← Back to issue list

build(deps): resolve OSVs

View original Github issue

Metadata

Project
craft-artifacts
Number
#81
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Merged as commit 32dec6c in craft-artifacts, bumping Pygments 2.19.2→2.20.0 and pytest 9.0.2→9.0.3 in uv.lock to clear OSV-scanner advisories. Approved by 2 reviewers despite a failing typecheck-with-ty job.

Resolution: closed resolved

Reason: The dependabot-style lockfile-only PR was approved by 2 reviewers and merged to the default branch as commit 32dec6c (titled 'build(deps): resolve OSVs (#81)'), updating uv.lock (+6/-6 lines) so the OSV-scanner, Trivy and build-artefact security checks pass.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [ ] Have you followed the guidelines for contributing? - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `make lint && make test`? --- ``` ❯ uv lock -P pytest -P pygments Using CPython 3.14.2 Resolved 118 packages in 516ms Updated pygments v2.19.2 -> v2.20.0 Updated pytest v9.0.2 -> v9.0.3 ```

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged as commit 32dec6c in craft-artifacts, bumping Pygments 2.19.2→2.20.0 and pytest 9.0.2→9.0.3 in uv.lock to clear OSV-scanner advisories. Approved by 2 reviewers despite a failing typecheck-with-ty job.
stealth/space-bunny-alpha — closed resolved Merged #81 as 32dec6c, updating Pygments 2.19.2 to 2.20.0 and pytest 9.0.2 to 9.0.3 in the lockfile to resolve OSV vulnerabilities.
stealth/space-bunny-alpha — closed resolved Merged lockfile updates to Pygments 2.20.0 and pytest 9.0.3, resolving OSV findings; security scans and tests passed.
qwen/qwen3.6-35b-a3b — — Merged after two approvals. Updates pygments to 2.20.0 and pytest to 9.0.3 to resolve OSV security vulnerabilities. CI checks passed, and the six-line dependency lock update was successfully integrated.
qwen3.6-35b-a3b-mtp-q6 — — Merged dependency update to resolve OSV vulnerabilities. Updated pygments to v2.20.0 and pytest to v9.0.3 via uv lock. Changes were integrated into the main branch.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/craft-providers#774 (confidence 45%)

    Analogous 'lock file maintenance for OSV bugs' PR in a sibling Canonical project addressing the same class of advisory remediation.

Related issues

Issue Project State Summary Similarity
#131 build(deps): resolve OSVs debcraft merged Merged as commit 509e420: routine 'build(deps): resolve OSVs' uv.lock update (cryptography 46.0.7, pygments 2.20.0, pytest 9.0.3, requests 2.33.1) that incidentally bumped craft-parts, causing a StepInfo regression.
83%
#180 build(deps): resolve OSVs craft-grammar merged Merged #180 in commit 983ae56, updating uv.lock to pytest 9.0.3 from 9.0.2 to resolve OSV findings; all CI checks passed.
80%
#1529 build(deps): bump pygments to 2.20.0 craft-parts merged Merged PR #1529 as commit 5ed85e12, updating Pygments to 2.20.0 to resolve an OSV; all listed CI checks passed.
80%
#115 build(deps): bump pygments from 2.19.2 to 2.20.0 debcraft merged Merged PR debcraft#115 as commit f580d60, updating Pygments from 2.19.2 to 2.20.0 in uv.lock.
79%
#313 build(deps): resolve osvs imagecraft merged Merged in commit 10f3370, updating Pygments and cryptography to resolve OSV findings.
79%
#124 build(deps): bump pygments from 2.19.2 to 2.20.0 starflow merged Dependabot PR bumping pygments 2.19.2 to 2.20.0 was approved by 2 reviewers, passed all CI checks, and merged into main via commit 1908f7b, updating uv.lock.
79%
#353 build(deps): bump libraries for OSVs craft-store merged Merged dependabot-style PR bumping cryptography 44.0.2→46.0.6, Markdown 3.8→3.10.2 and Pygments 2.19.1→2.20.0 in uv.lock to clear outstanding OSVs (commit 98818d8).
78%
#517 build(deps): bump pygments starbase merged Merged the Pygments dependency bump in #517 (commit c9fecdf), clearing the reported OSV security warning.
77%
#177 build(deps): bump pygments craft-grammar merged Merged the Pygments dependency bump in #177 via commit de39544, resolving an OSV warning with all CI checks passing.
77%
#1550 build(deps): bump pytest craft-parts merged Merged craft-parts#1550 in commit e5a6febb, updating pytest to resolve an OSV finding; all lint, test, and security checks passed.
77%