build(deps): raise oauthlib and urllib3 constraints
Metadata
Current evaluation
PR #267 was closed without merging due to failing CI checks. It replaced #260 to update oauthlib and urllib3 constraints.
Resolution: closed stale
Reason: The PR was closed without being merged. CI checks were failing on the 'Minimum dependencies' test, and no subsequent commit or PR indicates the changes were accepted.
Evaluated by: mr-cal-bot
No scores available.
Issue body
## Summary
The `Security scan / OSV-scanner` job fails on `main` because osv.dev has
published two advisories against `oauthlib` 3.3.1, which craft-archives pulls
in transitively through `lazr-restfulclient`:
| Advisory | Severity | Fixed in |
| --- | --- | --- |
| [PYSEC-2026-4113](https://osv.dev/PYSEC-2026-4113) | 6.1 | 4.0.0 |
| [GHSA-xpv3-w29h-x7cv](https://osv.dev/GHSA-xpv3-w29h-x7cv) / [PYSEC-2026-4114](https://osv.dev/PYSEC-2026-4114) | 6.8 | 4.0.0 |
The last green scan on `main` was run on 2026-09-24, before these advisories
were published, so this only surfaces on new runs.
## Changes
- `pyproject.toml`: `oauthlib>=3.0.0` → `oauthlib>=4.0.0` and
`urllib3>=2.0` → `urllib3>=2.8.0` in `tool.uv.constraint-dependencies`.
- `uv.lock`: `oauthlib` 3.3.1 → 4.0.0 and `urllib3` → 2.8.0 (sdist and
wheel hashes). The lockfile `revision` is deliberately left at 3 so the diff
stays minimal.
Nothing else in the resolution changes: `lazr-restfulclient` 4.0.0 accepts
`oauthlib` 4.x.
## Validation
- `make test-fast` — 256 passed, 1 skipped (includes the Launchpad PPA tests
that exercise `lazr.restfulclient`/oauthlib)
- `make lint-twine lint-uv-lockfile lint-actions` — clean
- `make lint-ty` still reports the pre-existing `@contextmanager` diagnostic,
which is fixed separately in #258
This is independent of the Starbase sync, so it is split out to keep the
merge PR diff focused.
## Note on this PR's history
This replaces #260, which was opened from a branch on `canonical/craft-archives`
under a different account. Same branch, same commits, reopened from this fork so
the PR is owned by the correct account.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | closed stale | PR #267 was closed without merging due to failing CI checks. It replaced #260 to update oauthlib and urllib3 constraints. |
Update history
| Date | Change |
|---|---|
| closed | |
| updated | |
| updated | |
| created |
Related work
-
Related To:
craft-archives#260
(confidence 100%)
PR #267 replaced #260.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1383 build(deps): constraints for oauthlib and urllib3 | rockcraft | merged | PR #1383 merged to add constraints for oauthlib and urllib3, resolving multiple OSV-reported security vulnerabilities. | |
| #1204 build(deps): constraints for oauthlib and urllib3 | craft-application | merged | Merged PR #1204 added oauthlib and urllib3 dependency constraints, remediating five cited GHSA/OSV vulnerabilities. | |
| #204 build(deps): raise oauthlib constraint floor for OSV findings | debcraft | merged | Fixed OSV security findings by raising oauthlib>=4.0.0 and urllib3>=2.8.0 constraints in tool.uv.constraint-dependencies. Merged with passing CI checks. | |
| #260 build(deps): raise oauthlib constraint to 4.0.0 | craft-archives | merged | Merged PR #260 raising the oauthlib dependency constraint to >=4.0.0 to resolve OSV security scan failures caused by advisories against version 3.3.1. | |
| #5562 build(deps): bump urllib3 from 1.26.20 to 2.5.0 in /docs/.sphinx | snapcraft | closed | Dependabot's urllib3 update was closed unmerged because the target requirements file was unused; merged PR #5598 later removed it in f42ae1ee4. | |
| #909 build(deps): bump cryptography and urllib3 | craft-providers | merged | Merged cryptography and urllib3 dependency updates in PR #909 to resolve OSV findings; landed as commit 922e691. | |
| #165 build: bump urllib3 | craft-grammar | merged | Merged PR #165 as commit 9deba2e, bumping urllib3 in a one-file lock update to resolve an OSV advisory; all CI checks passed. | |
| #1133 build(deps): update dependency urllib3 to v2.5.0 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | Renovate PR #1133 was autoclosed without merge; the same urllib3 2.5.0 update was merged in #1135 as commit 74e21521. | |
| #5565 build(deps): update dependency urllib3 to v2 [security] (hotfix/8.9) | snapcraft | closed | PR #5565 was closed unmerged: a maintainer said its urllib3 dependency file was unused. The obsolete docs requirements file was later removed by merged PR #5598 (f42ae1ee4). | |
| #344 build(deps): bump urllib3 | imagecraft | merged | Merged urllib3 dependency bump (uv.lock, +3/-3) fixing an OSV advisory; commit 033c84e landed PR #344 with 2 approvals and all CI checks green. |