VULN UPGRADE: patch: Jinja2, MarkupSafe, PyYAML [apps/pass-api]

[campaigner-prod]

Summary: Security update — 3 packages upgraded (patch changes only)

Manifests changed:

• apps/pass-api (pip)

Updates

Package	From	To	Type	Vulnerabilities Fixed
Jinja2	3.1.4	3.1.6	patch	6 MODERATE
MarkupSafe	3.0.1	3.0.3	patch	-
PyYAML	6.0.1	6.0.3	patch	-

Packages marked with "-" are updated due to dependency constraints.

---

Security Details

ℹ️ Other Vulnerabilities (6)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
Jinja2	GHSA-q2x7-8rv6-6q7h	MODERATE	Jinja has a sandbox breakout through indirect reference to format method	3.1.4	3.1.5
Jinja2	CVE-2024-56326	MODERATE	Jinja has a sandbox breakout through indirect reference to format method	3.1.4	-
Jinja2	GHSA-cpwx-vrp4-4pq7	MODERATE	Jinja2 vulnerable to sandbox breakout through attr filter selecting format method	3.1.4	3.1.6
Jinja2	CVE-2025-27516	MODERATE	Jinja sandbox breakout through attr filter selecting format method	3.1.4	-
Jinja2	GHSA-gmj6-6f8f-6699	MODERATE	Jinja has a sandbox breakout through malicious filenames	3.1.4	3.1.5
Jinja2	CVE-2024-56201	MODERATE	Jinja has a sandbox breakout through malicious filenames	3.1.4	-

⚠️ Dependencies that have Reached EOL (1)

Dependency	Unsafe Version	EOL Date	New Version	Path
MarkupSafe	3.0.1	-	3.0.3	apps/pass-api/tasks/requirements.txt

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI

---

Update Mode: Vulnerability Remediation

🤖 Generated by DataDog Automated Dependency Management System

[campaigner-prod]

Closing as stale (open >1 month). If the dependency update is still applicable, version-updater will recreate this PR on its next scheduled run. Feel free to reopen if you want to keep working on this specific revision.