build: bump urllib3
Metadata
Current evaluation
Merged PR #159 (commit f6dd80b) into craft-grammar: a +3/-3 uv.lock-only bump of urllib3 to clear an OSV advisory. Approved by 2 reviewers; all CI green except the Ubuntu 24.04/Py3.10 slow tests.
Resolution: closed resolved
Reason: The PR itself was merged, landing as commit f6dd80b ("build: bump urllib3 (#159)") in craft-grammar. The single-file lock change bumped urllib3 to clear the OSV advisory, with the OSV-scanner and Trivy security-scan jobs passing.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
---
Bumps urllib3 to resolve an OSV.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #159 (commit f6dd80b) into craft-grammar: a +3/-3 uv.lock-only bump of urllib3 to clear an OSV advisory. Approved by 2 reviewers; all CI green except the Ubuntu 24.04/Py3.10 slow tests. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged a urllib3 dependency bump to address an OSV vulnerability. The one-file (+3/-3) update received two approvals; all checks except the Ubuntu 24.04/Python 3.10 slow-test job passed. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged a three-line urllib3 dependency update to resolve an OSV vulnerability, with two reviewer approvals. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged to bump urllib3 and resolve an OSV vulnerability. Approved by two reviewers and passed CI checks. The change updates a single file with minimal version adjustments. |
Update history
No update history recorded yet.
Related work
-
Related To:
craft-grammar#165
(confidence 78%)
Follow-up PR #165 (commit 9deba2e) also titled 'build: bump urllib3', again a one-file lock update resolving an OSV advisory; it supersedes this bump rather than closing it.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #344 build(deps): bump urllib3 | imagecraft | merged | Merged urllib3 dependency bump (uv.lock, +3/-3) fixing an OSV advisory; commit 033c84e landed PR #344 with 2 approvals and all CI checks green. | |
| #165 build: bump urllib3 | craft-grammar | merged | Merged PR #165 as commit 9deba2e, bumping urllib3 in a one-file lock update to resolve an OSV advisory; all CI checks passed. | |
| #869 build: bump urllib3 | craft-providers | merged | PR #869 (commit 122fd0b) bumped urllib3 in craft-providers to clear an OSV finding; merged by maintainer bepri with approval, despite two unrelated arm64 CI failures. | |
| #63 build: bump urllib3 | debcraft | merged | Merged PR #63 updated urllib3 to resolve an OSV vulnerability; commit 5f83429 passed all CI checks. | |
| #256 build: bump urllib3 | imagecraft | merged | Maintainer bepri's PR #256 bumped urllib3 in pyproject.toml (+3/-3, one file) to clear an OSV advisory. Merged as commit f288fec with 2 approvals and all CI checks green. | |
| #74 build: bump urllib3 | debcraft | merged | Merged PR #74 bumped urllib3 to resolve an OSV security warning; the change landed in commit 8eb280d. | |
| #5912 build: bump urllib3 | snapcraft | merged | Merged PR #5912 (commit 99a19a09a) bumped urllib3 to resolve an OSV vulnerability. | |
| #972 build: bump urllib3 | craft-application | merged | PR #972 merged as commit 6e9b7307, raising the urllib3 lower bound in pyproject.toml (now ">=2.8" in uv.lock) to clear an OSV vulnerability; all CI checks passed. | |
| #5930 build: bump urllib3 | snapcraft | merged | Merged PR #5930 as commit a473ada2c, bumping urllib3 to address an OSV vulnerability. | |
| #988 build: update urllib3 | craft-application | merged | Merged PR #988 updated urllib3 to resolve an OSV in commit 816951da; all listed CI checks passed. |