← Back to issue list

build(deps): update urllib3 to 2.8.0

View original Github issue

Metadata

Project
craft-grammar
Number
#220
Type
pull request
State
merged
Author
lengau
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #220 updating urllib3 from 2.7.0 to 2.8.0 to address three OSV security vulnerabilities (PYSEC-2026-4175/4176/4177).

Resolution: closed resolved

Reason: The PR was merged, bumping urllib3 to 2.8.0 to resolve three reported security vulnerabilities (PYSEC-2026-4175/4176/4177).

Evaluated by: mr-cal-bot

No scores available.

Issue body

## Summary The OSV-scanner security job reports three known vulnerabilities in the locked `urllib3` 2.7.0 (PYSEC-2026-4175/4176/4177, CVSS up to 8.9), all fixed in 2.8.0: | OSV | CVSS | Fixed | | --- | --- | --- | | PYSEC-2026-4175 | 7.6 | 2.8.0 | | PYSEC-2026-4176 | 6.9 | 2.8.0 | | PYSEC-2026-4177 | 8.9 | 2.8.0 | `urllib3` is a transitive dependency (via `requests`/`types-requests`) and the existing constraint `urllib3>=2.0` in `pyproject.toml` already allows 2.8.0, so this is a lock-file-only bump. Pre-existing on `main`, unrelated to the Starbase sync; split out so the merge diff stays reviewable. ## Test plan - [x] `uv lock --check` passes - [x] `uv run pytest tests/unit` passes

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b — closed resolved Merged PR #220 updating urllib3 from 2.7.0 to 2.8.0 to address three OSV security vulnerabilities (PYSEC-2026-4175/4176/4177).
~deepseek/deepseek-pro-latest
Impact: 50
Quick Win: 36
Complexity: 5
Confidence: 80
Actionability: 75
needs review Lock-only bump urllib3 2.7.0→2.8.0 in uv.lock to fix three OSV advisories; approved by 2 reviewers, lint/files CI failing.
~deepseek/deepseek-pro-latest
Impact: 55
Quick Win: 42
Complexity: 5
Confidence: 78
Actionability: 80
needs review Lock-only bump of urllib3 2.7.0→2.8.0 in uv.lock (+4/-4) to fix three OSV advisories; approved, lint/files failing likely pre-existing.
~deepseek/deepseek-pro-latest
Impact: 50
Quick Win: 33
Complexity: 5
Confidence: 72
Actionability: 70
needs review Lock-only bump of urllib3 2.7.0→2.8.0 in uv.lock (+4/-4) to fix three OSV advisories; approved, lint/files failing likely pre-existing.
~deepseek/deepseek-pro-latest
Impact: 50
Quick Win: 25
Complexity: 10
Confidence: 70
Actionability: 55
needs review Lock-file-only bump of urllib3 2.7.0 to 2.8.0 in uv.lock to fix three OSV advisories; local uv lock --check and unit tests pass, but CI lint/files is failing.
~deepseek/deepseek-pro-latest
Impact: 45
Quick Win: 27
Complexity: 8
Confidence: 80
Actionability: 65
needs review Lock-file-only bump of urllib3 2.7.0→2.8.0 in uv.lock, fixing three OSV advisories (CVSS up to 8.9). OSV-scanner passes; lint/files check failing, WIP pending.

Update history

Date Change
merged
updated
updated
updated
updated
updated
created

Related issues

Issue Project State Summary Similarity
#1024 build(deps): raise urllib3 to 2.8.0 craft-providers merged Merged PR #1024 which bumps urllib3 to 2.8.0 in `uv.lock` and `pyproject.toml`, resolving persistent OSV-scanner security failures on main.
87%
#1753 build(deps): bump urllib3 to 2.8.0 craft-parts merged Lock-only bump of urllib3 from 2.7.0 to 2.8.0 to resolve OSV security scan failures. Approved by 2 reviewers with 0 unresolved comments. CI has failing OSV-scanner and test-python-plugins checks.
86%
#1130 build(deps): update dependency urllib3 to v2.5.0 [security] (main) craft-parts closed Renovate's urllib3 2.3.0->2.5.0 PR was closed unmerged as a duplicate of merged PR #1135 (commit 74e21521), which bumped urllib3 in pyproject.toml and uv.lock.
84%
#108 build(deps): bump urllib3 from 2.5.0 to 2.6.3 starflow merged Merged PR #108 in commit 53cb793, upgrading urllib3 from 2.5.0 to 2.6.3 with decompression-bomb and DoS security fixes.
84%
#1408 fix(deps): update urllib3 to 2.5.1 to address security vulnerabilities craft-parts closed Closed unmerged; the urllib3 security update was superseded by merged PR #1411 (commit 044ea761), which upgraded uv.lock from urllib3 2.5.0 to 2.6.1.
84%
#988 build: update urllib3 craft-application merged Merged PR #988 updated urllib3 to resolve an OSV in commit 816951da; all listed CI checks passed.
84%
#5564 build(deps): update dependency urllib3 to v2 [security] (hotfix/7.5) snapcraft closed Renovate's urllib3 1.26.19->2.5.0 security bump for hotfix/7.5 was closed unmerged after medubelko noted it was "Not used"; the underlying docs/requirements.txt was later deleted in merged PR #5598 (f42ae1ee4).
84%
#1430 build: update urllib3 craft-parts merged Merged PR #1430 (commit 1b60eff6) updated urllib3 to resolve an OSV vulnerability.
84%
#5565 build(deps): update dependency urllib3 to v2 [security] (hotfix/8.9) snapcraft closed PR #5565 was closed unmerged: a maintainer said its urllib3 dependency file was unused. The obsolete docs requirements file was later removed by merged PR #5598 (f42ae1ee4).
84%
#1133 build(deps): update dependency urllib3 to v2.5.0 [security] (hotfix/2.7) - autoclosed craft-parts closed Renovate PR #1133 was autoclosed without merge; the same urllib3 2.5.0 update was merged in #1135 as commit 74e21521.
83%