build(deps): resolve OSVs
Metadata
Current evaluation
Merged #180 in commit 983ae56, updating uv.lock to pytest 9.0.3 from 9.0.2 to resolve OSV findings; all CI checks passed.
Resolution: closed resolved
Reason: The approved dependency lock update was merged as commit 983ae56. It upgraded pytest from 9.0.2 to 9.0.3, with all tests, scans, lint, policy, and CLA checks passing.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
---
```
❯ uv lock -P pytest
Resolved 120 packages in 721ms
Updated pytest v9.0.2 -> v9.0.3
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged #180 in commit 983ae56, updating uv.lock to pytest 9.0.3 from 9.0.2 to resolve OSV findings; all CI checks passed. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged dependency lock update upgrading pytest 9.0.2 to 9.0.3 to resolve OSVs, with two approvals and all CI checks passing. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged following two approvals and successful CI checks. Updated pytest from v9.0.2 to v9.0.3 to resolve OSV security vulnerabilities across one dependency file. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #131 build(deps): resolve OSVs | debcraft | merged | Merged as commit 509e420: routine 'build(deps): resolve OSVs' uv.lock update (cryptography 46.0.7, pygments 2.20.0, pytest 9.0.3, requests 2.33.1) that incidentally bumped craft-parts, causing a StepInfo regression. | |
| #224 build(deps): update pytest for OSV | craft-platforms | merged | Merged #224 via commit 2e4d183, addressing the pytest OSV by retaining pytest below v9 for Python versions that do not support pytest 9. | |
| #81 build(deps): resolve OSVs | craft-artifacts | merged | Merged as commit 32dec6c in craft-artifacts, bumping Pygments 2.19.2→2.20.0 and pytest 9.0.2→9.0.3 in uv.lock to clear OSV-scanner advisories. Approved by 2 reviewers despite a failing typecheck-with-ty job. | |
| #313 build(deps): resolve osvs | imagecraft | merged | Merged in commit 10f3370, updating Pygments and cryptography to resolve OSV findings. | |
| #524 build(deps): bump pytest | starbase | merged | Merged pytest dependency update to resolve an OSV; commit e372177 landed with all CI checks passing. | |
| #945 build(deps): resolve OSVs | craft-providers | merged | Merged Dependabot-style OSV remediation PR into main as commit ee7d5be, re-locking pytest and cryptography; final conflict resolution kept main's cryptography 48.0.0. | |
| #143 build(deps): resolve OSVs | debcraft | merged | Merged in canonical/debcraft#143 as commit 3e9db88, updating idna 3.10→3.18 and urllib3 2.6.3→2.7.0 to resolve OSV findings. All CI checks passed. | |
| #774 build(deps): lock file maintenance for OSV bugs | craft-providers | merged | Merged PR #774 (commit 3a4e72e) updating uv.lock to resolve OSV advisories GHSA-9hjg-9r4m-mvj7, GHSA-48p4-8xcf-vxj5q and GHSA-pq67-6m6q-mj2v; +6/-6 lines in uv.lock only. | |
| #963 build(deps): update lockfile for OSVs | craft-providers | merged | Merged PR canonical/craft-providers#963 by lengau refreshed uv.lock (uv lock -P cryptography -P idna -P pytest -P urllib3) to clear OSV-scanner CI alerts. Related Plucky test fixes landed in #962. | |
| #353 build(deps): bump libraries for OSVs | craft-store | merged | Merged dependabot-style PR bumping cryptography 44.0.2→46.0.6, Markdown 3.8→3.10.2 and Pygments 2.19.1→2.20.0 in uv.lock to clear outstanding OSVs (commit 98818d8). |