From b8f371dbea70d79362755b1b2eb83f87fef15fc1 Mon Sep 17 00:00:00 2001
From: PraveshKoirala <praveshkoirala@gmail.com>
Date: Fri, 31 Jul 2026 22:22:01 -0500
Subject: [PATCH] build: bump Jinja2 to >=3.1.6 and MarkupSafe to >=2.1.0

Jinja2 2.11.3 is affected by four CVEs:
- CVE-2024-22195: XSS via xmlattr filter (fixed in 3.1.3)
- CVE-2024-34064: XSS via xmlattr filter keys (fixed in 3.1.4)
- CVE-2024-56326: Sandbox breakout via str.format (fixed in 3.1.5)
- CVE-2025-27516: Sandbox breakout via attr filter (fixed in 3.1.6)

MarkupSafe bumped from ==0.23 to >=2.1.0 as required by Jinja2 3.x.

All tests pass (1609 pytest, 650 behave scenarios) on Python 3.12.
---
 pyproject.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index b3dc0be02..3d84da312 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -34,8 +34,8 @@ requires-python = ">=3.9"
 
 [dependency-groups]
 dev = [
-    "Jinja2==2.11.3",
-    "MarkupSafe==0.23",
+    "Jinja2>=3.1.6",
+    "MarkupSafe>=2.1.0",
     "Sphinx==1.8.6",
     "alabaster<0.7.14",
     "behave>=1.2.6",