← Back to issue list

build(deps): raise oauthlib constraint to 4.0.0

View original Github issue

Metadata

Project
craft-archives
Number
#260
Type
pull request
State
merged
Author
lengau
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #260 raising the oauthlib dependency constraint to >=4.0.0 to resolve OSV security scan failures caused by advisories against version 3.3.1.

Resolution: closed resolved

Reason: The pull request was merged, updating pyproject.toml and uv.lock to require oauthlib>=4.0.0, which resolves the failing OSV security scans.

Evaluated by: mr-cal-bot

No scores available.

Issue body

## Summary The `Security scan / OSV-scanner` job fails on `main` because osv.dev has published two advisories against `oauthlib` 3.3.1, which craft-archives pulls in transitively through `lazr-restfulclient`: | Advisory | Severity | Fixed in | | --- | --- | --- | | [PYSEC-2026-4113](https://osv.dev/PYSEC-2026-4113) | 6.1 | 4.0.0 | | [GHSA-xpv3-w29h-x7cv](https://osv.dev/GHSA-xpv3-w29h-x7cv) / [PYSEC-2026-4114](https://osv.dev/PYSEC-2026-4114) | 6.8 | 4.0.0 | The last green scan on `main` was run on 2026-09-24, before these advisories were published, so this only surfaces on new runs. ## Changes - `pyproject.toml`: `oauthlib>=3.0.0` → `oauthlib>=4.0.0` in `tool.uv.constraint-dependencies`. - `uv.lock`: `oauthlib` 3.3.1 → 4.0.0 (sdist and wheel hashes). The lockfile `revision` is deliberately left at 3 so the diff stays minimal. Nothing else in the resolution changes: `lazr-restfulclient` 4.0.0 accepts `oauthlib` 4.x. ## Validation - `make test-fast` — 256 passed, 1 skipped (includes the Launchpad PPA tests that exercise `lazr.restfulclient`/oauthlib) - `make lint-twine lint-uv-lockfile lint-actions` — clean - `make lint-ty` still reports the pre-existing `@contextmanager` diagnostic, which is fixed separately in #258 This is independent of the Starbase sync, so it is split out to keep the merge PR diff focused.

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b — closed resolved Merged PR #260 raising the oauthlib dependency constraint to >=4.0.0 to resolve OSV security scan failures caused by advisories against version 3.3.1.
qwen/qwen3.6-35b-a3b
Impact: 70
Quick Win: 38
Complexity: 10
Confidence: 70
Actionability: 60
close superseded Raises oauthlib constraint from 3.0.0 to 4.0.0 to address OSV security advisories. Approved by 2 reviewers; some fast tests failing.
~deepseek/deepseek-pro-latest
Impact: 45
Quick Win: 32
Complexity: 10
Confidence: 85
Actionability: 80
needs review Raises oauthlib constraint floor to 4.0.0 and bumps uv.lock to 4.0.0 to fix two OSV advisories against 3.3.1. Approved; all CI green except lint/files.
~deepseek/deepseek-pro-latest
Impact: 50
Quick Win: 25
Complexity: 10
Confidence: 70
Actionability: 55
needs review Raises oauthlib constraint to >=4.0.0 and updates uv.lock to 4.0.0 to fix OSV-scanner advisories; tests pass, lint/files CI failing.
~deepseek/deepseek-pro-latest
Impact: 45
Quick Win: 22
Complexity: 10
Confidence: 75
Actionability: 55
needs review Raises oauthlib constraint to >=4.0.0 and updates uv.lock to 4.0.0 to remediate two OSV advisories against 3.3.1. CI mostly green; lint/files and one fast test failing.

Update history

Date Change
merged
updated
updated
updated
updated
updated
updated
created

Related issues

Issue Project State Summary Similarity
#204 build(deps): raise oauthlib constraint floor for OSV findings debcraft merged Fixed OSV security findings by raising oauthlib>=4.0.0 and urllib3>=2.8.0 constraints in tool.uv.constraint-dependencies. Merged with passing CI checks.
84%
#1204 build(deps): constraints for oauthlib and urllib3 craft-application merged Merged PR #1204 added oauthlib and urllib3 dependency constraints, remediating five cited GHSA/OSV vulnerabilities.
79%
#1383 build(deps): constraints for oauthlib and urllib3 rockcraft merged PR #1383 merged to add constraints for oauthlib and urllib3, resolving multiple OSV-reported security vulnerabilities.
78%
#267 build(deps): raise oauthlib and urllib3 constraints craft-archives closed PR #267 was closed without merging due to failing CI checks. It replaced #260 to update oauthlib and urllib3 constraints.
76%
#3914 build(deps): bump oauthlib from 3.2.0 to 3.2.1 snapcraft merged Dependabot PR merged: oauthlib bumped 3.2.0 -> 3.2.1 in snapcraft via commit 9e10fd1b6, pulling in the CVE-2022-36087 fix and non-HTTPS issuer/IPv6 signature fixes.
75%