Bump jinja2 version to resolve vulnerability (apache#32403)

Naireen · Sep 6, 2024 · 1ee2f6b · 1ee2f6b
1 parent 6901d7c
commit 1ee2f6b
Show file tree

Hide file tree

Showing 6 changed files with 8 additions and 9 deletions.
diff --git a/sdks/python/container/py310/base_image_requirements.txt b/sdks/python/container/py310/base_image_requirements.txt
@@ -85,7 +85,7 @@ httplib2==0.22.0
 hypothesis==6.111.2
 idna==3.8
 iniconfig==2.0.0
-Jinja2==3.0.3
+Jinja2==3.1.4
 joblib==1.4.2
 Js2Py==0.74
 jsonpickle==3.2.2

diff --git a/sdks/python/container/py311/base_image_requirements.txt b/sdks/python/container/py311/base_image_requirements.txt
@@ -83,7 +83,7 @@ httplib2==0.22.0
 hypothesis==6.111.2
 idna==3.8
 iniconfig==2.0.0
-Jinja2==3.0.3
+Jinja2==3.1.4
 joblib==1.4.2
 Js2Py==0.74
 jsonpickle==3.2.2

diff --git a/sdks/python/container/py312/base_image_requirements.txt b/sdks/python/container/py312/base_image_requirements.txt
@@ -83,7 +83,7 @@ httplib2==0.22.0
 hypothesis==6.111.2
 idna==3.8
 iniconfig==2.0.0
-Jinja2==3.0.3
+Jinja2==3.1.4
 joblib==1.4.2
 jsonpickle==3.2.2
 jsonschema==4.23.0

diff --git a/sdks/python/container/py38/base_image_requirements.txt b/sdks/python/container/py38/base_image_requirements.txt
@@ -88,7 +88,7 @@ idna==3.8
 importlib_metadata==8.4.0
 importlib_resources==6.4.4
 iniconfig==2.0.0
-Jinja2==3.0.3
+Jinja2==3.1.4
 joblib==1.4.2
 Js2Py==0.74
 jsonpickle==3.2.2

diff --git a/sdks/python/container/py39/base_image_requirements.txt b/sdks/python/container/py39/base_image_requirements.txt
@@ -86,7 +86,7 @@ hypothesis==6.111.2
 idna==3.8
 importlib_metadata==8.4.0
 iniconfig==2.0.0
-Jinja2==3.0.3
+Jinja2==3.1.4
 joblib==1.4.2
 Js2Py==0.74
 jsonpickle==3.2.2

diff --git a/sdks/python/setup.py b/sdks/python/setup.py
@@ -394,19 +394,18 @@ def get_portability_package_data():
       # BEAM-8840: Do NOT use tests_require or setup_requires.
       extras_require={
           'docs': [
-              'jinja2>=3.0,<3.1',
+              'jinja2>=3.0,<3.2',
               'Sphinx>=1.5.2,<2.0',
               'docstring-parser>=0.15,<1.0',
               # Pinning docutils as a workaround for Sphinx issue:
               # https://github.com/sphinx-doc/sphinx/issues/9727
               'docutils==0.17.1',
-              'jinja2>=3.0,<3.1',
               'pandas<2.2.0',
           ],
           'test': [
               'docstring-parser>=0.15,<1.0',
               'freezegun>=0.3.12',
-              'jinja2>=3.0,<3.1',
+              'jinja2>=3.0,<3.2',
               'joblib>=1.0.1',
               'mock>=1.0.1,<6.0.0',
               'pandas<2.2.0',
@@ -511,7 +510,7 @@ def get_portability_package_data():
           ],
           'yaml': [
               'docstring-parser>=0.15,<1.0',
-              'jinja2>=3.0,<3.1',
+              'jinja2>=3.0,<3.2',
               'pyyaml>=3.12,<7.0.0',
               'virtualenv-clone>=0.5,<1.0',
           ] + dataframe_dependency