build: bump requests to avoid OSV
Metadata
Current evaluation
Merged PR #1121 as commit 53f7d360, bumping requests to avoid the OSV scan failure encountered with #1120; all CI checks passed.
Resolution: closed resolved
Reason: PR #1121 was approved and merged, raising the requests dependency floor to 2.32.4. Commit 53f7d360 resolved the OSV scanner failure, and every reported CI check passed.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)?
-----
Fixes [an OSV error](https://github.com/canonical/craft-parts/actions/runs/15544456986/job/43762765631?pr=1120)
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1121 as commit 53f7d360, bumping requests to avoid the OSV scan failure encountered with #1120; all CI checks passed. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/craft-parts#1121, bumping requests to address an OSV scan failure; all CI checks passed and two reviewers approved. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/craft-parts#1121 (53f7d360), bumping requests to resolve an OSV vulnerability. The PR was approved by two reviewers and all CI checks passed. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged after bumping the requests dependency to resolve an OSV vulnerability. Approved by two reviewers with all CI checks passing. The update modifies three files with 136 additions and 10 deletions. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged to bump the requests dependency, resolving an OSV security vulnerability. Maintainer bepri applied the change directly without comments or changelog updates. |
Update history
No update history recorded yet.
Related work
-
Caused By:
canonical/craft-parts#1120
(confidence 100%)
Its CI run exposed the OSV error that PR #1121 fixed.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #262 build(deps): update filelock for OSV | imagecraft | merged | Merged PR #262 bumped the filelock dependency for an OSV advisory; landed on main as commit 96ff5ed ("build(deps): update filelock for OSV (#262)"), with all CI checks green. | |
| #418 build: bump cryptography for OSV | craft-store | merged | PR #418 (maintainer bepri) bumped the cryptography dependency in2 files (+56/-56) to clear an OSV vulnerability. Approved and merged as commit e8fef67, with the OSV-scanner security check passing. | |
| #457 build(autogen): bump dependencies | craft-cli | merged | Merged as commit e5a1243 (build(autogen): bump dependencies (#457)) by maintainer bepri, bumping build/doc dependencies to resolve a batch of OSVs; all CI, lint, security scan and policy checks passed. | |
| #122 build(deps): bump requests from 2.32.5 to 2.33.0 | starflow | merged | Updated requests from 2.32.5 to 2.33.0; PR #122 was merged as commit cf593d0 after two approvals and with all CI checks passing. |