chore(templates): bump pygments to 2.20.0
Metadata
Current evaluation
Merged as charmcraft#2622 (commit 640adea3), updating Pygments to 2.20.0 in the kubernetes and machine template lockfiles for a security fix.
Resolution: closed resolved
Reason: PR charmcraft#2622 was merged as commit 640adea3, applying the reviewed Pygments 2.20.0 security update to both affected template lockfiles.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR updates pygments in the locked dependencies of the `kubernetes` and `machine` profiles. pygments is used by pytest. I'm bumping pygments in response to a security issue. See also https://github.com/canonical/operator/pull/2404.
---
- [x] I've followed the [contribution guidelines](https://github.com/canonical/charmcraft/blob/main/CONTRIBUTING.md).
- [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] I've updated the relevant release notes.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as charmcraft#2622 (commit 640adea3), updating Pygments to 2.20.0 in the kubernetes and machine template lockfiles for a security fix. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in commit 640adea3, bumping locked Pygments to 2.20.0 in the kubernetes and machine profile templates to address a security issue. | |
| stealth/space-bunny-alpha | — | closed resolved | Pygments 2.20.0 was merged via #2622 (commit 640adea3), updating locked dependencies in the kubernetes and machine templates for a security fix. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as charmcraft#2622 (commit 640adea3), updating locked Pygments to 2.20.0 in the kubernetes and machine templates for a security fix. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged update bumping pygments to 2.20.0 in kubernetes and machine profiles to resolve a security vulnerability. Approved by two reviewers and passed CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged an external contribution bumping pygments to 2.20.0 in the kubernetes and machine profiles to address a security vulnerability. |
Update history
| Date | Change |
|---|---|
| updated |
Related work
-
Related To:
operator#2404
(confidence 95%)
The PR cites this operator-framework change as a corresponding security-driven Pygments update.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2653 chore(templates): bump pytest and other testing deps | charmcraft | merged | Merged PR #2653 as fae98626, updating Kubernetes and machine template locks for a pytest security fix plus ruff, codespell, pyright, and PyYAML. | |
| #1408 chore: release 2.5.2 | charmcraft | closed | Charmcraft 2.5.2 was released by merging #1408 in commit 2a93c7a2, updating the version metadata in two files. | |
| #974 chore(deps): update dependency pytz to v2022.7 | charmcraft | merged | Merged the pytz 2022.6→2022.7 dependency update in canonical/charmcraft#974 via commit e0d50d70 (merge aa77ef61), changing two dependency files. | |
| #2621 build(deps): bump pygments from 2.19.2 to 2.20.0 | charmcraft | closed | Dependabot PR #2621 was closed unmerged; the same Pygments 2.20.0 template-lock update was merged separately in #2622 at commit 640adea3. | |
| #1409 chore: release 2.5.2 | charmcraft | merged | Merged PR #1409 released Charmcraft 2.5.2 (commit 2a93c7a2), cherry-picking the main-branch fix allowing empty lines in requirements.txt. |