deps: pin urllib3 to v1.x
Metadata
Current evaluation
Merged PR #264 pins urllib3 to v1.x in craft-providers, mirroring the equivalent craft-parts PR #440 (commit 15aa1c54) to avoid request/dependency problems.
Resolution: closed resolved
Reason: The PR was approved and merged into main, adding a urllib3<2 pin (3 added lines in one dependency file). It carried the same fix as craft-parts#440, which landed as commit 15aa1c54.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-----
This is the same as craft-parts: https://github.com/canonical/craft-parts/pull/440
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #264 pins urllib3 to v1.x in craft-providers, mirroring the equivalent craft-parts PR #440 (commit 15aa1c54) to avoid request/dependency problems. | |
| qwen/qwen3.6-35b-a3b | — | closed resolved | Merged PR pinning urllib3 to v1.x to resolve dependency compatibility, mirroring craft-parts #440. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Likely Fixed By:
canonical/craft-parts#440
(confidence 90%)
Referenced in the PR body as the same change; merged as commit 15aa1c54 pinning urllib3 to prevent request problems.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #440 requirements: pin urllib3 version to prevent request problems | craft-parts | merged | Merged PR #440 (commit 15aa1c54), pinning urllib3 to avoid request failures and adding a pyright workaround for an XDG dependency deadlock. | |
| #572 build(deps): pin requests<2.32 | craft-providers | merged | Merged craft-providers PR #572 pins requests<2.32, mirroring craft-parts PR #741 to avoid breakage from an upstream breaking change. | |
| #869 build: bump urllib3 | craft-providers | merged | PR #869 (commit 122fd0b) bumped urllib3 in craft-providers to clear an OSV finding; merged by maintainer bepri with approval, despite two unrelated arm64 CI failures. | |
| #4859 build(deps): bump urllib3 from 1.26.18 to 1.26.19 | snapcraft | merged | Dependabot PR merged, bumping urllib3 1.26.18 to 1.26.19 in the main requirements (commit 60d370276, PR #4859); approved by 2 reviewers with no unresolved comments. | |
| #1408 fix(deps): update urllib3 to 2.5.1 to address security vulnerabilities | craft-parts | closed | Closed unmerged; the urllib3 security update was superseded by merged PR #1411 (commit 044ea761), which upgraded uv.lock from urllib3 2.5.0 to 2.6.1. | |
| #4388 build(deps): bump urllib3 from 1.26.15 to 1.26.17 | snapcraft | merged | Merged PR #4388 upgraded urllib3 from 1.26.15 to 1.26.17 in commit 8b7202506, adding redirect Cookie stripping and pool thread-safety fixes. | |
| #3532 build(deps): bump urllib3 from 1.26.4 to 1.26.5 | snapcraft | merged | Merged PR #3532 via commit 6ddfcad68, updating urllib3 from 1.26.4 to 1.26.5 in two files. | |
| #4404 build(deps): bump urllib3 from 1.26.17 to 1.26.18 | snapcraft | merged | Dependabot PR #4404 bumping urllib3 1.26.17→1.26.18 (GHSA-g4mx-q9vg-27p4 HTTP 303 redirect fix) was approved by 2 reviewers and merged into main as commit bbd0a4ecd; sibling PR #4405 did the same for docs/.sphinx. | |
| #159 build: bump urllib3 | craft-grammar | merged | Merged PR #159 (commit f6dd80b) into craft-grammar: a +3/-3 uv.lock-only bump of urllib3 to clear an OSV advisory. Approved by 2 reviewers; all CI green except the Ubuntu 24.04/Py3.10 slow tests. | |
| #4125 deps: update dependencies, freezing urllib3 < 2.0 | snapcraft | closed | Closed unmerged as unnecessary after dependencies were refreshed by merged PR #4129 (commit fc9f9ae44). |