build(deps): resolve OSVs
Metadata
Current evaluation
Merged Dependabot-style OSV remediation PR into main as commit ee7d5be, re-locking pytest and cryptography; final conflict resolution kept main's cryptography 48.0.0.
Resolution: closed resolved
Reason: The PR was approved (2 reviewers, 0 unresolved comments) and merged into main, recorded in pyproject.toml history as commit ee7d5be "build(deps): resolve OSVs (#945)". During review, lengau's alternative fix (commit a85281c) resolved repeated merge conflicts in uv.lock by taking main's cryptography 48.0.0.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
---
```
❯ uv lock -P pytest -P cryptography
Resolved 111 packages in 1.23s
Updated cryptography v46.0.6 -> v46.0.7
Updated pytest v9.0.2 -> v9.0.3
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged Dependabot-style OSV remediation PR into main as commit ee7d5be, re-locking pytest and cryptography; final conflict resolution kept main's cryptography 48.0.0. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in #945 as ee7d5be, updating locked dependencies to resolve OSV findings. Final conflict resolution retained main's cryptography 48.0.0. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged dependency updates resolving OSV vulnerabilities. Bumps cryptography to 46.0.7 and pytest to 9.0.3 to fix minimum dependency test failures. Conflicts resolved automatically before final merge. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
15
Complexity:
25
Confidence:
85
|
needs review | Updates cryptography and pytest to resolve OSV alerts and fix minimum-dependency CI failures. Merge conflicts have been resolved and the PR awaits final maintainer review. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/craft-providers#972
(confidence 40%)
Neighbouring dependency constraint commit on pyproject.toml immediately preceding ee7d5be in history; same lockfile/constraint surface.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #131 build(deps): resolve OSVs | debcraft | merged | Merged as commit 509e420: routine 'build(deps): resolve OSVs' uv.lock update (cryptography 46.0.7, pygments 2.20.0, pytest 9.0.3, requests 2.33.1) that incidentally bumped craft-parts, causing a StepInfo regression. | |
| #313 build(deps): resolve osvs | imagecraft | merged | Merged in commit 10f3370, updating Pygments and cryptography to resolve OSV findings. | |
| #180 build(deps): resolve OSVs | craft-grammar | merged | Merged #180 in commit 983ae56, updating uv.lock to pytest 9.0.3 from 9.0.2 to resolve OSV findings; all CI checks passed. | |
| #940 build(deps): update cryptography, pygments, requests | craft-providers | merged | Merged PR #940 as commit eb8549f, updating cryptography, Pygments, and requests to resolve three OSV warnings. | |
| #353 build(deps): bump libraries for OSVs | craft-store | merged | Merged dependabot-style PR bumping cryptography 44.0.2→46.0.6, Markdown 3.8→3.10.2 and Pygments 2.19.1→2.20.0 in uv.lock to clear outstanding OSVs (commit 98818d8). | |
| #421 build: bump dependencies for OSVs | imagecraft | merged | Maintainer dependabot-style PR merged as commit 71a1ee0: cryptography 49.0.0 -> 50.0.0 and httplib2 0.31.2 -> 0.32.0 to clear OSV dependency findings. Approved by 2 reviewers; OSV-scanner check passed, though build/snap-builds checks failed. | |
| #524 build(deps): bump pytest | starbase | merged | Merged pytest dependency update to resolve an OSV; commit e372177 landed with all CI checks passing. | |
| #1061 build(deps): bump cryptography | craft-application | merged | Merged PR #1061 in commit 4b0e00ae, bumping cryptography to remediate an OSV; two approvals and all reported CI checks passed. | |
| #1278 build(deps): update deps to resolve OSV vulnerabilities | rockcraft | merged | Merged as f0b08615, updating nine dependencies to address OSV findings and adding scoped python-apt and cryptography scanner exceptions. | |
| #418 build: bump cryptography for OSV | craft-store | merged | PR #418 (maintainer bepri) bumped the cryptography dependency in2 files (+56/-56) to clear an OSV vulnerability. Approved and merged as commit e8fef67, with the OSV-scanner security check passing. |