Merge pull request #1488 from lukaszstolarczuk/fix-sec

Bump jinja and its dependency version
oneapi-src · Apr 8, 2024 · 7c1683f · 7c1683f
2 parents cac3de1 + 2ad8110
commit 7c1683f
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/third_party/deps.yml b/third_party/deps.yml
@@ -33,6 +33,7 @@ dependencies:
   - openssl=3.1.1
   - pkg-config=0.29.2
   - rhash=1.4.3
+  # don't upgrade xz utils due to CVE-2024-3094
   - xz=5.2.6
   - zlib=1.2.13
   - zstd=1.5.2
diff --git a/third_party/requirements.txt b/third_party/requirements.txt
@@ -12,10 +12,10 @@ docutils==0.15.2
 exhale==0.3.0
 idna==2.8
 imagesize==1.1.0
-Jinja2==2.11.3
+Jinja2==3.1.3
 lxml==4.9.3
 Mako==1.3.0
-MarkupSafe==1.1.1
+MarkupSafe==2.1.5
 packaging==19.2
 Pygments==2.17.2
 pyparsing==2.4.5