← Back to issue list

requirements: re-freeze requirements

View original Github issue

Metadata

Project
craft-providers
Number
#49
Type
pull request
State
merged
Author
cjp256
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #49 re-froze requirements and updated pydantic from vulnerable 1.8.1 to 1.8.2, addressing CVE-2021-29510.

Resolution: closed resolved

Reason: PR #49 was merged after review to refresh requirements for the pydantic 1.8.1 security issue. Repository context identifies #48 as superseded by #49, which updated pydantic to 1.8.2.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Security issue in pydantic 1.8.1. Refresh requirements. Signed-off-by: Chris Patterson <chris.patterson@canonical.com> - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? -----

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #49 re-froze requirements and updated pydantic from vulnerable 1.8.1 to 1.8.2, addressing CVE-2021-29510.
stealth/space-bunny-alpha — closed resolved Merged PR #49, re-freezing requirements to refresh pydantic past vulnerable 1.8.1; changes landed in commit d4113e4 via merge 5fa9fb2.
qwen/qwen3.6-35b-a3b — closed resolved Re-freezed requirements to address a security vulnerability in pydantic 1.8.1. The PR was merged after review.

Update history

Date Change
created

Related work

  • Related To: craft-providers#48 (confidence 100%)

    The pydantic bump PR #48 was superseded by #49, which delivered the requirements refresh.

Related issues

Issue Project State Summary Similarity
#347 requirements: freeze pydantic<2.0 craft-providers merged Merged #347 (commit ee9f32d), pinning pydantic<2.0 to avoid test failures caused by Pydantic v2 incompatibilities.
77%
#89 deps: freeze pydantic <2.0 craft-store merged Merged PR #89 as commit 86e3c52, pinning pydantic below 2.0 to prevent further breakage; remaining test failures were attributed to #88.
72%
#48 build(deps): bump pydantic from 1.8.1 to 1.8.2 craft-providers closed Superseded by merged PR canonical/craft-providers#49, which re-froze requirements and upgraded pydantic from 1.8.1 to 1.8.2.
71%
#511 deps: freeze pydantic version craft-parts merged Merged #511 as commit 86fbcb58 to pin pydantic; together with #512, it restored passing CI as validated by #513.
70%