← Back to issue list

build(deps): bump lxml

View original Github issue

Metadata

Project
craft-parts
Number
#1563
Type
pull request
State
merged
Author
smethnani
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #1563 (commit 3495de62) bumped lxml from 6.0.2 to 6.1.0 in uv.lock to clear an OSV advisory; all CI and OSV/Trivy security scans passed with no reviewer comments.

Resolution: closed resolved

Reason: The PR itself was the resolution: it merged as commit 3495de62 ("build(deps): bump lxml (#1563)") updating uv.lock from lxml 6.0.2 to 6.1.0 to fix an OSV-reported vulnerability. CI, including the OSV-scanner and Trivy jobs, passed and it was approved with 0 unresolved review comments; HEAD now resolves lxml 6.1.1 after the later lock-file maintenance in #1637.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Updates `lxml` from v6.0.2 to v6.1.0 to resolve an osv - [x] Have you followed the guidelines for contributing? - [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `make lint && make test`? - [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)? ---

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #1563 (commit 3495de62) bumped lxml from 6.0.2 to 6.1.0 in uv.lock to clear an OSV advisory; all CI and OSV/Trivy security scans passed with no reviewer comments.
stealth/space-bunny-alpha — closed resolved Merged #1563 upgraded lxml from 6.0.2 to 6.1.0 to resolve an OSV vulnerability; all CI checks passed.
qwen/qwen3.6-35b-a3b — — Merged dependency update bumping lxml from v6.0.2 to v6.1.0 to resolve an OSV vulnerability. Approved by two reviewers and passed all CI checks.
qwen3.6-35b-a3b-mtp-q6 — — Merged dependency update bumping lxml from 6.0.2 to 6.1.0 to resolve an OSV security advisory. Approved and integrated by maintainer smethnani.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/craft-parts#1637 (confidence 72%)

    Later commit 4bdcac79 "build(deps): lock file maintenance (main) (#1637)" further advanced lxml to 6.1.1 in uv.lock, superseding this bump.

  • Related To: canonical/craft-artifacts#86 (confidence 55%)

    Sibling starbase repo PR bumping lxml 6.0.2 -> 6.1.1 (commit 3149b0b); matching commit 663c1b44 (#540) appears in this repo's history via the starbase merge.

Related issues

Issue Project State Summary Similarity
#86 build(deps): bump lxml craft-artifacts merged Merged PR #86 via commit 3149b0b, updating lxml from 6.0.2 to 6.1.1 in uv.lock to resolve an OSV vulnerability.
94%
#331 build(deps): update lxml imagecraft merged Merged as commit eae7ded: uv.lock-only bump of lxml to 6.1.1 clearing an OSV advisory. All CI passed, including OSV-scanner and Trivy scans; 2 approvals. Later superseded by lxml bump #540 (663c1b4).
94%
#6210 build(deps): bump lxml snapcraft merged Merged PR #6210 and commit 76f9fdaca bumped lxml to resolve an OSV security advisory.
90%
#1072 build(deps): bump lxml craft-application merged Merged #1072 via commit e8c8a384, updating lxml from v6.0.2 to v6.1.0 to resolve an OSV vulnerability.
89%
#540 build(deps): bump lxml starbase merged Merged #540, bumping lxml to resolve an OSV vulnerability. The update landed as commit 663c1b4 with all CI checks passing.
87%
#141 build(deps): update lxml to 6.1.0 debcraft merged Renovate-style dependency bump of lxml from 6.0.2 to 6.1.0 merged into debcraft via commit 434c271 (PR #141), updating only uv.lock; all CI checks passed.
86%
#362 build(deps): bump lxml craft-store merged Merged PR canonical/craft-store#362 in commit 4719100, upgrading lxml from 5.4.0 to 6.1.0 to resolve an OSV advisory.
85%
#3404 build(deps): bump lxml from 4.5.0 to 4.6.2 snapcraft merged Merged PR #3404 as commit ebb14936e, updating lxml from 4.5.0 to 4.6.2 and including HTML Cleaner JavaScript-pass-through fixes such as CVE-2020-27783.
81%
#3485 build(deps): bump lxml from 4.6.2 to 4.6.3 snapcraft merged Dependabot security bump of lxml 4.6.2 -> 4.6.3 (CVE-2021-28957 HTML cleaner fix) was approved and merged into snapcraft as commit d4d7721e3, updating requirements.txt.
77%
#3606 build(deps): bump lxml from 4.6.3 to 4.6.5 snapcraft merged Dependabot PR merged (commit 53b8cf7f1, merge 4c78e5354), bumping lxml 4.6.3 -> 4.6.5 in requirements.txt, pulling in HTML-cleaner script-injection fixes GHSL-2021-1037/1038.
75%