Jinja restriction in dependencies

[davisthomas-aily]

Jinja2 = "<3.1" in the pyproject is quite limiting - as you can see this points to versions prior to March 2022, can we fix this?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[Vilela-aig]

I just wanted to chime in and say this is also causing issues for me. The <3.1 pin on Jinja2 is quite limiting and is blocking compatibility with some other packages in my environment. It would be great to see this updated if possible. Thanks!

[nnansters]

Hey all,

Sorry for taking our sweet time on this. I'll take a look at it this weekend!

[nnansters]

See #440 ! Seems good?

[Vilela-aig]

See #440 ! Seems good?

Yes @nnansters! That will solve the problem for me!

[christiansegercrantz]

Hey! When can we expect a release for this? The Jinja2 version the released version is forcing has 5 vulnerabilities:

Name Version ID Fix Versions

---

jinja2 3.0.3 GHSA-h5c8-rqwp-cp95 3.1.3
jinja2 3.0.3 GHSA-h75v-3vvj-5mfj 3.1.4
jinja2 3.0.3 GHSA-q2x7-8rv6-6q7h 3.1.5
jinja2 3.0.3 GHSA-gmj6-6f8f-6699 3.1.5
jinja2 3.0.3 GHSA-cpwx-vrp4-4pq7 3.1.6

Further more, also lightgbm is causing a vulnerability due to it's pin

Name Version ID Fix Versions

---

lightgbm 4.5.0 PYSEC-2024-231 4.6.0

Lastly, it would probably be good to start using pip_audit in your CI to catch these kinds of problems.

[christiansegercrantz]

Hey! When can we expect a release for this? The Jinja2 version the released version is forcing has 5 vulnerabilities:

Name Version ID Fix Versions

jinja2 3.0.3 GHSA-h5c8-rqwp-cp95 3.1.3 jinja2 3.0.3 GHSA-h75v-3vvj-5mfj 3.1.4 jinja2 3.0.3 GHSA-q2x7-8rv6-6q7h 3.1.5 jinja2 3.0.3 GHSA-gmj6-6f8f-6699 3.1.5 jinja2 3.0.3 GHSA-cpwx-vrp4-4pq7 3.1.6

Further more, also lightgbm is causing a vulnerability due to it's pin

Name Version ID Fix Versions

lightgbm 4.5.0 PYSEC-2024-231 4.6.0

Lastly, it would probably be good to start using pip_audit in your CI to catch these kinds of problems.

Hey, bubbling down on this. Could a simple patch release be made for this already merged PR so this could be used? It's quite problematic to have to get the package from GH instead of pypi.

[nnansters]

IT'S OUT!

Sorry to test your patience like this, other work has been quite brutal lately.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.