← Back to issue list

build(deps): add constraint for Starlette

View original Github issue

Metadata

Project
charmcraft
Number
#2716
Type
pull request
State
merged
Author
steinbro
Labels
—
Created
Updated
Closed

Current evaluation

Merged into main via commit 4a54393b, adding a Starlette dependency constraint to avoid versions affected by the BadHost CVE.

Resolution: closed resolved

Reason: PR #2716 was approved and merged as commit 4a54393b, constraining the indirect Starlette dependency to a version not affected by BadHost.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Pin the indirect dependency to a version not affected by BadHost CVE. --- - [ ] I've followed the [contribution guidelines](https://github.com/canonical/charmcraft/blob/main/CONTRIBUTING.md). - [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing. - [ ] I've updated the relevant release notes.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged into main via commit 4a54393b, adding a Starlette dependency constraint to avoid versions affected by the BadHost CVE.
stealth/space-bunny-alpha — closed resolved Merged canonical/charmcraft#2716 in commit 4a54393b, adding a Starlette dependency constraint to avoid versions affected by the BadHost CVE.
qwen/qwen3.6-35b-a3b — — Merged dependency constraint pinning Starlette to a version unaffected by the BadHost CVE. Approved by a reviewer, passed CI checks, and successfully integrated.
qwen3.6-35b-a3b-mtp-q6 — — Merged a Starlette dependency constraint to pin the indirect dependency to a version unaffected by the BadHost CVE. The change passed lint and test checks and was integrated without documentation updates.

Update history

No update history recorded yet.

Related issues

Issue Project State Summary Similarity
#6277 build(deps): add constraint for Starlette snapcraft merged Merged in #6277 (d3e2405d6), adding a Starlette constraint to avoid versions affected by the BadHost CVE.
96%
#376 build(deps): add constraint for Starlette craft-store merged Merged #376 via ed08e00, adding a Starlette >=1.0.1 constraint to avoid versions affected by the BadHost CVE.
96%
#164 build(deps): add constraint for Starlette debcraft merged Merged #164 as commit 10a58dc, constraining indirect Starlette to a version unaffected by the BadHost CVE.
96%
#91 build(deps): add constraint for Starlette craft-artifacts merged Merged in commit 5665dcb, adding a two-file constraint for indirect Starlette to avoid versions affected by the BadHost CVE.
96%
#1241 build(deps): add constraint for Starlette rockcraft merged Merged PR #1241 in commit 703bbc20, constraining indirect Starlette to a version not affected by the BadHost CVE.
96%
#228 build(deps): add constraint for Starlette craft-platforms merged Merged PR #228 via commit dcbf23e, constraining indirect Starlette to versions unaffected by the BadHost CVE.
96%
#547 build(deps): add constraint for Starlette starbase merged Merged PR #547 added a constraint for the indirect Starlette dependency, excluding versions affected by the BadHost CVE; the change landed as ca8caba.
95%
#972 build(deps): add constraint for Starlette craft-providers merged Merged in #972 via commit 7ed9c81, constraining indirect Starlette to >=1.0.1 to avoid versions affected by the BadHost CVE.
95%
#190 build(deps): add constraint for Starlette craft-grammar merged Merged PR #190 with two approvals, adding a two-file constraint to exclude indirect Starlette versions affected by the BadHost CVE.
94%
#5120 build(deps): update dependency starlette to v0.40.0 [security] (hotfix/8.4) snapcraft merged Renovate security bump of Starlette 0.38.4 -> 0.40.0 (CVE-2024-47874 multipart DoS) merged into hotfix/8.4 as commit fceb8c169; the equivalent main PR #5119 landed as 9fa59f7c4.
77%