sarvex / ParlAI

A framework for training and evaluating AI models on a variety of openly available dialogue datasets.
https://parl.ai
MIT License
0 stars 0 forks source link

Update dependency jinja2 to v3.1.3 [SECURITY] - autoclosed #74

Closed renovate[bot] closed 4 months ago

renovate[bot] commented 4 months ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
jinja2 (changelog) ==3.0.3 -> ==3.1.3 age adoption passing confidence

[!WARNING] Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2024-22195

The xmlattr filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the xmlattr filter, and an application doing so should already be verifying what keys are provided regardless of this fix.


Configuration

πŸ“… Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

β™» Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

πŸ”• Ignore: Close this PR and you won't be reminded about this update again.



This PR has been generated by Mend Renovate. View repository job log here.

sonarcloud[bot] commented 4 months ago

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

github-actions[bot] commented 4 months ago

πŸ¦™ MegaLinter status: ❌ ERROR

Descriptor Linter Files Fixed Errors Elapsed time
❌ ACTION actionlint 4 9 0.06s
⚠️ BASH bash-exec 16 7 0.05s
❌ BASH shellcheck 16 64 0.38s
βœ… BASH shfmt 16 11 0 0.66s
❌ COPYPASTE jscpd yes 738 32.83s
❌ CSS stylelint 10 5 1 4.3s
❌ DOCKERFILE hadolint 1 1 0.13s
❌ HTML djlint 23 5077 180.8s
❌ HTML htmlhint 23 37 0.64s
❌ JAVASCRIPT standard 61 61 1 22.59s
❌ JSON eslint-plugin-jsonc 55 0 1 5.71s
❌ JSON jsonlint 55 1 0.25s
⚠️ JSON prettier 55 43 1 6.33s
βœ… JSON v8r 55 0 79.02s
⚠️ MARKDOWN markdownlint 273 237 721 11.87s
❌ MARKDOWN markdown-link-check 273 100 113.76s
βœ… MARKDOWN markdown-table-formatter 273 239 0 2.12s
❌ REPOSITORY checkov yes 6 63.86s
❌ REPOSITORY gitleaks yes 2 60.1s
βœ… REPOSITORY git_diff yes no 1.17s
❌ REPOSITORY grype yes 1 22.74s
βœ… REPOSITORY secretlint yes no 36.15s
❌ REPOSITORY trivy yes 1 9.81s
βœ… REPOSITORY trivy-sbom yes no 5.2s
βœ… REPOSITORY trufflehog yes no 12.5s
❌ SPELL cspell 2561 59501 817.63s
❌ SPELL lychee 1077 146 90.9s
βœ… YAML prettier 705 695 0 24.0s
❌ YAML v8r 705 1 610.92s
❌ YAML yamllint 705 1 45.72s

See detailed report in MegaLinter reports

_MegaLinter is graciously provided by OX Security_