build(deps): update lockfile for OSVs
Metadata
Current evaluation
Merged PR canonical/craft-providers#963 by lengau refreshed uv.lock (uv lock -P cryptography -P idna -P pytest -P urllib3) to clear OSV-scanner CI alerts. Related Plucky test fixes landed in #962.
Resolution: closed resolved
Reason: The dependabot-style lockfile bump was merged (approved by 2 reviewers) and the OSV-scanner check passes on the PR, clearing the reported OSV CI failures; the accompanying Plucky LXD test fixes were merged separately in #962.
Evaluated by: mr-cal-bot
No scores available.
Issue body
`uv lock -P cryptography -P idna -P pytest -P urllib3`
Fixes OSV CI.
Plucky tests are fixed in #962
- [x] Have you followed the guidelines for contributing?
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [x] Have you successfully run `make lint && make test`?
---
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR canonical/craft-providers#963 by lengau refreshed uv.lock (uv lock -P cryptography -P idna -P pytest -P urllib3) to clear OSV-scanner CI alerts. Related Plucky test fixes landed in #962. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR canonical/craft-providers#963 refreshed uv.lock via `uv lock -P cryptography -P idna -P pytest -P urllib3` (60-line lockfile-only diff) to clear OSV-scanner CI failures; OSV checks passed after merge. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged canonical/craft-providers#963, refreshing uv.lock for cryptography, idna, pytest and urllib3 to fix OSV CI. Plucky test failures were addressed separately in #962. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR canonical/craft-providers#963 by lengau re-ran `uv lock -P cryptography -P idna -P pytest -P urllib3`, bumping those deps in uv.lock (+60/-60) to clear the failing OSV-scanner CI check; approved by 2 reviewers. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged after two approvals. Updated lockfile via uv lock on cryptography, idna, pytest, and urllib3 to fix OSV CI. Approved and passed checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged lockfile updates for cryptography, idna, pytest, and urllib3 via uv lock. Resolves OSV CI failures. Plucky test fixes are handled in PR #962. |
Update history
No update history recorded yet.
Related work
-
Related To:
craft-providers#962
(confidence 85%)
Referenced in the PR body as the fix for Plucky LXD test failures, shipped alongside this lockfile update
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #262 build(deps): update filelock for OSV | imagecraft | merged | Merged PR #262 bumped the filelock dependency for an OSV advisory; landed on main as commit 96ff5ed ("build(deps): update filelock for OSV (#262)"), with all CI checks green. | |
| #774 build(deps): lock file maintenance for OSV bugs | craft-providers | merged | Merged PR #774 (commit 3a4e72e) updating uv.lock to resolve OSV advisories GHSA-9hjg-9r4m-mvj7, GHSA-48p4-8xcf-vxj5q and GHSA-pq67-6m6q-mj2v; +6/-6 lines in uv.lock only. | |
| #180 build(deps): resolve OSVs | craft-grammar | merged | Merged #180 in commit 983ae56, updating uv.lock to pytest 9.0.3 from 9.0.2 to resolve OSV findings; all CI checks passed. | |
| #131 build(deps): resolve OSVs | debcraft | merged | Merged as commit 509e420: routine 'build(deps): resolve OSVs' uv.lock update (cryptography 46.0.7, pygments 2.20.0, pytest 9.0.3, requests 2.33.1) that incidentally bumped craft-parts, causing a StepInfo regression. | |
| #228 build(deps): lock file maintenance (main) | craft-archives | merged | Renovate lock file maintenance PR merged into main as commit 1b6bf12, refreshing uv.lock (+1144/-1118). Merged despite two red "Security scan / OSV-scanner" checks; lint, test and CLA jobs all passed. | |
| #231 build(deps): lock file maintenance (main) | craft-archives | merged | Renovate lock file maintenance merged into main as commit ddae56d, refreshing uv.lock (+1144/-1118). Lint, fast/slow tests, minimum-deps and CLA checks passed; only the flaky OSV-scanner check was red. | |
| #353 build(deps): bump libraries for OSVs | craft-store | merged | Merged dependabot-style PR bumping cryptography 44.0.2→46.0.6, Markdown 3.8→3.10.2 and Pygments 2.19.1→2.20.0 in uv.lock to clear outstanding OSVs (commit 98818d8). | |
| #227 build(deps): lock file maintenance (main) | craft-archives | merged | Renovate lock file maintenance PR merged into main as commit 14e2bba, refreshing all locks (uv.lock, +1144/-1118) after two reviewer approvals despite a failing OSV-scanner job. | |
| #81 build(deps): resolve OSVs | craft-artifacts | merged | Merged as commit 32dec6c in craft-artifacts, bumping Pygments 2.19.2→2.20.0 and pytest 9.0.2→9.0.3 in uv.lock to clear OSV-scanner advisories. Approved by 2 reviewers despite a failing typecheck-with-ty job. | |
| #27 build(deps): lock file maintenance | debcraft | merged | Renovate lock file maintenance PR merged into main via commit cee23b9, refreshing uv.lock (+1089/-708) to latest dependency versions after 2 approvals and a fully green CI run. |