← Back to issue list

build(deps): unpin requests, release 4.2.6

View original Github issue

Metadata

Project
craft-application
Number
#505
Type
pull request
State
merged
Author
mr-cal
Labels
—
Created
Updated
Closed

Current evaluation

Merged in PR #505 (commit 8236c3d3) and released as 4.2.6, removing the requests<2.32.0 constraint to address CVE-2024-35195.

Resolution: closed resolved

Reason: PR #505 was merged after craft-parts and craft-providers adopted requests-unixsockets2. Commit 8236c3d3 unpinned requests, and the 4.2.6 changelog confirms the change resolved the constraint associated with CVE-2024-35195.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [x] Have you followed the guidelines for contributing? - [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [x] Have you successfully run `tox`? ----- craft-parts and craft-providers have switched to requests-unixsockets2, so requests can be unpinned. Allows craft applications to address [CVE-2024-35195](https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56).

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged in PR #505 (commit 8236c3d3) and released as 4.2.6, removing the requests<2.32.0 constraint to address CVE-2024-35195.
stealth/space-bunny-alpha — closed resolved Merged in #505 (commit 8236c3d3), releasing 4.2.6 and unpinning requests after craft-parts and craft-providers adopted requests-unixsockets2, enabling remediation of CVE-2024-35195.
stealth/space-bunny-alpha — closed resolved Merged as release 4.2.6: unpinned requests after craft-parts and craft-providers adopted requests-unixsockets2, enabling applications to address CVE-2024-35195.
qwen/qwen3.6-35b-a3b — — Merged to unpin requests after craft-parts and craft-providers adopted requests-unixsockets2. Addresses CVE-2024-35195. Approved by two reviewers with passing CI.

Update history

No update history recorded yet.

Related issues

Issue Project State Summary Similarity
#5553 build(deps): bump requests to 2.32.4 snapcraft merged Merged PR #5553 as commit 3cfe7a1a3, upgrading requests to 2.32.4 and setting it as the minimum version to mitigate a CVE.
81%
#5064 build(deps): update dependency requests to v2.32.2 [security] (main) snapcraft merged Merged PR #5064 as ec4f9b16f, updating requests from 2.31.0 to 2.32.2 to remediate CVE-2024-35195.
77%
#1516 build(deps): update dependency requests to v2.33.0 [security] (main) craft-parts merged Merged PR #1516 as commit 3d099307, upgrading requests from 2.32.5 to 2.33.0 to remediate CVE-2026-25645.
75%
#6127 build(deps): bump requests from 2.32.5 to 2.33.0 snapcraft merged Merged #6127 as fce681014, updating requests from 2.32.5 to 2.33.0, including upstream hardening for CVE-2026-25645.
74%
#5096 build(deps): switch to requests-unixsocket2, release 8.4.2 snapcraft merged Merged in #5096, switching to requests-unixsocket2 and adding 8.4.2/7.5.7 release notes to remediate CVE-2024-35195 and address #5079.
74%
#122 build(deps): bump requests from 2.32.5 to 2.33.0 starflow merged Updated requests from 2.32.5 to 2.33.0; PR #122 was merged as commit cf593d0 after two approvals and with all CI checks passing.
74%
#491 build(deps): loosen requests dependency craft-application merged Merged PR #491 in commit 63ff3d01, loosening the Requests dependency after its upstream bug was fixed so newer Requests releases can be used.
73%
#5065 build(deps): update dependency requests to v2.32.2 [security] (hotfix/7.5) snapcraft merged Merged into hotfix/7.5 as 4df808913, updating requests from 2.28.1 to 2.32.2 to remediate CVE-2024-35195.
73%
#5066 build(deps): update dependency requests to v2.32.2 [security] (hotfix/8.3) snapcraft closed Renovate security bump of requests 2.31.0->2.32.2 for hotfix/8.3 (CVE-2024-35195) was closed unmerged after ~724 days of inactivity; same update merged for main (#5064), hotfix/7.5 (#5065) and hotfix/8.4 (#5067).
72%
#4813 build(deps): bump requests from 2.31.0 to 2.32.0 snapcraft closed Dependabot's requests 2.32.0 bump was closed unmerged; #5064 later advanced requests from 2.31.0 to 2.32.2 in commit ec4f9b16f.
72%