← Back to issue list

build(deps-dev): bump h11 from 0.14.0 to 0.16.0

View original Github issue

Metadata

Project
charmcraft
Number
#2267
Type
pull request
State
closed
Author
dependabot[bot]
Labels
—
Created
Updated
Closed

Current evaluation

Dependabot's h11 0.14.0→0.16.0 bump was closed unmerged as redundant; h11 v0.16.0 was already present. The equivalent security update merged via PR #2268 (commit 35e8fbe0).

Resolution: closed superseded

Reason: Dependabot commented 'h11 is up-to-date now, so this is no longer needed' and closed the PR. The same upgrade to h11 v0.16.0 was delivered by the security update PR canonical/charmcraft#2268, merged as commit 35e8fbe0.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Bumps [h11](https://github.com/python-hyper/h11) from 0.14.0 to 0.16.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-hyper/h11/commit/1c5b07581f058886c8bdd87adababd7d959dc7ca"><code>1c5b075</code></a> this time for surer</li> <li><a href="https://github.com/python-hyper/h11/commit/d9c369935e853a7ee1aeb7e481f6dddf9b9c9b8a"><code>d9c3699</code></a> this time for sure...</li> <li><a href="https://github.com/python-hyper/h11/commit/d91b9dd2290a25c8c3f5ec15feb57de5873e6e39"><code>d91b9dd</code></a> blacken</li> <li><a href="https://github.com/python-hyper/h11/commit/5a4683ca466b59bbab9b19cfea20ee157b31cee0"><code>5a4683c</code></a> Soothe mypy</li> <li><a href="https://github.com/python-hyper/h11/commit/9c9567f0a92d13a83a8d8ebdbc757c8c2d384536"><code>9c9567f</code></a> Bump version to 0.16.0</li> <li><a href="https://github.com/python-hyper/h11/commit/114803a29ce50116dc47951c690ad4892b1a36ed"><code>114803a</code></a> Merge commit from fork</li> <li><a href="https://github.com/python-hyper/h11/commit/9462006f6ce4941661888228cbd4ac1ea80689b0"><code>9462006</code></a> Bump version to 0.15.0</li> <li><a href="https://github.com/python-hyper/h11/commit/70a96bea8e55403e5d92db14c111432c6d7a8685"><code>70a96be</code></a> Merge pull request <a href="https://redirect.github.com/python-hyper/h11/issues/181">#181</a> from Julien00859/Julien00859/get_int_max_str_digits</li> <li><a href="https://github.com/python-hyper/h11/commit/60782ad107e538b9312aac7e1c119c8358bf797c"><code>60782ad</code></a> Reject Content-Length longer 1 billion TB</li> <li><a href="https://github.com/python-hyper/h11/commit/dff7cc397a26ed4acdedd92d1bda6c8f18a6ed9f"><code>dff7cc3</code></a> Validate Chunked-Encoding chunk footer</li> <li>Additional commits viewable in <a href="https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=h11&package-manager=pip&previous-version=0.14.0&new-version=0.16.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/canonical/charmcraft/network/alerts). </details>

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed superseded Dependabot's h11 0.14.0→0.16.0 bump was closed unmerged as redundant; h11 v0.16.0 was already present. The equivalent security update merged via PR #2268 (commit 35e8fbe0).
stealth/space-bunny-alpha — closed superseded Dependabot's dev-dependency bump of h11 0.14.0 to 0.16.0 was closed unmerged as redundant: Dependabot commented h11 was already up to date, and the equivalent security update landed via merged PR #2268 (commit 35e8fbe0).
stealth/space-bunny-alpha — closed superseded Closed unmerged as redundant. Dependabot bot said h11 was already up-to-date; the same h11 0.14.0->0.16.0 security bump landed via PR #2268 (commit 35e8fbe0).
stealth/space-bunny-alpha — closed superseded Closed unmerged as redundant: Dependabot confirmed h11 was already current. The equivalent security update to h11 v0.16.0 merged separately in canonical/charmcraft#2268.
qwen/qwen3.6-35b-a3b — — Dependabot PR to bump h11 from 0.14.0 to 0.16.0 was closed as superseded. The bot confirmed the dependency is already up-to-date, making the update redundant.
qwen3.6-35b-a3b-mtp-q6 — — Dependabot PR to update h11 from 0.14.0 to 0.16.0 was closed and abandoned. The bot confirmed the dependency is already at the target version, rendering the update redundant.

Update history

No update history recorded yet.

Related work

  • Superseded By: canonical/charmcraft#2268 (confidence 92%)

    Merged PR upgrading h11 to v0.16.0 (commit 35e8fbe0); uv.lock now pins h11 0.16.0, making the Dependabot PR redundant.

Related issues

Issue Project State Summary Similarity
#1080 build(deps): update dependency h11 to v0.16.0 [security] (hotfix/2.4) craft-parts closed Closed unmerged; the equivalent h11 0.16.0 security update was carried forward by #1081 and merged through #1083 (commit 0ef423df).
88%
#2268 build(deps): update dependency h11 to v0.16.0 [security] (main) charmcraft merged Merged PR #2268 via commit 35e8fbe0, upgrading h11 from 0.14.0 to 0.16.0 to address CVE-2025-43859 and HTTP request-smuggling risk.
88%
#1078 build(deps): update dependency h11 to v0.16.0 [security] (main) - autoclosed craft-parts closed Renovate PR #1078 updating h11 0.14.0 -> 0.16.0 (CVE-2025-43859) was autoclosed; the identical change landed via merged PR #1083 in commit 0ef423df.
88%
#1083 build(deps): update dependency h11 to v0.16.0 [security] craft-parts merged Merged PR #1083 in commit 0ef423df, updating h11 from 0.14.0 to 0.16.0 to remediate CVE-2025-43859 and HTTP request-smuggling risk.
87%
#2269 build(deps): update dependency h11 to v0.16.0 [security] (hotfix/3.3) charmcraft closed Closed unmerged after CI failures; the identical h11 0.16.0 security update merged to main via #2268 (35e8fbe0), superseding this hotfix/3.3 PR.
87%
#1079 build(deps): update dependency h11 to v0.16.0 [security] (hotfix/2.3) craft-parts closed Closed unmerged; the h11 0.16.0 security update was superseded by canonical/craft-parts#1083 and merged in commit 0ef423df to address CVE-2025-43859.
84%
#1081 build(deps): update dependency h11 to v0.16.0 [security] (hotfix/2.4.3) craft-parts closed Superseded by canonical/craft-parts#1083, which merged the same h11 0.16.0 security update in commit 0ef423df.
83%
#2270 build(deps): update dependency h11 to v0.16.0 [security] (hotfix/3.4) - autoclosed charmcraft closed Autoclosed unmerged; the hotfix h11 0.16.0 update was replaced by commit 0c9e5348, which updated both httpcore and h11.
82%