← Back to issue list

build: bump urllib3

View original Github issue

Metadata

Project
craft-application
Number
#972
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

PR #972 merged as commit 6e9b7307, raising the urllib3 lower bound in pyproject.toml (now ">=2.8" in uv.lock) to clear an OSV vulnerability; all CI checks passed.

Resolution: closed resolved

Reason: The PR was merged into main by maintainer bepri with two approvals and no failing checks, changing only pyproject.toml's urllib3 constraint to clear the flagged OSV. Subsequent commits 816951da (#988) and 80a58477 (#1076) bumped urllib3 further, confirming the fix landed.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [ ] Have you followed the guidelines for contributing? - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `make lint && make test`? - [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)? --- Bumps urllib3 to resolve an OSV.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved PR #972 merged as commit 6e9b7307, raising the urllib3 lower bound in pyproject.toml (now ">=2.8" in uv.lock) to clear an OSV vulnerability; all CI checks passed.
stealth/space-bunny-alpha — closed resolved Merged PR #74 bumped urllib3 to resolve an OSV security vulnerability; the single-file dependency update passed all CI checks and received two approvals.
qwen/qwen3.6-35b-a3b — — Merged a dependency update bumping urllib3 to resolve an OSV vulnerability. Approved by two reviewers with all CI checks passing. The change updated the package version in a single file.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/craft-application#988 (confidence 72%)

    Commit 816951da "build: update urllib3" further updates urllib3 after this bump, keeping the OSV resolved.

  • Related To: canonical/craft-application#1076 (confidence 62%)

    Commit 80a58477 "build(deps): bump idna, urllib3" is a later follow-up dependency bump touching the same package.

  • Related To: canonical/craft-application#1204 (confidence 55%)

    Commit 40bdeaaa adds constraints for oauthlib and urllib3, continuing ongoing urllib3 dependency management.

Related issues

Issue Project State Summary Similarity
#63 build: bump urllib3 debcraft merged Merged PR #63 updated urllib3 to resolve an OSV vulnerability; commit 5f83429 passed all CI checks.
88%
#1024 build(deps): raise urllib3 to 2.8.0 craft-providers merged Merged PR #1024 which bumps urllib3 to 2.8.0 in `uv.lock` and `pyproject.toml`, resolving persistent OSV-scanner security failures on main.
88%
#256 build: bump urllib3 imagecraft merged Maintainer bepri's PR #256 bumped urllib3 in pyproject.toml (+3/-3, one file) to clear an OSV advisory. Merged as commit f288fec with 2 approvals and all CI checks green.
87%
#5912 build: bump urllib3 snapcraft merged Merged PR #5912 (commit 99a19a09a) bumped urllib3 to resolve an OSV vulnerability.
86%
#165 build: bump urllib3 craft-grammar merged Merged PR #165 as commit 9deba2e, bumping urllib3 in a one-file lock update to resolve an OSV advisory; all CI checks passed.
86%
#5930 build: bump urllib3 snapcraft merged Merged PR #5930 as commit a473ada2c, bumping urllib3 to address an OSV vulnerability.
85%
#1753 build(deps): bump urllib3 to 2.8.0 craft-parts merged Merged PR #1753 bumps urllib3 from 2.7.0 to 2.8.0 in uv.lock to resolve OSV security findings, preparing for #1728.
85%
#74 build: bump urllib3 debcraft merged Merged PR #74 bumped urllib3 to resolve an OSV security warning; the change landed in commit 8eb280d.
84%
#344 build(deps): bump urllib3 imagecraft merged Merged urllib3 dependency bump (uv.lock, +3/-3) fixing an OSV advisory; commit 033c84e landed PR #344 with 2 approvals and all CI checks green.
84%
#988 build: update urllib3 craft-application merged Merged PR #988 updated urllib3 to resolve an OSV in commit 816951da; all listed CI checks passed.
84%