← Back to issue list

build(deps): constraints for oauthlib and urllib3

View original Github issue

Metadata

Project
craft-application
Number
#1204
Type
pull request
State
merged
Author
tigarmo
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #1204 added oauthlib and urllib3 dependency constraints, remediating five cited GHSA/OSV vulnerabilities.

Resolution: closed resolved

Reason: PR canonical/craft-application#1204 was approved and merged. Lint, test, and security-scan checks passed, aside from the unrelated snap-tests failure.

Evaluated by: mr-cal-bot

No scores available.

Issue body

These address the following vulnerabilities: - https://osv.dev/GHSA-hj66-6f7g-4r5v - https://osv.dev/GHSA-xpv3-w29h-x7cv - https://osv.dev/GHSA-8988-9cw3-xx77 - https://osv.dev/GHSA-gh4c-6fx4-qh6g - https://osv.dev/GHSA-vxq7-64xx-v4gw - [ ] Have you followed the guidelines for contributing? - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `make lint && make test`? - [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)? ---

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #1204 added oauthlib and urllib3 dependency constraints, remediating five cited GHSA/OSV vulnerabilities.
stealth/space-bunny-alpha — closed resolved Merged PR #1204 as commit 40bdeaaa, adding oauthlib and urllib3 constraints to address five cited OSV vulnerabilities.
qwen/qwen3.8-27b — closed resolved Merged PR adding dependency constraints for oauthlib and urllib3 in craft-providers to resolve 5 OSV security vulnerabilities (GHSA-hj66, GHSA-xpv3, GHSA-8988, GHSA-gh4c, GHSA-vxq7). Approved by 2 reviewers; CI passing except snap-tests.
qwen/qwen3.8-27b
Impact: 45
Quick Win: 34
Complexity: 10
Confidence: 85
Actionability: 85
needs review Bumps oauthlib and urllib3 constraint floors in pyproject.toml/uv.lock to address 5 GHSA advisories (1 oauthlib, 4 urllib3). Approved by 2 reviewers; CI green except unrelated snap-tests (openstack:).
qwen/qwen3.8-27b
Impact: 35
Quick Win: 27
Complexity: 10
Confidence: 85
Actionability: 85
needs review Tightens oauthlib and urllib3 version constraints in pyproject.toml and uv.lock to address 5 OSV vulnerabilities. Approved by 2 reviewers; all CI green except the unrelated openstack snap-tests infra job.
qwen/qwen3.8-27b
Impact: 45
Quick Win: 28
Complexity: 10
Confidence: 80
Actionability: 70
needs review Tightens minimum version constraints for oauthlib and urllib3 in pyproject.toml and uv.lock to address 5 GHSA vulnerabilities. Approved by 1 reviewer, CI passing (3 pending), 1 unresolved review comment.
qwen/qwen3.8-27b
Impact: 40
Quick Win: 23
Complexity: 10
Confidence: 85
Actionability: 65
needs review Raises minimum version constraints for oauthlib and urllib3 in pyproject.toml and uv.lock to address five GHSA vulnerabilities. Approved by one reviewer, CI passing with 3 flaky/arm checks pending, 1 unresolved review comment.
qwen/qwen3.8-27b
Impact: 35
Quick Win: 22
Complexity: 10
Confidence: 80
Actionability: 70
needs review Bumps oauthlib and urllib3 minimum versions in the uv constraint-dependencies (pyproject.toml + uv.lock) to address 5 GHSA vulnerabilities. Approved by 1 reviewer; CI passing except 3 pending checks; 1 unresolved review comment.
qwen/qwen3.8-27b
Impact: 40
Quick Win: 29
Complexity: 10
Confidence: 85
Actionability: 80
needs review Raises uv constraint-dependencies for oauthlib and urllib3 in pyproject.toml and uv.lock to address 5 GHSA vulnerabilities. All core CI green; awaiting maintainer review.
qwen/qwen3.8-27b
Impact: 50
Quick Win: 32
Complexity: 10
Confidence: 80
Actionability: 70
needs review Bumps uv constraint-dependencies for oauthlib and urllib3 in pyproject.toml and uv.lock to address five GHSA vulnerabilities (oauthlib CSRF, urllib3 header leaks/ReDoS). Clean 2-file diff; CI mostly green with fast tests/lint/snap-build pending, awaiting review.

Update history

Date Change
merged
updated
updated
updated
created

Related issues

Issue Project State Summary Similarity
#1383 build(deps): constraints for oauthlib and urllib3 rockcraft merged PR #1383 merged to add constraints for oauthlib and urllib3, resolving multiple OSV-reported security vulnerabilities.
93%
#267 build(deps): raise oauthlib and urllib3 constraints craft-archives closed PR #267 was closed without merging due to failing CI checks. It replaced #260 to update oauthlib and urllib3 constraints.
87%
#204 build(deps): raise oauthlib constraint floor for OSV findings debcraft merged Fixed OSV security findings by raising oauthlib>=4.0.0 and urllib3>=2.8.0 constraints in tool.uv.constraint-dependencies. Merged with passing CI checks.
81%
#260 build(deps): raise oauthlib constraint to 4.0.0 craft-archives merged Merged PR #260 raising the oauthlib dependency constraint to >=4.0.0 to resolve OSV security scan failures caused by advisories against version 3.3.1.
79%
#909 build(deps): bump cryptography and urllib3 craft-providers merged Merged cryptography and urllib3 dependency updates in PR #909 to resolve OSV findings; landed as commit 922e691.
74%
#5912 build: bump urllib3 snapcraft merged Merged PR #5912 (commit 99a19a09a) bumped urllib3 to resolve an OSV vulnerability.
73%
#3914 build(deps): bump oauthlib from 3.2.0 to 3.2.1 snapcraft merged Dependabot PR merged: oauthlib bumped 3.2.0 -> 3.2.1 in snapcraft via commit 9e10fd1b6, pulling in the CVE-2022-36087 fix and non-HTTPS issuer/IPv6 signature fixes.
73%
#63 build: bump urllib3 debcraft merged Merged PR #63 updated urllib3 to resolve an OSV vulnerability; commit 5f83429 passed all CI checks.
73%
#1430 build: update urllib3 craft-parts merged Merged PR #1430 (commit 1b60eff6) updated urllib3 to resolve an OSV vulnerability.
72%
#102 build: fix urllib3 osv craft-grammar merged Merged PR #102 in commit c936b0f, fixing an OSV workflow error related to urllib3; all lint, test, policy, and security checks passed.
72%