← Back to issue list

build: bump urllib3

View original Github issue

Metadata

Project
craft-providers
Number
#869
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

PR #869 (commit 122fd0b) bumped urllib3 in craft-providers to clear an OSV finding; merged by maintainer bepri with approval, despite two unrelated arm64 CI failures.

Resolution: closed resolved

Reason: The PR itself was merged into main as commit 122fd0b ("build: bump urllib3"), a one-file dependency change that resolved the reported OSV; OSV-scanner and Trivy security checks passed.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [ ] Have you followed the guidelines for contributing? - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `make lint && make test`? --- Bumps urllib3 to resolve an OSV.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved PR #869 (commit 122fd0b) bumped urllib3 in craft-providers to clear an OSV finding; merged by maintainer bepri with approval, despite two unrelated arm64 CI failures.
qwen/qwen3.6-35b-a3b — closed resolved Merged PR bumping urllib3 to resolve an OSV security vulnerability.

Update history

Date Change
created

Related work

  • Related To: canonical/craft-providers#872 (confidence 72%)

    Referenced in the only comment: separate PR fixing the macOS 13 runner deprecation, unrelated to the urllib3 bump

  • Likely Fixed By: canonical/craft-providers#909 (confidence 55%)

    Later PR (commit 922e691) bumps cryptography and urllib3 again to resolve further OSV findings, extending this dependency work

  • Related To: canonical/craft-providers#264 (confidence 45%)

    Earlier commits pinned urllib3 to 1.x, the constraint this bump moves away from

Related issues

Issue Project State Summary Similarity
#63 build: bump urllib3 debcraft merged Merged PR #63 updated urllib3 to resolve an OSV vulnerability; commit 5f83429 passed all CI checks.
86%
#159 build: bump urllib3 craft-grammar merged Merged PR #159 (commit f6dd80b) into craft-grammar: a +3/-3 uv.lock-only bump of urllib3 to clear an OSV advisory. Approved by 2 reviewers; all CI green except the Ubuntu 24.04/Py3.10 slow tests.
86%
#256 build: bump urllib3 imagecraft merged Maintainer bepri's PR #256 bumped urllib3 in pyproject.toml (+3/-3, one file) to clear an OSV advisory. Merged as commit f288fec with 2 approvals and all CI checks green.
86%
#165 build: bump urllib3 craft-grammar merged Merged PR #165 as commit 9deba2e, bumping urllib3 in a one-file lock update to resolve an OSV advisory; all CI checks passed.
85%
#5912 build: bump urllib3 snapcraft merged Merged PR #5912 (commit 99a19a09a) bumped urllib3 to resolve an OSV vulnerability.
84%
#344 build(deps): bump urllib3 imagecraft merged Merged urllib3 dependency bump (uv.lock, +3/-3) fixing an OSV advisory; commit 033c84e landed PR #344 with 2 approvals and all CI checks green.
83%
#988 build: update urllib3 craft-application merged Merged PR #988 updated urllib3 to resolve an OSV in commit 816951da; all listed CI checks passed.
83%
#74 build: bump urllib3 debcraft merged Merged PR #74 bumped urllib3 to resolve an OSV security warning; the change landed in commit 8eb280d.
83%
#972 build: bump urllib3 craft-application merged PR #972 merged as commit 6e9b7307, raising the urllib3 lower bound in pyproject.toml (now ">=2.8" in uv.lock) to clear an OSV vulnerability; all CI checks passed.
82%
#5930 build: bump urllib3 snapcraft merged Merged PR #5930 as commit a473ada2c, bumping urllib3 to address an OSV vulnerability.
82%