- [ ] Have you followed the guidelines for contributing? - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `make lint && make test`? - [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)? --- ## Description The OSV-scanner in the security scan workflow detected critical vulnerabilities (GHSA-2xpw-w6gg-jr37 and GHSA-gm62-xv2j-4w53) in urllib3 2.5.0. ## Changes - Created `requirements/uv-requirements.--all-extras.txt` with all 140 dependencies from `uv.lock` - Updated urllib3 from 2.5.0 to 2.5.1 to address the CVEs The requirements file provides a known-good dependency snapshot for CI security scanning, ensuring urllib3 uses the patched version. > [!WARNING] > > <details> > <summary>Firewall rules blocked me from connecting to one or more addresses (expand for details)</summary> > > #### I tried to connect to the following addresses, but was blocked by firewall rules: > > - `astral.sh` > - Triggering command: `/usr/bin/curl curl -LsSf REDACTED` (dns block) > > If you need me to access, download, or install something from one of these locations, you can either: > > - Configure [Actions setup steps](https://gh.io/copilot/actions-setup-steps) to set up my environment, which run before the firewall is enabled > - Add the appropriate URLs or hosts to the custom allowlist in this repository's [Copilot coding agent settings](https://github.com/canonical/craft-parts/settings/copilot/coding_agent) (admins only) > > </details> <!-- START COPILOT ORIGINAL PROMPT --> <details> <summary>Original prompt</summary> > The job 'Security scan' failed in the GitHub Actions workflow due to critical vulnerabilities detected in the urllib3 dependency (version 2.5.0) as listed in requirements/uv-requirements.--all-extras.txt. The osv-scanner reported vulnerabilities GHSA-2xpw-w6gg-jr37 and GHSA-gm62-xv2j-4w53 for urllib3 2.5.0. > > To fix: > - Locate urllib3 in requirements/uv-requirements.--all-extras.txt. > - Update the version specification to a patched release, e.g., urllib3>=2.5.1, to address recent CVEs. > - Confirm the updated version is compatible with the project and rerun the workflow to verify the fix. > > References from job log: > - Vulnerability: https://osv.dev/GHSA-2xpw-w6gg-jr37 > - Vulnerability: https://osv.dev/GHSA-gm62-xv2j-4w53 > - Failing workflow: https://github.com/canonical/craft-parts/blob/07920c7e1715dcbe1050313093b493ee1acd3863/.github/workflows/policy.yaml > - Job log excerpt:  > > Directly edit requirements/uv-requirements.--all-extras.txt as described above. </details> <!-- START COPILOT CODING AGENT SUFFIX --> *This pull request was created as a result of the following prompt from Copilot chat.* > The job 'Security scan' failed in the GitHub Actions workflow due to critical vulnerabilities detected in the urllib3 dependency (version 2.5.0) as listed in requirements/uv-requirements.--all-extras.txt. The osv-scanner reported vulnerabilities GHSA-2xpw-w6gg-jr37 and GHSA-gm62-xv2j-4w53 for urllib3 2.5.0. > > To fix: > - Locate urllib3 in requirements/uv-requirements.--all-extras.txt. > - Update the version specification to a patched release, e.g., urllib3>=2.5.1, to address recent CVEs. > - Confirm the updated version is compatible with the project and rerun the workflow to verify the fix. > > References from job log: > - Vulnerability: https://osv.dev/GHSA-2xpw-w6gg-jr37 > - Vulnerability: https://osv.dev/GHSA-gm62-xv2j-4w53 > - Failing workflow: https://github.com/canonical/craft-parts/blob/07920c7e1715dcbe1050313093b493ee1acd3863/.github/workflows/policy.yaml > - Job log excerpt:  > > Directly edit requirements/uv-requirements.--all-extras.txt as described above. <!-- START COPILOT CODING AGENT TIPS --> --- 💬 We'd love your input! Share your thoughts on Copilot coding agent in our [2 minute survey](https://gh.io/copilot-coding-agent-survey).