fix: Update urllib3 to 2.6.1 to resolve security vulnerabilities
Metadata
Current evaluation
Merged. Updated urllib3 to 2.6.1 in uv.lock, resolving two high-severity vulnerabilities that failed CI security scans. No code changes needed. All checks passed and the PR was merged.
Suggested action: —
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
- [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)?
---
## Description
Security scans failing on urllib3 2.5.0 due to GHSA-2xpw-w6gg-jr37 and GHSA-gm62-xv2j-4w53 (both severity 8.9).
## Changes
- **uv.lock**: Updated urllib3 from 2.5.0 to 2.6.1 with corresponding package hashes
urllib3 2.6.1 resolves both advisories. No application code changes required.
The starflow CI workflow automatically generates requirements files from uv.lock during security scans, so no manual requirements file is needed in the repository.
<!-- START COPILOT ORIGINAL PROMPT -->
<details>
<summary>Original prompt</summary>
> ## Problem Statement: Security Job Failure
> The security scan in the Check policy workflow is failing due to high-severity vulnerabilities in the `urllib3` package (v2.5.0), as seen in the logs:
> > | https://osv.dev/GHSA-2xpw-w6gg-jr37 | 8.9 | PyPI | urllib3 | 2.5.0 | requirements/uv-requirements.--all-extras.txt |
> > | https://osv.dev/GHSA-gm62-xv2j-4w53 | 8.9 | PyPI | urllib3 | 2.5.0 | requirements/uv-requirements.--all-extras.txt |
> This causes `osv-scanner` to fail and the workflow to exit with code 1.
>
> ## Solution
> - Update `urllib3` in `requirements/uv-requirements.--all-extras.txt` to a secure version that resolves these advisories (see:
> - https://osv.dev/GHSA-2xpw-w6gg-jr37
> - https://osv.dev/GHSA-gm62-xv2j-4w53)
> - Re-run the workflow to verify the scan passes.
>
> ### Suggested Code Change:
> - In `requirements/uv-requirements.--all-extras.txt`, change:
> ```
> urllib3==2.5.0
> ```
> to the latest secure version. For example, if 2.5.2 or higher resolves the issue:
> ```
> urllib3==2.5.2
> ```
> - Check advisories for the correct patched version.
>
> ---
> References:
> - osv-scanner job log: failure due to vulnerabilities in urllib3
> - Job definition: .github/workflows/policy.yaml (ref: 07920c7e1715dcbe1050313093b493ee1acd3863)
>
</details>
<!-- START COPILOT CODING AGENT SUFFIX -->
*This pull request was created as a result of the following prompt from Copilot chat.*
> ## Problem Statement: Security Job Failure
> The security scan in the Check policy workflow is failing due to high-severity vulnerabilities in the `urllib3` package (v2.5.0), as seen in the logs:
> > | https://osv.dev/GHSA-2xpw-w6gg-jr37 | 8.9 | PyPI | urllib3 | 2.5.0 | requirements/uv-requirements.--all-extras.txt |
> > | https://osv.dev/GHSA-gm62-xv2j-4w53 | 8.9 | PyPI | urllib3 | 2.5.0 | requirements/uv-requirements.--all-extras.txt |
> This causes `osv-scanner` to fail and the workflow to exit with code 1.
>
> ## Solution
> - Update `urllib3` in `requirements/uv-requirements.--all-extras.txt` to a secure version that resolves these advisories (see:
> - https://osv.dev/GHSA-2xpw-w6gg-jr37
> - https://osv.dev/GHSA-gm62-xv2j-4w53)
> - Re-run the workflow to verify the scan passes.
>
> ### Suggested Code Change:
> - In `requirements/uv-requirements.--all-extras.txt`, change:
> ```
> urllib3==2.5.0
> ```
> to the latest secure version. For example, if 2.5.2 or higher resolves the issue:
> ```
> urllib3==2.5.2
> ```
> - Check advisories for the correct patched version.
>
> ---
> References:
> - osv-scanner job log: failure due to vulnerabilities in urllib3
> - Job definition: .github/workflows/policy.yaml (ref: 07920c7e1715dcbe1050313093b493ee1acd3863)
>
<!-- START COPILOT CODING AGENT TIPS -->
---
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more [Copilot coding agent tips](https://gh.io/copilot-coding-agent-tips) in the docs.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged. Updated urllib3 to 2.6.1 in uv.lock, resolving two high-severity vulnerabilities that failed CI security scans. No code changes needed. All checks passed and the PR was merged. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged update to urllib3 2.6.1, resolving two high-severity vulnerabilities that caused CI security scans to fail. Changes were limited to uv.lock with no application code modifications required. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1430 build: update urllib3 | craft-parts | merged | Merged update to the urllib3 dependency to resolve an OSV security vulnerability. Approved by two reviewers and passed CI checks. Modified one file with 27 additions and 5 deletions. | |
| #988 build: update urllib3 | craft-application | merged | Merged pull request updating the urllib3 dependency to resolve an OSV vulnerability. Approved by two reviewers with all CI checks passing. The change updated a single file with three lines. | |
| #108 build(deps): bump urllib3 from 2.5.0 to 2.6.3 | starflow | merged | Merged a Dependabot PR bumping urllib3 from 2.5.0 to 2.6.3. The update patches critical decompression bomb and DoS vulnerabilities, plus bug fixes. Approved by reviewers, passed all CI checks, and merged successfully. | |
| #1408 fix(deps): update urllib3 to 2.5.1 to address security vulnerabilities | craft-parts | closed | Closed without merge. Updated urllib3 to 2.5.1 to resolve critical security vulnerabilities and added a requirements file for CI scanning. No reviews or CI checks were performed before closure. | |
| #256 build: bump urllib3 | imagecraft | merged | Merged a dependency update bumping urllib3 to resolve an OSV security advisory. The change passed all CI checks and received reviewer approval before integration. | |
| #5930 build: bump urllib3 | snapcraft | merged | Merged a dependency update bumping urllib3 to resolve an OSV vulnerability. Approved by two reviewers and integrated after passing CI checks. | |
| #972 build: bump urllib3 | craft-application | merged | Merged a dependency update bumping urllib3 to resolve an OSV vulnerability. Approved by two reviewers with all CI checks passing. The change updated the package version in a single file. | |
| #159 build: bump urllib3 | craft-grammar | merged | Merged to bump urllib3 and resolve an OSV vulnerability. Approved by two reviewers and passed CI checks. The change updates a single file with minimal version adjustments. | |
| #165 build: bump urllib3 | craft-grammar | merged | Merged a dependency update bumping urllib3 to resolve an OSV vulnerability. Approved by two reviewers with all CI checks passing. The change modifies a single file. | |
| #5912 build: bump urllib3 | snapcraft | merged | Merged to bump urllib3 and resolve an OSV vulnerability. Approved by two reviewers and passed CI checks. Updated a single dependency file with minimal changes. |