build: update dependencies to resolve OSVs
Metadata
Current evaluation
Merged craft-providers#1000, updating dependencies to resolve OSVs and aligning the security scanner’s calling conventions.
Resolution: closed resolved
Reason: PR #1000 was merged into the main project. Its dependency updates addressed the reported OSVs, and it also updated the security-scan calling conventions.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Also updates the calling conventions for the security scan.
---
- [ ] I've followed the [contribution guidelines](https://github.com/canonical/starbase/blob/main/CONTRIBUTING.md).
- [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
- [ ] I've updated the relevant release notes.
---
<sub>Stack created with <a href="https://github.com/github/gh-stack">GitHub Stacks CLI</a> • <a href="https://gh.io/stacks-feedback">Give Feedback 💬</a></sub>
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged craft-providers#1000, updating dependencies to resolve OSVs and aligning the security scanner’s calling conventions. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged craft-providers#1000 to resolve OSVs through dependency updates and align the security scanner's calling conventions. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged and closed to resolve OSVs by updating dependencies and security scan calling conventions. Passed CI checks with no comments or reviewer feedback. |
Update history
| Date | Change |
|---|---|
| updated | |
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2223 build(dep): update dependencies | charmcraft | merged | Merged as commit e148af23 (charmcraft#2223), bumping dependencies in 2 files (+900/-756) to clear failing OSV security scanner checks; approved by 2 maintainers. | |
| #131 build(deps): resolve OSVs | debcraft | merged | Merged as commit 509e420: routine 'build(deps): resolve OSVs' uv.lock update (cryptography 46.0.7, pygments 2.20.0, pytest 9.0.3, requests 2.33.1) that incidentally bumped craft-parts, causing a StepInfo regression. | |
| #963 build(deps): update lockfile for OSVs | craft-providers | merged | Merged PR canonical/craft-providers#963 by lengau refreshed uv.lock (uv lock -P cryptography -P idna -P pytest -P urllib3) to clear OSV-scanner CI alerts. Related Plucky test fixes landed in #962. | |
| #143 build(deps): resolve OSVs | debcraft | merged | Merged in canonical/debcraft#143 as commit 3e9db88, updating idna 3.10→3.18 and urllib3 2.6.3→2.7.0 to resolve OSV findings. All CI checks passed. | |
| #1278 build(deps): update deps to resolve OSV vulnerabilities | rockcraft | merged | Merged as f0b08615, updating nine dependencies to address OSV findings and adding scoped python-apt and cryptography scanner exceptions. | |
| #41 requirements: update dependencies | rockcraft | merged | Merged PR #41 in commit 0e8a4f5f; dependency updates included craft-providers 1.3.0 and were intended to address #39. | |
| #1019 build: update craft-providers | rockcraft | merged | Merged PR canonical/rockcraft#1019 (commit 841f7432, "build: update craft-providers"), a 3-line dependency bump to craft-providers that fixed "EOL devel" base errors in spread tests; snap-tests failures were confirmed expected. |