← Back to issue list

build(autogen): bump urllib3

View original Github issue

Metadata

Project
craft-parts
Number
#1135
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Autogenerated dependency bump PR merged as commit 74e21521: urllib3 upgraded via `uv sync --upgrade-package urllib3` (+7/-7 across pyproject.toml and uv.lock). Approved by 3 reviewers with all CI checks green.

Resolution: closed resolved

Reason: The PR itself was merged to the main branch as commit 74e21521 by maintainer bepri, bumping the pinned urllib3 version in pyproject.toml and uv.lock. Review status shows3 approvals, 0 unresolved comments and every CI job (unit-tests, linters, OSV/Trivy scans, cla-check) passing, so the bump landed as intended.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)? ----- Bumped with `uv sync --upgrade-package urllib3`

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Autogenerated dependency bump PR merged as commit 74e21521: urllib3 upgraded via `uv sync --upgrade-package urllib3` (+7/-7 across pyproject.toml and uv.lock). Approved by 3 reviewers with all CI checks green.
stealth/space-bunny-alpha — closed resolved Merged PR canonical/craft-parts#1135 as commit 74e21521, upgrading urllib3 via uv sync; all CI checks passed.
qwen/qwen3.6-35b-a3b — — Merged after three approvals and passing CI checks. The urllib3 dependency was upgraded using uv sync --upgrade-package urllib3, modifying two files with minor version updates.
qwen3.6-35b-a3b-mtp-q6 — — Merged maintainer bepri's update to bump urllib3 using uv sync --upgrade-package urllib3. The dependency update was integrated directly without changelog entries or additional comments.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/craft-parts#1411 (confidence 60%)

    Later commit044ea761 bumps urllib3 to 2.6.1 explicitly to fix security vulnerabilities; unrelated to this autogen bump but shows urllib3 was tracked over time.

  • Related To: canonical/craft-parts#1430 (confidence 55%)

    Follow-up autogen/manual urllib3 update (commit 1b60eff6), indicating the dependency kept receiving periodic bumps after #1135.

  • Related To: canonical/imagecraft#164 (confidence 40%)

    Same upstream urllib3 bump propagated to another Canonical project, but this craft-parts PR was merged with all CI green and did not depend on it.

Related issues

Issue Project State Summary Similarity
#164 build(autogen): bump urllib3 imagecraft merged Merged as commit 4443100: bumped urllib3 via `uv sync --upgrade-package urllib3` (+3/-3, 1 file) to stop shipping a vulnerable version, despite spread test failures on Ubuntu 20.04/22.04/24.04.
87%
#972 build: bump urllib3 craft-application merged PR #972 merged as commit 6e9b7307, raising the urllib3 lower bound in pyproject.toml (now ">=2.8" in uv.lock) to clear an OSV vulnerability; all CI checks passed.
83%
#344 build(deps): bump urllib3 imagecraft merged Merged urllib3 dependency bump (uv.lock, +3/-3) fixing an OSV advisory; commit 033c84e landed PR #344 with 2 approvals and all CI checks green.
82%
#256 build: bump urllib3 imagecraft merged Maintainer bepri's PR #256 bumped urllib3 in pyproject.toml (+3/-3, one file) to clear an OSV advisory. Merged as commit f288fec with 2 approvals and all CI checks green.
82%
#159 build: bump urllib3 craft-grammar merged Merged PR #159 (commit f6dd80b) into craft-grammar: a +3/-3 uv.lock-only bump of urllib3 to clear an OSV advisory. Approved by 2 reviewers; all CI green except the Ubuntu 24.04/Py3.10 slow tests.
80%
#165 build: bump urllib3 craft-grammar merged Merged PR #165 as commit 9deba2e, bumping urllib3 in a one-file lock update to resolve an OSV advisory; all CI checks passed.
79%
#4859 build(deps): bump urllib3 from 1.26.18 to 1.26.19 snapcraft merged Dependabot PR merged, bumping urllib3 1.26.18 to 1.26.19 in the main requirements (commit 60d370276, PR #4859); approved by 2 reviewers with no unresolved comments.
79%
#63 build: bump urllib3 debcraft merged Merged PR #63 updated urllib3 to resolve an OSV vulnerability; commit 5f83429 passed all CI checks.
78%
#1024 build(deps): raise urllib3 to 2.8.0 craft-providers merged Merged PR #1024 which bumps urllib3 to 2.8.0 in `uv.lock` and `pyproject.toml`, resolving persistent OSV-scanner security failures on main.
78%
#4404 build(deps): bump urllib3 from 1.26.17 to 1.26.18 snapcraft merged Dependabot PR #4404 bumping urllib3 1.26.17→1.26.18 (GHSA-g4mx-q9vg-27p4 HTTP 303 redirect fix) was approved by 2 reviewers and merged into main as commit bbd0a4ecd; sibling PR #4405 did the same for docs/.sphinx.
78%