution through untrusted format strings. The sandbox already handled `str.format`. ### [`v2.10`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-2103) [Compare Source](https://togithub.com/pallets/jinja/compare/2.9.6...2.10) Released 2019-10-04 - Fix a typo in Babel entry point in `setup.py` that was preventing installation. ### [`v2.9.6`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-296) [Compare Source](https://togithub.com/pallets/jinja/compare/2.9.5...2.9.6) Released 2017-04-03 - Fixed custom context behavior in fast resolve mode :issue:`675` ### [`v2.9.5`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-295) [Compare Source](https://togithub.com/pallets/jinja/compare/2.9.4...2.9.5) Released 2017-01-28 - Restored the original repr of the internal `_GroupTuple` because this caused issues with ansible and it was an unintended change. :issue:`654` - Added back support for custom contexts that override the old `resolve` method since it was hard for people to spot that this could cause a regression. - Correctly use the buffer for the else block of for loops. This caused invalid syntax errors to be caused on 2.x and completely wrong behavior on Python 3 :issue:`669` - Resolve an issue where the `{% extends %}` tag could not be used with async environments. :issue:`668` - Reduce memory footprint slightly by reducing our unicode database dump we use for identifier matching on Python 3 :issue:`666` - Fixed autoescaping not working for macros in async compilation mode. :issue:`671` ### [`v2.9.4`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-294) [Compare Source](https://togithub.com/pallets/jinja/compare/2.9.3...2.9.4) Released 2017-01-10 - Solved some warnings for string literals. :issue:`646` - Increment the bytecode cache version which was not done due to an oversight before. - Corrected bad code generation and scoping for filtered loops. :issue:`649` - Resolved an issue where top-level output silencing after known extend blocks could generate invalid code when blocks where contained in if statements. :issue:`651` - Made the `truncate.leeway` default configurable to improve compatibility with older templates. ### [`v2.9.3`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-293) [Compare Source](https://togithub.com/pallets/jinja/compare/2.9.2...2.9.3) Released 2017-01-08 - Restored the use of blocks in macros to the extend that was possible before. On Python 3 it would render a generator repr instead of the block contents. :issue:`645` - Set a consistent behavior for assigning of variables in inner scopes when the variable is also read from an outer scope. This now sets the intended behavior in all situations however it does not restore the old behavior where limited assignments to outer scopes was possible. For more information and a discussion see :issue:`641` - Resolved an issue where `block scoped` would not take advantage of the new scoping rules. In some more exotic cases a variable overridden in a local scope would not make it into a block. - Change the code generation of the `with` statement to be in line with the new scoping rules. This resolves some unlikely bugs in edge cases. This also introduces a new internal `With` node that can be used by extensions. ### [`v2.9.2`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-292) [Compare Source](https://togithub.com/pallets/jinja/compare/2.9.1...2.9.2) Released 2017-01-08 - Fixed a regression that caused for loops to not be able to use the same variable for the target as well as source iterator. :issue:`640` - Add support for a previously unknown behavior of macros. It used to be possible in some circumstances to explicitly provide a caller argument to macros. While badly buggy and unintended it turns out that this is a common case that gets copy pasted around. To not completely break backwards compatibility with the most common cases it's now possible to provide an explicit keyword argument for caller if it's given an explicit default. :issue:`642` ### [`v2.9.1`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-291) [Compare Source](https://togithub.com/pallets/jinja/compare/2.9...2.9.1) Released 2017-01-07 - Resolved a regression with call block scoping for macros. Nested caller blocks that used the same identifiers as outer macros could refer to the wrong variable incorrectly. ### [`v2.9`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-296) [Compare Source](https://togithub.com/pallets/jinja/compare/2.8.1...2.9) Released 2017-04-03 - Fixed custom context behavior in fast resolve mode :issue:`675` ### [`v2.8.1`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-281) [Compare Source](https://togithub.com/pallets/jinja/compare/2.8...2.8.1) Released 2016-12-29 - Fixed the `for_qs` flag for `urlencode`. - Fixed regression when applying `int` to non-string values. - SECURITY: if the sandbox mode is used format expressions are now sandboxed with the same rules as in Jinja. This solves various information leakage problems that can occur with format strings.