← Back to issue list

build(autogen): bump libraries to fix OSVs

View original Github issue

Metadata

Project
craft-store
Number
#342
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Autogenerated lockfile PR by maintainer bepri merged as commit 7a0dbd3, bumping cffi 1.17.1->2.0.0, filelock, jaraco-context, protobuf 6.33.5, pynacl 1.6.2, urllib3 2.6.3 and wheel 0.46.3 to clear OSV scanner/Trivy findings.

Resolution: closed resolved

Reason: PR #342 was approved by 2 reviewers with all CI checks green (Fast/Slow tests, OSV-scanner, Trivy, lint, docs) and merged into main as commit 7a0dbd3, which appears in uv.lock history. The bumped versions (urllib3 2.6.3, protobuf 6.33.5, pynacl 1.6.2) removed the reported vulnerabilities.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [ ] Have you followed the guidelines for contributing? - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `make lint && make test`? ----- Fixes several OSVs. ``` ❯ uv lock -P filelock -P jaraco-context -P protobuf -P pynacl -P urllib3 -P wheel warning: The `tool.uv.dev-dependencies` field (used in `pyproject.toml`) is deprecated and will be removed in a future release; use `dependency-groups.dev` instead warning: Ignoring existing virtual environment linked to non-existent Python interpreter: .venv/bin/python3 -> python Using CPython 3.14.2 Resolved 158 packages in 1.20s Updated cffi v1.17.1 -> v2.0.0 Updated filelock v3.18.0 -> v3.20.3 Updated jaraco-context v6.0.1 -> v6.1.0 Updated protobuf v6.31.1 -> v6.33.5 Updated pynacl v1.5.0 -> v1.6.2 Updated urllib3 v2.6.1 -> v2.6.3 Updated wheel v0.45.1 -> v0.46.3 ```

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Autogenerated lockfile PR by maintainer bepri merged as commit 7a0dbd3, bumping cffi 1.17.1->2.0.0, filelock, jaraco-context, protobuf 6.33.5, pynacl 1.6.2, urllib3 2.6.3 and wheel 0.46.3 to clear OSV scanner/Trivy findings.
stealth/space-bunny-alpha — closed resolved Merged an autogen lockfile update raising seven dependencies, including urllib3 2.6.3 and protobuf 6.33.5, to remediate OSV findings.
qwen/qwen3.6-35b-a3b — — Merged dependency updates for cffi, filelock, jaraco-context, protobuf, pynacl, urllib3, and wheel to resolve OSV security vulnerabilities. Approved by two reviewers and passed all CI checks.

Update history

No update history recorded yet.

Related work

  • Related To: craft-store#353 (confidence 78%)

    Follow-up autogenerated 'bump libraries for OSV' bump (commit 98818d8) covering remaining OSV findings

  • Related To: craft-store#383 (confidence 72%)

    Later 'upgrade vulnerable dependencies to fix OSV scanner' (commit 0e63168), same recurring dependency-remediation series

  • Related To: craft-store#418 (confidence 62%)

    Later commit e8fef67 bumping cryptography for OSV, same maintenance pattern

Related issues

Issue Project State Summary Similarity
#247 build(autogen): bump dependencies to resolve OSVs imagecraft merged Merged #247 via commit 603fbc3, updating filelock 3.20.2, fonttools 4.61.1, and urllib3 2.6.2 to resolve OSV warnings; all CI checks passed.
81%
#457 build(autogen): bump dependencies craft-cli merged Merged as commit e5a1243 (build(autogen): bump dependencies (#457)) by maintainer bepri, bumping build/doc dependencies to resolve a batch of OSVs; all CI, lint, security scan and policy checks passed.
76%
#353 build(deps): bump libraries for OSVs craft-store merged Merged dependabot-style PR bumping cryptography 44.0.2→46.0.6, Markdown 3.8→3.10.2 and Pygments 2.19.1→2.20.0 in uv.lock to clear outstanding OSVs (commit 98818d8).
72%