← Back to issue list

build(deps): lock file maintenance for OSV bugs

View original Github issue

Metadata

Project
craft-providers
Number
#774
Type
pull request
State
merged
Author
lengau
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #774 (commit 3a4e72e) updating uv.lock to resolve OSV advisories GHSA-9hjg-9r4m-mvj7, GHSA-48p4-8xcf-vxj5q and GHSA-pq67-6m6q-mj2v; +6/-6 lines in uv.lock only.

Resolution: closed resolved

Reason: The PR was approved and merged to main as commit 3a4e72e 'build(deps): lock file maintenance for OSV bugs (#774)', bumping the locked versions of the transitive dependencies flagged by the three OSV advisories. Lint fallout was handled separately in #768.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Resolutions for: - https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7 - https://osv.dev/vulnerability/GHSA-48p4-8xcf-vxj5q - https://osv.dev/vulnerability/GHSA-pq67-6m6q-mj2v - [x] Have you followed the guidelines for contributing? - [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [x] Have you successfully run `make lint && make test`? --- Lint issues are fixed in #768

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #774 (commit 3a4e72e) updating uv.lock to resolve OSV advisories GHSA-9hjg-9r4m-mvj7, GHSA-48p4-8xcf-vxj5q and GHSA-pq67-6m6q-mj2v; +6/-6 lines in uv.lock only.
qwen/qwen3.6-35b-a3b — closed resolved Merged lock file maintenance to resolve OSV vulnerabilities GHSA-9hjg-9r4m-mvj7, GHSA-48p4-8xcf-vxj5q, and GHSA-pq67-6m6q-mj2v.

Update history

Date Change
created

Related work

  • Related To: canonical/craft-providers#768 (confidence 85%)

    Referenced in the PR body as the place lint issues from the lock update were fixed (merged: ruff minimum Python 3.10).

  • Related To: canonical/craft-providers#782 (confidence 55%)

    Follow-up commit0a7d38 'build(deps): update uv lockfile' immediately after 3a4e72e continued the same lock maintenance.

  • Related To: canonical/craft-providers#759 (confidence 50%)

    Preceding dependency bugfix commit 9fe26a5 that this lock maintenance built on.

Related issues

Issue Project State Summary Similarity
#262 build(deps): update filelock for OSV imagecraft merged Merged PR #262 bumped the filelock dependency for an OSV advisory; landed on main as commit 96ff5ed ("build(deps): update filelock for OSV (#262)"), with all CI checks green.
83%
#92 build(deps): lock file maintenance starflow merged Renovate lock file maintenance PR merged into main as commit 00eb359, refreshing uv.lock (+201/-146, 1 file) after approval by 2 reviewers and a fully passing CI run.
82%
#374 build(deps): lock file maintenance craft-cli merged Renovate lock file maintenance PR #374 merged into main as commit 43211b6, refreshing uv.lock only (+427/-370 lines); 2 reviewer approvals and all CI checks passed.
82%
#152 build(deps): lock file maintenance craft-platforms merged Renovate lock file maintenance PR merged into main as commit eb960b3, refreshing uv.lock (+52/-15 lines) so all locks use the latest dependency versions.
82%
#343 build(deps): lock file maintenance starbase merged Renovate lock-file maintenance PR merged into main as commit 067feab, refreshing all locks in uv.lock (+55/-55 lines).
81%
#2758 build(deps): lock file maintenance (main) charmcraft merged Renovate lock-file maintenance PR #2758 merged into main as commit 3eaf69ba, refreshing uv.lock (+755/-665) with latest dependency versions.
81%
#228 build(deps): lock file maintenance (main) craft-archives merged Renovate lock file maintenance PR merged into main as commit 1b6bf12, refreshing uv.lock (+1144/-1118). Merged despite two red "Security scan / OSV-scanner" checks; lint, test and CLA jobs all passed.
81%
#27 build(deps): lock file maintenance debcraft merged Renovate lock file maintenance PR merged into main via commit cee23b9, refreshing uv.lock (+1089/-708) to latest dependency versions after 2 approvals and a fully green CI run.
81%
#227 build(deps): lock file maintenance (main) craft-archives merged Renovate lock file maintenance PR merged into main as commit 14e2bba, refreshing all locks (uv.lock, +1144/-1118) after two reviewer approvals despite a failing OSV-scanner job.
81%
#2410 build(deps): lock file maintenance (main) charmcraft merged Renovate PR #2410 merged into main as 4eff50fb, refreshing uv.lock to latest dependency versions.
81%