fix(deps): update urllib3 to 2.5.1 to address security vulnerabilities
Metadata
Current evaluation
Closed without merge. Updated urllib3 to 2.5.1 to resolve critical security vulnerabilities and added a requirements file for CI scanning. No reviews or CI checks were performed before closure.
Suggested action: —
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
- [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)?
---
## Description
The OSV-scanner in the security scan workflow detected critical vulnerabilities (GHSA-2xpw-w6gg-jr37 and GHSA-gm62-xv2j-4w53) in urllib3 2.5.0.
## Changes
- Created `requirements/uv-requirements.--all-extras.txt` with all 140 dependencies from `uv.lock`
- Updated urllib3 from 2.5.0 to 2.5.1 to address the CVEs
The requirements file provides a known-good dependency snapshot for CI security scanning, ensuring urllib3 uses the patched version.
> [!WARNING]
>
> <details>
> <summary>Firewall rules blocked me from connecting to one or more addresses (expand for details)</summary>
>
> #### I tried to connect to the following addresses, but was blocked by firewall rules:
>
> - `astral.sh`
> - Triggering command: `/usr/bin/curl curl -LsSf REDACTED` (dns block)
>
> If you need me to access, download, or install something from one of these locations, you can either:
>
> - Configure [Actions setup steps](https://gh.io/copilot/actions-setup-steps) to set up my environment, which run before the firewall is enabled
> - Add the appropriate URLs or hosts to the custom allowlist in this repository's [Copilot coding agent settings](https://github.com/canonical/craft-parts/settings/copilot/coding_agent) (admins only)
>
> </details>
<!-- START COPILOT ORIGINAL PROMPT -->
<details>
<summary>Original prompt</summary>
> The job 'Security scan' failed in the GitHub Actions workflow due to critical vulnerabilities detected in the urllib3 dependency (version 2.5.0) as listed in requirements/uv-requirements.--all-extras.txt. The osv-scanner reported vulnerabilities GHSA-2xpw-w6gg-jr37 and GHSA-gm62-xv2j-4w53 for urllib3 2.5.0.
>
> To fix:
> - Locate urllib3 in requirements/uv-requirements.--all-extras.txt.
> - Update the version specification to a patched release, e.g., urllib3>=2.5.1, to address recent CVEs.
> - Confirm the updated version is compatible with the project and rerun the workflow to verify the fix.
>
> References from job log:
> - Vulnerability: https://osv.dev/GHSA-2xpw-w6gg-jr37
> - Vulnerability: https://osv.dev/GHSA-gm62-xv2j-4w53
> - Failing workflow: https://github.com/canonical/craft-parts/blob/07920c7e1715dcbe1050313093b493ee1acd3863/.github/workflows/policy.yaml
> - Job log excerpt: 
>
> Directly edit requirements/uv-requirements.--all-extras.txt as described above.
</details>
<!-- START COPILOT CODING AGENT SUFFIX -->
*This pull request was created as a result of the following prompt from Copilot chat.*
> The job 'Security scan' failed in the GitHub Actions workflow due to critical vulnerabilities detected in the urllib3 dependency (version 2.5.0) as listed in requirements/uv-requirements.--all-extras.txt. The osv-scanner reported vulnerabilities GHSA-2xpw-w6gg-jr37 and GHSA-gm62-xv2j-4w53 for urllib3 2.5.0.
>
> To fix:
> - Locate urllib3 in requirements/uv-requirements.--all-extras.txt.
> - Update the version specification to a patched release, e.g., urllib3>=2.5.1, to address recent CVEs.
> - Confirm the updated version is compatible with the project and rerun the workflow to verify the fix.
>
> References from job log:
> - Vulnerability: https://osv.dev/GHSA-2xpw-w6gg-jr37
> - Vulnerability: https://osv.dev/GHSA-gm62-xv2j-4w53
> - Failing workflow: https://github.com/canonical/craft-parts/blob/07920c7e1715dcbe1050313093b493ee1acd3863/.github/workflows/policy.yaml
> - Job log excerpt: 
>
> Directly edit requirements/uv-requirements.--all-extras.txt as described above.
<!-- START COPILOT CODING AGENT TIPS -->
---
💬 We'd love your input! Share your thoughts on Copilot coding agent in our [2 minute survey](https://gh.io/copilot-coding-agent-survey).
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Closed without merge. Updated urllib3 to 2.5.1 to resolve critical security vulnerabilities and added a requirements file for CI scanning. No reviews or CI checks were performed before closure. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed without merging. The automated urllib3 update to 2.5.1 addressing CVEs was not integrated and appears abandoned. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1133 build(deps): update dependency urllib3 to v2.5.0 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | The urllib3 security update to v2.5.0 was autoclosed without review or merge. Generated by Renovate bot, the PR remained pending with zero reviewers and was ultimately abandoned. | |
| #1131 build(deps): update dependency urllib3 to v2.5.0 [security] (hotfix/2.10) - autoclosed | craft-parts | closed | Renovate automatically closed this urllib3 v2.5.0 security update without merging. The pull request was autoclosed, indicating it was superseded by a newer update or abandoned. | |
| #1430 build: update urllib3 | craft-parts | merged | Merged update to the urllib3 dependency to resolve an OSV security vulnerability. Approved by two reviewers and passed CI checks. Modified one file with 27 additions and 5 deletions. | |
| #1132 build(deps): update dependency urllib3 to v2.5.0 [security] (hotfix/2.4) - autoclosed | craft-parts | closed | Renovate automatically closed this urllib3 v2.5.0 security update without review or merge. The pull request was autoclosed, likely due to branch deletion or Renovate cleanup, leaving the change unapplied. | |
| #108 build(deps): bump urllib3 from 2.5.0 to 2.6.3 | starflow | merged | Merged a Dependabot PR bumping urllib3 from 2.5.0 to 2.6.3. The update patches critical decompression bomb and DoS vulnerabilities, plus bug fixes. Approved by reviewers, passed all CI checks, and merged successfully. | |
| #1411 fix: Update urllib3 to 2.6.1 to resolve security vulnerabilities | craft-parts | merged | Merged. Updated urllib3 to 2.6.1 in uv.lock, resolving two high-severity vulnerabilities that failed CI security scans. No code changes needed. All checks passed and the PR was merged. | |
| #344 build(deps): bump urllib3 | imagecraft | merged | Merged to bump urllib3 and resolve an OSV. Approved by two reviewers with all CI checks passing. The update modifies a single file with three additions and three deletions. | |
| #5930 build: bump urllib3 | snapcraft | merged | Merged a dependency update bumping urllib3 to resolve an OSV vulnerability. Approved by two reviewers and integrated after passing CI checks. | |
| #5562 build(deps): bump urllib3 from 1.26.20 to 2.5.0 in /docs/.sphinx | snapcraft | closed | Closed and abandoned after a maintainer noted the modified dependency file is unused. Dependabot acknowledged the closure and will stop notifying about this version. No changes were merged. | |
| #988 build: update urllib3 | craft-application | merged | Merged pull request updating the urllib3 dependency to resolve an OSV vulnerability. Approved by two reviewers with all CI checks passing. The change updated a single file with three lines. |