build(autogen): bump libraries to fix OSVs
Metadata
Current evaluation
Merged dependency updates for cffi, filelock, jaraco-context, protobuf, pynacl, urllib3, and wheel to resolve OSV security vulnerabilities. Approved by two reviewers and passed all CI checks.
Suggested action: —
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
-----
Fixes several OSVs.
```
❯ uv lock -P filelock -P jaraco-context -P protobuf -P pynacl -P urllib3 -P wheel
warning: The `tool.uv.dev-dependencies` field (used in `pyproject.toml`) is deprecated and will be removed in a future release; use `dependency-groups.dev` instead
warning: Ignoring existing virtual environment linked to non-existent Python interpreter: .venv/bin/python3 -> python
Using CPython 3.14.2
Resolved 158 packages in 1.20s
Updated cffi v1.17.1 -> v2.0.0
Updated filelock v3.18.0 -> v3.20.3
Updated jaraco-context v6.0.1 -> v6.1.0
Updated protobuf v6.31.1 -> v6.33.5
Updated pynacl v1.5.0 -> v1.6.2
Updated urllib3 v2.6.1 -> v2.6.3
Updated wheel v0.45.1 -> v0.46.3
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged dependency updates for cffi, filelock, jaraco-context, protobuf, pynacl, urllib3, and wheel to resolve OSV security vulnerabilities. Approved by two reviewers and passed all CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged maintainer bepri's dependency update to cffi, filelock, jaraco-context, protobuf, pynacl, urllib3, and wheel, resolving multiple open source vulnerabilities. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #457 build(autogen): bump dependencies | craft-cli | merged | Merged after reviewer approval and passing all CI checks. Bumped dependencies across two files to resolve multiple OSV security vulnerabilities. All tests, linting, and security scans passed successfully. | |
| #247 build(autogen): bump dependencies to resolve OSVs | imagecraft | merged | Merged after passing CI and receiving two approvals. Updated filelock, fonttools, and urllib3 to resolve OSV security warnings. An unrelated Spread test failure was noted but did not block the merge. | |
| #353 build(deps): bump libraries for OSVs | craft-store | merged | Merged after updating cryptography, markdown, and pygments to patch OSV vulnerabilities. Approved by two reviewers and passed all CI checks. | |
| #5871 build(autogen): bump pip for OSV | snapcraft | merged | Merged after three approvals. Bumps pip to 25.3 to resolve OSV vulnerability GHSA-4xh5-x5gv-qwph. All required CI checks passed prior to merge. | |
| #131 build(deps): resolve OSVs | debcraft | merged | Merged dependency updates to resolve OSV vulnerabilities. Updated cryptography, pygments, pytest, requests, and craft-parts via uv lock. Approved by two reviewers with all CI checks passing. Changes accepted despite minor pinning discussions. | |
| #230 build(autogen): bump starlette for OSV | imagecraft | merged | Merged to bump the Starlette dependency, resolving an OSV security warning. Approved by two reviewers, passed all CI checks, and updated the lock file with a minimal version change. | |
| #1003 build(auto): bump cryptography | craft-providers | merged | Merged to bump the cryptography dependency and resolve an OSV security vulnerability. Approved by two reviewers with all CI checks passing. | |
| #1055 build(deps): bump cryptography | craft-application | merged | Merged after bumping the cryptography dependency to resolve an OSV security vulnerability. Approved by two reviewers and passed all CI checks, including security scans and multi-platform tests. | |
| #143 build(deps): resolve OSVs | debcraft | merged | Resolved OSV security vulnerabilities by updating idna to v3.18 and urllib3 to v2.7.0. Approved by a reviewer, passed all CI checks, and merged. | |
| #963 build(deps): update lockfile for OSVs | craft-providers | merged | Merged after two approvals. Updated lockfile via uv lock on cryptography, idna, pytest, and urllib3 to fix OSV CI. Approved and passed checks. |