build(deps): bump libraries for OSVs
Metadata
Current evaluation
Merged after updating cryptography, markdown, and pygments to patch OSV vulnerabilities. Approved by two reviewers and passed all CI checks.
Suggested action: —
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
-----
Bumps multiple libraries to resolve some outstanding OSVs.
```
$ uv lock -P cryptography -P markdown -P pygments
warning: The `tool.uv.dev-dependencies` field (used in `pyproject.toml`) is deprecated and will be removed in a future release; use `dependency-groups.dev` instead
Using CPython 3.12.3 interpreter at: /usr/bin/python3
Resolved 158 packages in 1.63s
Updated cryptography v44.0.2 -> v46.0.6
Updated markdown v3.8 -> v3.10.2
Updated pygments v2.19.1 -> v2.20.0
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged after updating cryptography, markdown, and pygments to patch OSV vulnerabilities. Approved by two reviewers and passed all CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged. Updated cryptography, markdown, and pygments to resolve outstanding OSVs. Dependencies bumped via uv lock and integrated into the codebase. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #131 build(deps): resolve OSVs | debcraft | merged | Merged dependency updates to resolve OSV vulnerabilities. Updated cryptography, pygments, pytest, requests, and craft-parts via uv lock. Approved by two reviewers with all CI checks passing. Changes accepted despite minor pinning discussions. | |
| #1055 build(deps): bump cryptography | craft-application | merged | Merged after bumping the cryptography dependency to resolve an OSV security vulnerability. Approved by two reviewers and passed all CI checks, including security scans and multi-platform tests. | |
| #313 build(deps): resolve osvs | imagecraft | merged | Merged after approval by two reviewers. Bumps pygments and cryptography dependencies to resolve OSVs. Integrated despite failing spread tests on Ubuntu versions. | |
| #418 build: bump cryptography for OSV | craft-store | merged | Merged to bump the cryptography dependency and resolve an OSV vulnerability. Approved by a reviewer, passed CI checks, and modified two files. | |
| #356 build(deps): bump cryptography | craft-store | merged | Merged to bump the cryptography dependency and resolve OSV vulnerability GHSA-p423-j2cm-9vmq. Approved by two reviewers and passed CI checks, with one Windows test failure noted. | |
| #1061 build(deps): bump cryptography | craft-application | merged | Merged a dependency update to bump cryptography, resolving an OSV security vulnerability. Approved by two reviewers and passing all CI checks, the change modified one file with 51 additions and 51 deletions. | |
| #1278 build(deps): update deps to resolve OSV vulnerabilities | rockcraft | merged | Merged dependency updates for cryptography, dulwich, idna, lxml, poetry, pytest, urllib3, and msgpack to resolve OSV vulnerabilities. Added osv-scanner exceptions for python-apt and cryptography. Approved and passed CI. | |
| #81 build(deps): resolve OSVs | craft-artifacts | merged | Merged after two approvals. Updates pygments to 2.20.0 and pytest to 9.0.3 to resolve OSV security vulnerabilities. CI checks passed, and the six-line dependency lock update was successfully integrated. | |
| #177 build(deps): bump pygments | craft-grammar | merged | Merged pull request that bumps the pygments dependency to fix an OSV security warning. Approved by two reviewers and passed all CI checks before integration. | |
| #517 build(deps): bump pygments | starbase | merged | Merged a dependency update to bump pygments, resolving an OSV security warning. Approved by two reviewers, passed all CI checks, and integrated with a minimal three-line change. |