build(deps): bump idna + urllib3
Metadata
Current evaluation
Merged #1615 in commit dd195de9, updating idna 3.11→3.18 and urllib3 2.6.3→2.7.0 to address reported OSV findings.
Resolution: closed resolved
Reason: PR #1615 was approved and merged as commit dd195de9. It updates idna and urllib3 to versions addressing the reported OSV findings.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
- [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)?
---
Resolves OSVs
```
Updated idna v3.11 -> v3.18
Updated urllib3 v2.6.3 -> v2.7.0
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged #1615 in commit dd195de9, updating idna 3.11→3.18 and urllib3 2.6.3→2.7.0 to address reported OSV findings. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #1615 in commit dd195de9, updating idna 3.11→3.18 and urllib3 2.6.3→2.7.0 to resolve reported OSV findings. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged dependency update bumping idna to v3.18 and urllib3 to v2.7.0 to resolve open source vulnerabilities. Approved by two reviewers and passed CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged dependency update bumping idna to 3.18 and urllib3 to 2.7.0 to resolve associated OSVs. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1076 build(deps): bump idna, urllib3 | craft-application | merged | Merged idna and urllib3 dependency bumps to address OSV findings; commit 80a58477 records the accepted change. | |
| #6265 build(deps): bump idna, urllib3 | snapcraft | merged | Merged idna and urllib3 dependency bumps to address reported OSV vulnerabilities in snapcraft#6265 (commit de6a28a9c). | |
| #344 build(deps): bump urllib3 | imagecraft | merged | Merged urllib3 dependency bump (uv.lock, +3/-3) fixing an OSV advisory; commit 033c84e landed PR #344 with 2 approvals and all CI checks green. | |
| #346 build(deps): bump idna | imagecraft | merged | Merged PR #346 in commit 4bf75c9, updating idna from 3.11 to 3.15 to resolve an OSV vulnerability. | |
| #1307 build(deps): bump urllib3 from 1.26.16 to 1.26.17 | charmcraft | closed | Dependabot closed #1307 unmerged as obsolete: the identical urllib3 1.26.16→1.26.17 security bump had already landed via #1308 (commit 51323d0f). | |
| #220 build(deps): update urllib3 to 2.8.0 | craft-grammar | merged | Merged PR #220 updating urllib3 from 2.7.0 to 2.8.0 to address three OSV security vulnerabilities (PYSEC-2026-4175/4176/4177). | |
| #165 build: bump urllib3 | craft-grammar | merged | Merged PR #165 as commit 9deba2e, bumping urllib3 in a one-file lock update to resolve an OSV advisory; all CI checks passed. | |
| #1753 build(deps): bump urllib3 to 2.8.0 | craft-parts | merged | Lock-only bump of urllib3 from 2.7.0 to 2.8.0 to resolve OSV security scan failures. Approved by 2 reviewers with 0 unresolved comments. CI has failing OSV-scanner and test-python-plugins checks. | |
| #108 build(deps): bump urllib3 from 2.5.0 to 2.6.3 | starflow | merged | Merged PR #108 in commit 53cb793, upgrading urllib3 from 2.5.0 to 2.6.3 with decompression-bomb and DoS security fixes. | |
| #63 build: bump urllib3 | debcraft | merged | Merged PR #63 updated urllib3 to resolve an OSV vulnerability; commit 5f83429 passed all CI checks. |