build(deps): bump urllib3 to 2.8.0
Metadata
Current evaluation
⚠️ This summary may be outdated — the issue content or evaluation prompts have changed since this evaluation was made.
Lock-only bump of urllib3 from 2.7.0 to 2.8.0 to resolve OSV security scan failures. Approved by 2 reviewers with 0 unresolved comments. CI has failing OSV-scanner and test-python-plugins checks.
Resolution: needs review
Reason: PR is a lock-only dependency bump with 2 approvals and 0 unresolved review comments, but CI shows the OSV-scanner still failing (ironic since the PR aims to fix it) and test-python-plugins tests are failing. The author needs to investigate and address these CI failures before merge.
Evaluated by: mr-cal-bot
Impact:
15
Quick Win:
9
Complexity:
5
Confidence:
85
Actionability:
60
Issue body
🤖 [BEEP BOOP, A BOT WROTE THIS COMMENT - Claude Opus 5.5, Copilot CLI]
Bumps `urllib3` 2.7.0 → 2.8.0 in `uv.lock` to resolve OSV findings that currently fail `Security scan / OSV-scanner` on `main`:
- [PYSEC-2026-4175](https://osv.dev/PYSEC-2026-4175) / GHSA-8988-9cw3-xx77
- [PYSEC-2026-4176](https://osv.dev/PYSEC-2026-4176) / GHSA-gh4c-6fx4-qh6g
- [PYSEC-2026-4177](https://osv.dev/PYSEC-2026-4177) / GHSA-vxq7-64xx-v4gw
Lock-only change (`uv lock --upgrade-package urllib3`). Split out as a preparation PR for #1728, where the same scan failure appears.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b |
Impact:
15
Quick Win:
9
Complexity:
5
Confidence:
85
Actionability:
60
|
needs review | Lock-only bump of urllib3 from 2.7.0 to 2.8.0 to resolve OSV security scan failures. Approved by 2 reviewers with 0 unresolved comments. CI has failing OSV-scanner and test-python-plugins checks. | |
| qwen/qwen3.6-35b-a3b |
Impact:
45
Quick Win:
30
Complexity:
10
Confidence:
85
Actionability:
75
|
needs review | Lock-only update bumping urllib3 from 2.7.0 to 2.8.0 to resolve OSV security scan failures. Has 2 approvals, 0 unresolved comments, most CI passing with one failing minimum-dependencies test. | |
| stealth/space-bunny-alpha |
Impact:
40
Quick Win:
29
Complexity:
5
Confidence:
86
Actionability:
76
|
needs review | Lock-only bump of urllib3 2.7.0 → 2.8.0 in uv.lock (+3/-3) by a maintainer, fixing three OSV advisories that currently fail the OSV-scanner check on main; OSV check passing, no failures, most test jobs still pending. | |
| qwen/qwen3.8-27b |
Impact:
45
Quick Win:
34
Complexity:
5
Confidence:
85
Actionability:
80
|
needs review | Lockfile-only bump of urllib3 2.7.0 to 2.8.0 in uv.lock, resolving three OSV findings (PYSEC-2026-4175/4176/4177) failing OSV-scanner on main. Preparation PR for #1728. Security checks green, test matrix pending, awaiting review. |
Update history
| Date | Change |
|---|---|
| merged | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| created |
Related work
-
Related To:
craft-providers#1024
(confidence 90%)
Same project family (Canonical) bumping urllib3 to 2.8.0, likely part of coordinated security update.
-
Related To:
craft-grammar#220
(confidence 85%)
Another Canonical project updating urllib3 to 2.8.0, suggesting a broader security remediation effort.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1024 build(deps): raise urllib3 to 2.8.0 | craft-providers | merged | Merged PR #1024 which bumps urllib3 to 2.8.0 in `uv.lock` and `pyproject.toml`, resolving persistent OSV-scanner security failures on main. | |
| #220 build(deps): update urllib3 to 2.8.0 | craft-grammar | merged | Merged PR #220 updating urllib3 from 2.7.0 to 2.8.0 to address three OSV security vulnerabilities (PYSEC-2026-4175/4176/4177). | |
| #344 build(deps): bump urllib3 | imagecraft | merged | Merged urllib3 dependency bump (uv.lock, +3/-3) fixing an OSV advisory; commit 033c84e landed PR #344 with 2 approvals and all CI checks green. | |
| #4859 build(deps): bump urllib3 from 1.26.18 to 1.26.19 | snapcraft | merged | Dependabot PR merged, bumping urllib3 1.26.18 to 1.26.19 in the main requirements (commit 60d370276, PR #4859); approved by 2 reviewers with no unresolved comments. | |
| #2544 build(deps): bump urllib3 from 2.5.0 to 2.6.3 | charmcraft | closed | urllib3 was not upgraded to 2.6.3: PR #2544 was closed unmerged with no maintainer explanation or resolving commit; Dependabot later stopped notifications for that release. | |
| #165 build: bump urllib3 | craft-grammar | merged | Merged PR #165 as commit 9deba2e, bumping urllib3 in a one-file lock update to resolve an OSV advisory; all CI checks passed. | |
| #108 build(deps): bump urllib3 from 2.5.0 to 2.6.3 | starflow | merged | Merged PR #108 in commit 53cb793, upgrading urllib3 from 2.5.0 to 2.6.3 with decompression-bomb and DoS security fixes. | |
| #1307 build(deps): bump urllib3 from 1.26.16 to 1.26.17 | charmcraft | closed | Dependabot closed #1307 unmerged as obsolete: the identical urllib3 1.26.16→1.26.17 security bump had already landed via #1308 (commit 51323d0f). | |
| #972 build: bump urllib3 | craft-application | merged | PR #972 merged as commit 6e9b7307, raising the urllib3 lower bound in pyproject.toml (now ">=2.8" in uv.lock) to clear an OSV vulnerability; all CI checks passed. | |
| #5562 build(deps): bump urllib3 from 1.26.20 to 2.5.0 in /docs/.sphinx | snapcraft | closed | Dependabot's urllib3 update was closed unmerged because the target requirements file was unused; merged PR #5598 later removed it in f42ae1ee4. |