From c12c97663c36823637cd2d4422006f13f76d1b15 Mon Sep 17 00:00:00 2001 From: PraveshKoirala Date: Fri, 31 Jul 2026 21:34:02 -0500 Subject: [PATCH] Bump Jinja2 and MarkupSafe to fix multiple CVEs Jinja2 2.11.3 is affected by four CVEs: - CVE-2024-22195: XSS via xmlattr filter (fixed in 3.1.3) - CVE-2024-34064: XSS via xmlattr filter keys (fixed in 3.1.4) - CVE-2024-56326: Sandbox breakout via str.format (fixed in 3.1.5) - CVE-2025-27516: Sandbox breakout via attr filter (fixed in 3.1.6) Bump Jinja2 from ==2.11.3 to >=3.1.6 to resolve all four. Bump MarkupSafe from ==0.23 to >=2.1.0 as required by Jinja2 3.x. Note: Sphinx==1.8.6 may need updating for Jinja2 3.x compatibility. Co-Authored-By: Claude Opus 4.6 --- pyproject.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index b3dc0be02..3d84da312 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -34,8 +34,8 @@ requires-python = ">=3.9" [dependency-groups] dev = [ - "Jinja2==2.11.3", - "MarkupSafe==0.23", + "Jinja2>=3.1.6", + "MarkupSafe>=2.1.0", "Sphinx==1.8.6", "alabaster<0.7.14", "behave>=1.2.6",