Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

build(deps): bump jinja2 from 3.1.3 to 3.1.4 in /.kokoro#1172

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
mukund-ananthu merged 4 commits intomainfromdependabot/pip/dot-kokoro/jinja2-3.1.4
May 30, 2024

Conversation

@dependabot
Copy link
Contributor

@dependabotdependabotbot commented on behalf ofgithubMay 6, 2024

Bumpsjinja2 from 3.1.3 to 3.1.4.

Release notes

Sourced fromjinja2's releases.

3.1.4

This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.

PyPI:https://pypi.org/project/Jinja2/3.1.4/Changes:https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-4

  • Thexmlattr filter does not allow keys with/ solidus,> greater-than sign, or= equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first.GHSA-h75v-3vvj-5mfj
Changelog

Sourced fromjinja2's changelog.

Version 3.1.4

Released 2024-05-05

  • Thexmlattr filter does not allow keys with/ solidus,>greater-than sign, or= equals sign, in addition to disallowing spaces.Regardless of any validation done by Jinja, user input should never be usedas keys to this filter, or must be separately validated first.:ghsa:h75v-3vvj-5mfj
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting@dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from theSecurity Alerts page.

Bumps [jinja2](https://github.com/pallets/jinja) from 3.1.3 to 3.1.4.- [Release notes](https://github.com/pallets/jinja/releases)- [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst)- [Commits](pallets/jinja@3.1.3...3.1.4)---updated-dependencies:- dependency-name: jinja2  dependency-type: indirect...Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotbot requested review froma team ascode ownersMay 6, 2024 20:57
@dependabotdependabotbot added the dependenciesPull requests that update a dependency file labelMay 6, 2024
@trusted-contributions-gcftrusted-contributions-gcfbot added the kokoro:force-runAdd this label to force Kokoro to re-run the tests. labelMay 6, 2024
@product-auto-labelproduct-auto-labelbot added the size: xsPull request size is extra small. labelMay 6, 2024
@trusted-contributions-gcftrusted-contributions-gcfbot added the owlbot:runAdd this label to trigger the Owlbot post processor. labelMay 6, 2024
@product-auto-labelproduct-auto-labelbot added the api: pubsubIssues related to the googleapis/python-pubsub API. labelMay 6, 2024
@gcf-owl-botgcf-owl-botbot removed the owlbot:runAdd this label to trigger the Owlbot post processor. labelMay 6, 2024
@trusted-contributions-gcftrusted-contributions-gcfbot added the owlbot:runAdd this label to trigger the Owlbot post processor. labelMay 6, 2024
@product-auto-labelproduct-auto-labelbot added size: uPull request is empty. and removed size: xsPull request size is extra small. labelsMay 6, 2024
@gcf-owl-botgcf-owl-botbot removed the owlbot:runAdd this label to trigger the Owlbot post processor. labelMay 6, 2024
@yoshi-kokoroyoshi-kokoro removed the kokoro:force-runAdd this label to force Kokoro to re-run the tests. labelMay 6, 2024
@mukund-ananthumukund-ananthu added the kokoro:force-runAdd this label to force Kokoro to re-run the tests. labelMay 6, 2024
@yoshi-kokoroyoshi-kokoro removed the kokoro:force-runAdd this label to force Kokoro to re-run the tests. labelMay 6, 2024
@trusted-contributions-gcftrusted-contributions-gcfbot added kokoro:force-runAdd this label to force Kokoro to re-run the tests. owlbot:runAdd this label to trigger the Owlbot post processor. labelsMay 30, 2024
@gcf-owl-botgcf-owl-botbot removed the owlbot:runAdd this label to trigger the Owlbot post processor. labelMay 30, 2024
@yoshi-kokoroyoshi-kokoro removed the kokoro:force-runAdd this label to force Kokoro to re-run the tests. labelMay 30, 2024
@trusted-contributions-gcftrusted-contributions-gcfbot added kokoro:force-runAdd this label to force Kokoro to re-run the tests. owlbot:runAdd this label to trigger the Owlbot post processor. labelsMay 30, 2024
@gcf-owl-botgcf-owl-botbot removed the owlbot:runAdd this label to trigger the Owlbot post processor. labelMay 30, 2024
@mukund-ananthumukund-ananthuenabled auto-merge (squash)May 30, 2024 15:55
@yoshi-kokoroyoshi-kokoro removed the kokoro:force-runAdd this label to force Kokoro to re-run the tests. labelMay 30, 2024
@mukund-ananthumukund-ananthu added the kokoro:force-runAdd this label to force Kokoro to re-run the tests. labelMay 30, 2024
@yoshi-kokoroyoshi-kokoro removed the kokoro:force-runAdd this label to force Kokoro to re-run the tests. labelMay 30, 2024
@mukund-ananthumukund-ananthu merged commitee55694 intomainMay 30, 2024
@mukund-ananthumukund-ananthu deleted the dependabot/pip/dot-kokoro/jinja2-3.1.4 branchMay 30, 2024 17:58
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

1 more reviewer

@mukund-ananthumukund-ananthumukund-ananthu approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@mukund-ananthumukund-ananthu

Labels

api: pubsubIssues related to the googleapis/python-pubsub API.dependenciesPull requests that update a dependency filesize: uPull request is empty.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mukund-ananthu@yoshi-kokoro

[8]ページ先頭

©2009-2025 Movatter.jp