test: bump black fixture to 26.3.1 to resolve OSV findings
Metadata
Current evaluation
PR #1732 bumped the python plugin conflict fixture from black==24.10.0 to 26.3.1 and made the conflict assertion order-agnostic. Approved (2 reviewers, OSV/policy checks green) but closed unmerged with no comments after 10 days with many checks still pending.
Resolution: closed stale
Reason: The PR was never merged — it is closed with zero comments and no resolving commit, while test/artifact/policy checks were still pending. Nothing in main carries the 26.3.1 fixture bump, so the change was abandoned rather than superseded by a merged alternative.
Evaluated by: mr-cal-bot
No scores available.
Issue body
The python plugin conflict test fixture pins `black==24.10.0`, which osv-scanner flags (PYSEC-2026-2120, critical; PYSEC-2026-2121, high), failing the Security scan workflow. This bumps the fixture to 26.3.1 and makes the conflict assertion order-agnostic, since pip orders the two pins by version in its error message.
Surfaced while working on canonical/craft-parts#1728; split out as a preparation PR since it stands on its own merits.
🤖 [BEEP BOOP, A BOT WROTE THIS PR - Kimi K3, Copilot CLI]
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | PR #1732 bumped the python plugin conflict fixture from black==24.10.0 to 26.3.1 and made the conflict assertion order-agnostic. Approved (2 reviewers, OSV/policy checks green) but closed unmerged with no comments after 10 days with many checks still pending. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as canonical/craft-parts#1732 in commit de538c04, updating the Black fixture to 26.3.1 and making the conflict assertion order-agnostic. | |
| stealth/space-bunny-alpha | — | closed stale | PR #1732 bumped the python plugin conflict test fixture from black==24.10.0 to 26.3.1 (PYSEC-2026-2120/2121) and made the conflict assertion order-agnostic. Approved, but closed unmerged with test/artefact checks still pending; split out of #1728. | |
| stealth/space-bunny-alpha | — | closed stale | Not merged: the Black fixture update to 26.3.1 passed OSV-scanner and policy audits, but multiple test, artifact, and policy checks remained pending. | |
| qwen/qwen3.6-35b-a3b |
Impact:
50
Quick Win:
36
Complexity:
10
Confidence:
85
Actionability:
80
|
needs review | Bumps black fixture from 24.10.0 to 26.3.1 to resolve OSV security scan failures (PYSEC-2026-2120/2121) and makes the conflict assertion order-agnostic. CI passing, awaiting review. |
Update history
| Date | Change |
|---|---|
| closed | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| created |
Related work
-
Related To:
canonical/craft-parts#1728
(confidence 70%)
PR #1728 (merge of starbase, merged as d2be519e) is the work this fixture PR was split out from as preparation; the fixture bump itself was closed unmerged.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #6097 build(deps): bump black from 24.8.0 to 26.3.1 in /tests/spread/plugins/craft-parts/build-and-run-hello/uv-hello/src | snapcraft | closed | Dependabot's Black 24.8.0-to-26.3.1 test-fixture bump was closed unmerged after a maintainer asked Dependabot to ignore the dependency. |