chore(deps): update dependency certifi to v2023.7.22 [security] - autoclosed
Metadata
Current evaluation
Autoclosed after the same certifi 2023.7.22 security update was merged via Dependabot PR #1182 in commit 8350a166.
Resolution: closed superseded
Reason: The update was superseded by Dependabot PR #1182, which merged the certifi upgrade from 2023.5.7 to 2023.7.22 in commit 8350a166.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [certifi](https://togithub.com/certifi/python-certifi) | `==2023.5.7` -> `==2023.7.22` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2023-37920](https://togithub.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7)
Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. These are in the process of being removed from Mozilla's trust store.
e-Tugra's root certificates are being removed pursuant to an investigation prompted by reporting of security issues in their systems. Conclusions of Mozilla's investigation can be found [here](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A).
---
### Release Notes
<details>
<summary>certifi/python-certifi (certifi)</summary>
### [`v2023.7.22`](https://togithub.com/certifi/python-certifi/compare/2023.05.07...2023.07.22)
[Compare Source](https://togithub.com/certifi/python-certifi/compare/2023.05.07...2023.07.22)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "before 07:00" in timezone Etc/UTC.
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi4xMS4wIiwidXBkYXRlZEluVmVyIjoiMzYuMTEuMCIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Autoclosed after the same certifi 2023.7.22 security update was merged via Dependabot PR #1182 in commit 8350a166. | |
| stealth/space-bunny-alpha | — | closed superseded | Autoclosed after the same certifi 2023.5.7 to 2023.7.22 security update was merged via Dependabot PR #1182 in commit 8350a166. | |
| qwen/qwen3.6-35b-a3b | — | — | Renovate bot PR updating certifi to v2023.7.22 for CVE-2023-37920 was autoclosed due to inactivity. Automerge was disabled by configuration, and the request received no reviews or CI checks before automatic closure. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate bot PR updating certifi to v2023.7.22 for CVE-2023-37920 was autoclosed without merging. The security dependency update was abandoned and never applied. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/charmcraft#1182
(confidence 100%)
Dependabot PR #1182 merged the same dependency update in commit 8350a166.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4897 chore(deps): update dependency certifi to v2024 [security] - autoclosed | snapcraft | closed | Autoclosed unmerged as redundant; certifi 2024.7.4 landed via #4896 (a4e2895da), with the matching docs update later merged in #4903. | |
| #1720 chore(deps): update dependency certifi to v2024.7.4 [security] | charmcraft | merged | Renovate security bump of certifi from 2024.6.2 to 2024.7.4 merged via commit 38351514, addressing CVE-2024-39689 (GLOBALTRUST root removal). Later superseded by #1936 bumping to v2024.8.30. | |
| #1695 chore(deps): update dependency certifi to v2024.6.2 | charmcraft | merged | Renovate dependency bump PR: certifi 2024.2.2 → 2024.6.2 merged into main via commit 7460a6fe (+2/-2 lines in 2 requirements files), approved by 2 reviewers. | |
| #4773 chore(deps): update dependency pip to v23 [security] - autoclosed | snapcraft | closed | Renovate PR #4773 was autoclosed without merge; Dependabot PR #4776 superseded it by merging the same pip 22.0.2→23.3 docs upgrade in commit 99387d281. | |
| #1111 chore(deps): update dependency requests to v2.31.0 [security] - abandoned | charmcraft | closed | Renovate's requests 2.28.2 -> 2.31.0 security PR was closed empty (0 files) after autoclosing was skipped due to a modified branch; the identical CVE-2023-32681 upgrade landed via merged Dependabot PR #1110 (10d6d55a). | |
| #4856 chore(deps): update dependency requests to v2.32.2 [security] - autoclosed | snapcraft | closed | PR #4856 was autoclosed without merge; the same requests 2.32.2 security update later landed via #5064 (ec4f9b16f). | |
| #15 Update dependency certifi to v2023 [SECURITY] - autoclosed | imagecraft | closed | Renovate PR #15 proposed certifi 2023.7.22 for security fixes but was autoclosed unmerged after inactivity; no resolving merge or commit was recorded. | |
| #1689 chore(deps): update dependency requests to v2.32.0 [security] - autoclosed | charmcraft | closed | Renovate’s requests 2.32.0 security update was autoclosed unmerged after 864 days, with no reviews, comments, or CI checks. | |
| #4812 chore(deps): update dependency requests to v2.32.0 [security] - autoclosed | snapcraft | closed | Renovate PR #4812 was autoclosed unmerged after 856 days; the security upgrade was later delivered by #5064 (commit ec4f9b16f), raising requests from 2.31.0 to 2.32.2. | |
| #61 chore(deps): update dependency requests to v2.32.2 [security] - autoclosed | imagecraft | closed | Renovate's requests 2.32.2 update was autoclosed unmerged; requests was later updated to 2.33.0 by merged PR #308 (commit cbca1c1). |