← Back to issue list

build(deps): bump lxml

View original Github issue

Metadata

Project
craft-artifacts
Number
#86
Type
pull request
State
merged
Author
smethnani
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #86 via commit 3149b0b, updating lxml from 6.0.2 to 6.1.1 in uv.lock to resolve an OSV vulnerability.

Resolution: closed resolved

Reason: The dependency update was merged as commit 3149b0b and advanced lxml from 6.0.2 to 6.1.1, addressing the reported OSV.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [ ] Have you followed the guidelines for contributing? - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `make lint && make test`? --- Resolves an osv ``` ❯ uv lock -P lxml Updated lxml v6.0.2 -> v6.1.1 ```

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #86 via commit 3149b0b, updating lxml from 6.0.2 to 6.1.1 in uv.lock to resolve an OSV vulnerability.
stealth/space-bunny-alpha — closed resolved Merged in commit 3149b0b, updating uv.lock from lxml 6.0.2 to 6.1.1 to resolve an OSV finding.
stealth/space-bunny-alpha — closed resolved Merged starbase PR #540, updating uv.lock to bump lxml from 6.0.2 to 6.1.1 and resolve the reported OSV vulnerability.
qwen/qwen3.6-35b-a3b — — Merged a dependency update bumping lxml from v6.0.2 to v6.1.1 to resolve an OSV security advisory. Approved by two reviewers and integrated after passing CI checks.
qwen3.6-35b-a3b-mtp-q6 — — Merged dependency update bumping lxml from v6.0.2 to v6.1.1 to resolve an open source vulnerability. Integrated by maintainer smethnani.

Update history

No update history recorded yet.

Related work

Related issues

Issue Project State Summary Similarity
#1563 build(deps): bump lxml craft-parts merged Merged PR #1563 (commit 3495de62) bumped lxml from 6.0.2 to 6.1.0 in uv.lock to clear an OSV advisory; all CI and OSV/Trivy security scans passed with no reviewer comments.
94%
#1072 build(deps): bump lxml craft-application merged Merged #1072 via commit e8c8a384, updating lxml from v6.0.2 to v6.1.0 to resolve an OSV vulnerability.
94%
#331 build(deps): update lxml imagecraft merged Merged as commit eae7ded: uv.lock-only bump of lxml to 6.1.1 clearing an OSV advisory. All CI passed, including OSV-scanner and Trivy scans; 2 approvals. Later superseded by lxml bump #540 (663c1b4).
91%
#6210 build(deps): bump lxml snapcraft merged Merged PR #6210 and commit 76f9fdaca bumped lxml to resolve an OSV security advisory.
90%
#540 build(deps): bump lxml starbase merged Merged #540, bumping lxml to resolve an OSV vulnerability. The update landed as commit 663c1b4 with all CI checks passing.
90%
#141 build(deps): update lxml to 6.1.0 debcraft merged Renovate-style dependency bump of lxml from 6.0.2 to 6.1.0 merged into debcraft via commit 434c271 (PR #141), updating only uv.lock; all CI checks passed.
87%
#362 build(deps): bump lxml craft-store merged Merged PR canonical/craft-store#362 in commit 4719100, upgrading lxml from 5.4.0 to 6.1.0 to resolve an OSV advisory.
86%
#3404 build(deps): bump lxml from 4.5.0 to 4.6.2 snapcraft merged Merged PR #3404 as commit ebb14936e, updating lxml from 4.5.0 to 4.6.2 and including HTML Cleaner JavaScript-pass-through fixes such as CVE-2020-27783.
83%
#3485 build(deps): bump lxml from 4.6.2 to 4.6.3 snapcraft merged Dependabot security bump of lxml 4.6.2 -> 4.6.3 (CVE-2021-28957 HTML cleaner fix) was approved and merged into snapcraft as commit d4d7721e3, updating requirements.txt.
78%
#3606 build(deps): bump lxml from 4.6.3 to 4.6.5 snapcraft merged Dependabot PR merged (commit 53b8cf7f1, merge 4c78e5354), bumping lxml 4.6.3 -> 4.6.5 in requirements.txt, pulling in HTML-cleaner script-injection fixes GHSL-2021-1037/1038.
76%