build: bump starlette
Metadata
Current evaluation
Merged PR #1629 as commit 5363f3fd, bumping Starlette to resolve an OSV; remaining python-apt findings were judged false positives.
Resolution: closed resolved
Reason: PR #1629 was merged into main as commit 5363f3fd. Its dependency update addressed an OSV, while the remaining python-apt scanner findings were considered false positives because a newer version was already in use.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
- [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)?
---
Bumps starlette to resolve an OSV. The python-apt failures all seem to be false positives, we are using a newer version of python-apt than what is being recommended by the scanner.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1629 as commit 5363f3fd, bumping Starlette to resolve an OSV; remaining python-apt findings were judged false positives. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/craft-parts#1629 (5363f3fd), bumping Starlette to address an OSV; remaining python-apt findings were assessed as false positives. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged to bump starlette and resolve an OSV security advisory. Approved by two reviewers and passed CI after confirming python-apt warnings were false positives. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #350 build(deps): bump starlette | imagecraft | merged | Merged PR #350 as commit 920399b, bumping Starlette from v0.52.1 to v1.2.0 to resolve an OSV advisory; all reported CI checks passed. | |
| #230 build(autogen): bump starlette for OSV | imagecraft | merged | Merged as commit cd48836, bumping Starlette in imagecraft's lockfile (uv lock --upgrade-package starlette) to clear an OSV advisory; all CI checks passed. | |
| #5118 build(deps): bump starlette from 0.38.5 to 0.40.0 | snapcraft | closed | Dependabot's starlette 0.38.5→0.40.0 PR touched no files (0 files changed) and was closed unmerged. The same security fix landed via Renovate PR #5119 (commit 9fa59f7c4, main) and #5120 (commit fceb8c169, hotfix/8.4). | |
| #357 build(deps): bump cryptography and starlette | imagecraft | merged | Merged PR #357 (commit a868324) bumping cryptography v46.0.7 to v49.0.0 and adding a starlette>=1.3.1 constraint to clear OSV findings; approved with 1 reviewer and most CI checks passing. | |
| #333 build: bump urllib3 and starlette | craft-store | merged | Merged PR #333 in commit 0d45cae, bumping urllib3 and Starlette to resolve OSV security advisories; all CI checks passed. | |
| #208 build(deps): bump starlette from 0.48.0 to 0.49.1 | craft-platforms | closed | Closed unmerged as redundant after Dependabot lock-file maintenance in #211 made Starlette current. | |
| #1181 build(deps): update dependency starlette to v0.47.2 [security] (hotfix/2.7) | craft-parts | merged | Renovate security bump of Starlette 0.45.3 -> 0.47.2 merged into hotfix/2.7 (approved, +1/-1 in pyproject.toml), fixing CVE-2025-54121 event-loop blocking on large uploads. Main counterpart merged as #1180 (48f28aa7). | |
| #190 build(deps): add constraint for Starlette | craft-grammar | merged | Merged PR #190 with two approvals, adding a two-file constraint to exclude indirect Starlette versions affected by the BadHost CVE. | |
| #84 build(deps): bump starlette from 0.48.0 to 0.49.1 | debcraft | merged | Merged PR #84 in commit ee56b5f, updating Starlette from 0.48.0 to 0.49.1 to fix the FileResponse Range-header parsing vulnerability. | |
| #1241 build(deps): add constraint for Starlette | rockcraft | merged | Merged PR #1241 in commit 703bbc20, constraining indirect Starlette to a version not affected by the BadHost CVE. |