← Back to issue list

build(autogen): bump dependencies

View original Github issue

Metadata

Project
craft-cli
Number
#457
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Merged as commit e5a1243 (build(autogen): bump dependencies (#457)) by maintainer bepri, bumping build/doc dependencies to resolve a batch of OSVs; all CI, lint, security scan and policy checks passed.

Resolution: closed resolved

Reason: The PR itself was merged into main as commit e5a1243, titled 'build(autogen): bump dependencies (#457)', after approval with no failing CI jobs; the only unresolved review thread was a maintainer note that the OSVs mostly concern docs dependencies not yet on Sphinx Stack.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [ ] Have you followed the guidelines for contributing? - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `make lint && make test`? --- Resolves a bunch of OSVs. Note: although almost all of these are docs dependencies, this repository doesn't use Sphinx Stack yet and so I'm not going to treat them any differently here.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged as commit e5a1243 (build(autogen): bump dependencies (#457)) by maintainer bepri, bumping build/doc dependencies to resolve a batch of OSVs; all CI, lint, security scan and policy checks passed.
stealth/space-bunny-alpha — closed resolved Merged build(autogen) dependency updates to resolve multiple OSVs; all listed CI, lint, policy, CLA, and security checks passed.
qwen/qwen3.6-35b-a3b — — Merged after reviewer approval and passing all CI checks. Bumped dependencies across two files to resolve multiple OSV security vulnerabilities. All tests, linting, and security scans passed successfully.
qwen3.6-35b-a3b-mtp-q6
Staleness: 5
Complexity: 20
Confidence: 85
needs review Updates and bumps various project dependencies to resolve multiple OSV security vulnerabilities. Currently awaiting maintainer review and CI checks.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/imagecraft#247 (confidence 45%)

    Same series of 'build(autogen): bump dependencies to resolve OSVs' PRs in sibling Canonical craft repos, with near-identical scope and rationale.

  • Related To: canonical/craft-providers#1000 (confidence 40%)

    Companion OSV-resolving dependency bump in craft-providers, likely filed from the same cross-repo security sweep.

  • Related To: craft-cli#451 (confidence 35%)

    Adjacent, later-autogenerated dependabot bump (sphinx-toolbox v4.2.0) in pyproject.toml; #457 was the manual autogen bump covering the same dependency set.

Related issues

Issue Project State Summary Similarity
#247 build(autogen): bump dependencies to resolve OSVs imagecraft merged Merged #247 via commit 603fbc3, updating filelock 3.20.2, fonttools 4.61.1, and urllib3 2.6.2 to resolve OSV warnings; all CI checks passed.
80%
#342 build(autogen): bump libraries to fix OSVs craft-store merged Autogenerated lockfile PR by maintainer bepri merged as commit 7a0dbd3, bumping cffi 1.17.1->2.0.0, filelock, jaraco-context, protobuf 6.33.5, pynacl 1.6.2, urllib3 2.6.3 and wheel 0.46.3 to clear OSV scanner/Trivy findings.
76%
#2223 build(dep): update dependencies charmcraft merged Merged as commit e148af23 (charmcraft#2223), bumping dependencies in 2 files (+900/-756) to clear failing OSV security scanner checks; approved by 2 maintainers.
72%
#167 build(autogen): bump version of setuptools craft-archives merged Merged #167 via commit 03132c5, updating setuptools in the generated dependency lock file; all CI checks passed and two reviewers approved.
70%
#1121 build: bump requests to avoid OSV craft-parts merged Merged PR #1121 as commit 53f7d360, bumping requests to avoid the OSV scan failure encountered with #1120; all CI checks passed.
70%