build(deps): raise urllib3 to 2.8.0
Metadata
Current evaluation
Merged PR #1024 which bumps urllib3 to 2.8.0 in `uv.lock` and `pyproject.toml`, resolving persistent OSV-scanner security failures on main.
Resolution: closed resolved
Reason: The PR was merged, updating the dependency lock and constraint to urllib3 2.8.0, which fixes the reported PYSEC vulnerabilities and passes the OSV-scanner workflow.
Evaluated by: mr-cal-bot
No scores available.
Issue body
🤖 [BEEP BOOP, A BOT WROTE THIS COMMENT - mimo-v2.6-flash-free, opencode]
Raise the locked `urllib3` from 2.7.0 to 2.8.0 in `uv.lock` (only change;
the `>=2.0` constraint already permits it).
This fixes the OSV-scanner findings that fail the `Check policy` workflow
(`Security scan / OSV-scanner` job) on `main` — the same job has been
failing on main since 2026-10-05, independently of the Starbase merge:
| Advisory | CVSS |
| --- | --- |
| PYSEC-2026-4175 (GHSA-8988-9cw3-xx77) | 7.6 |
| PYSEC-2026-4176 (GHSA-gh4c-6fx4-qh6g) | 6.9 |
| PYSEC-2026-4177 (GHSA-vxq7-64xx-v4gw) | 8.9 |
All three are fixed in urllib3 2.8.0. The scanner reads
`requirements/uv-requirements.--all-extras.txt`, which starflow's
`scan-python` workflow exports from `uv.lock`, so the lock bump is the fix.
Validation: `uv lock --check` passes; `make test-fast` 1682 passed.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | closed resolved | Merged PR #1024 which bumps urllib3 to 2.8.0 in `uv.lock` and `pyproject.toml`, resolving persistent OSV-scanner security failures on main. | |
| ~deepseek/deepseek-pro-latest |
Impact:
45
Quick Win:
31
Complexity:
8
Confidence:
80
Actionability:
75
|
needs review | Lock-only bump of urllib3 2.7.0→2.8.0 in uv.lock (+4/-4) to fix three OSV advisories failing the OSV-scanner job. OSV check passes; lint/files fails on pre-existing ty warnings fixed by #1020. | |
| ~deepseek/deepseek-pro-latest |
Impact:
55
Quick Win:
33
Complexity:
8
Confidence:
75
Actionability:
65
|
keep open | Lock-only urllib3 2.7.0→2.8.0 bump in uv.lock (+4/-4) to fix three OSV advisories failing the OSV-scanner check on main. OSV check passes; lint/files fails on pre-existing ty warnings fixed by #1020. | |
| ~deepseek/deepseek-pro-latest |
Impact:
50
Quick Win:
28
Complexity:
5
Confidence:
70
Actionability:
60
|
needs review | Lock-only bump of urllib3 2.7.0 to 2.8.0 in uv.lock to fix three OSV advisories failing Security scan on main; CI mostly green but lint/files failing. |
Update history
| Date | Change |
|---|---|
| merged | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #972 build: bump urllib3 | craft-application | merged | PR #972 merged as commit 6e9b7307, raising the urllib3 lower bound in pyproject.toml (now ">=2.8" in uv.lock) to clear an OSV vulnerability; all CI checks passed. | |
| #1753 build(deps): bump urllib3 to 2.8.0 | craft-parts | merged | Lock-only bump of urllib3 from 2.7.0 to 2.8.0 to resolve OSV security scan failures. Approved by 2 reviewers with 0 unresolved comments. CI has failing OSV-scanner and test-python-plugins checks. | |
| #220 build(deps): update urllib3 to 2.8.0 | craft-grammar | merged | Merged PR #220 updating urllib3 from 2.7.0 to 2.8.0 to address three OSV security vulnerabilities (PYSEC-2026-4175/4176/4177). | |
| #1130 build(deps): update dependency urllib3 to v2.5.0 [security] (main) | craft-parts | closed | Renovate's urllib3 2.3.0->2.5.0 PR was closed unmerged as a duplicate of merged PR #1135 (commit 74e21521), which bumped urllib3 in pyproject.toml and uv.lock. | |
| #344 build(deps): bump urllib3 | imagecraft | merged | Merged urllib3 dependency bump (uv.lock, +3/-3) fixing an OSV advisory; commit 033c84e landed PR #344 with 2 approvals and all CI checks green. | |
| #1408 fix(deps): update urllib3 to 2.5.1 to address security vulnerabilities | craft-parts | closed | Closed unmerged; the urllib3 security update was superseded by merged PR #1411 (commit 044ea761), which upgraded uv.lock from urllib3 2.5.0 to 2.6.1. | |
| #5963 build(deps): bump urllib3 from 2.6.1 to 2.6.3 | snapcraft | closed | Closed unmerged as a duplicate of merged PR #5930, which updated urllib3 to 2.6.3 in commit a473ada2c. | |
| #5562 build(deps): bump urllib3 from 1.26.20 to 2.5.0 in /docs/.sphinx | snapcraft | closed | Dependabot's urllib3 update was closed unmerged because the target requirements file was unused; merged PR #5598 later removed it in f42ae1ee4. | |
| #108 build(deps): bump urllib3 from 2.5.0 to 2.6.3 | starflow | merged | Merged PR #108 in commit 53cb793, upgrading urllib3 from 2.5.0 to 2.6.3 with decompression-bomb and DoS security fixes. | |
| #74 build: bump urllib3 | debcraft | merged | Merged PR #74 bumped urllib3 to resolve an OSV security warning; the change landed in commit 8eb280d. |