← Back to issue list

build(deps): bump libraries for OSVs

View original Github issue

Metadata

Project
craft-store
Number
#353
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Merged dependabot-style PR bumping cryptography 44.0.2→46.0.6, Markdown 3.8→3.10.2 and Pygments 2.19.1→2.20.0 in uv.lock to clear outstanding OSVs (commit 98818d8).

Resolution: closed resolved

Reason: The PR was merged into main as commit 98818d8 ("build(deps): bump libraries for OSV (#353)"), updating uv.lock via `uv lock -P cryptography -P markdown -P pygments`; OSV-scanner and Trivy CI checks passed.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [ ] Have you followed the guidelines for contributing? - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `make lint && make test`? ----- Bumps multiple libraries to resolve some outstanding OSVs. ``` $ uv lock -P cryptography -P markdown -P pygments warning: The `tool.uv.dev-dependencies` field (used in `pyproject.toml`) is deprecated and will be removed in a future release; use `dependency-groups.dev` instead Using CPython 3.12.3 interpreter at: /usr/bin/python3 Resolved 158 packages in 1.63s Updated cryptography v44.0.2 -> v46.0.6 Updated markdown v3.8 -> v3.10.2 Updated pygments v2.19.1 -> v2.20.0 ```

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged dependabot-style PR bumping cryptography 44.0.2→46.0.6, Markdown 3.8→3.10.2 and Pygments 2.19.1→2.20.0 in uv.lock to clear outstanding OSVs (commit 98818d8).
stealth/space-bunny-alpha — closed resolved Merged canonical/craft-store#353, bumping cryptography 44.0.2→46.0.6, Markdown 3.8→3.10.2 and Pygments 2.19.1→2.20.0 to resolve outstanding OSVs.
qwen/qwen3.6-35b-a3b — — Merged after updating cryptography, markdown, and pygments to patch OSV vulnerabilities. Approved by two reviewers and passed all CI checks.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/craft-store#356 (confidence 70%)

    Follow-up 'build(deps): bump cryptography' (commit fcbad5c) further raised the cryptography pin shortly after #353.

  • Related To: canonical/craft-store#418 (confidence 65%)

    Later 'build: bump cryptography for OSV' (commit e8fef67) addressed a new cryptography advisory, showing #353's bump was later superseded.

Related issues

Issue Project State Summary Similarity
#131 build(deps): resolve OSVs debcraft merged Merged as commit 509e420: routine 'build(deps): resolve OSVs' uv.lock update (cryptography 46.0.7, pygments 2.20.0, pytest 9.0.3, requests 2.33.1) that incidentally bumped craft-parts, causing a StepInfo regression.
80%
#86 build(deps): bump cryptography from 46.0.1 to 46.0.5 debcraft merged Dependabot bumped cryptography 46.0.1→46.0.5 in uv.lock; merged as commit 8d82006 (CVE-2026-26007 fix). Later superseded by #111 (46.0.6) and #122 (46.0.7).
78%
#81 build(deps): resolve OSVs craft-artifacts merged Merged as commit 32dec6c in craft-artifacts, bumping Pygments 2.19.2→2.20.0 and pytest 9.0.2→9.0.3 in uv.lock to clear OSV-scanner advisories. Approved by 2 reviewers despite a failing typecheck-with-ty job.
78%
#111 build(deps): bump cryptography from 46.0.5 to 46.0.6 debcraft merged Dependabot bump of cryptography 46.0.5 -> 46.0.6 (security fix for CVE-2026-34073) merged into debcraft, updating uv.lock. Follow-up bump to 46.0.7 later landed via #122.
78%
#1055 build(deps): bump cryptography craft-application merged Merged PR #1055 (commit df46c84a) bumped the cryptography dependency to fix an OSV advisory, with 2 approvals and all CI checks passing; a later near-identical bump landed as #1061 (4b0e00ae).
78%
#313 build(deps): resolve osvs imagecraft merged Merged in commit 10f3370, updating Pygments and cryptography to resolve OSV findings.
78%
#940 build(deps): update cryptography, pygments, requests craft-providers merged Merged PR #940 as commit eb8549f, updating cryptography, Pygments, and requests to resolve three OSV warnings.
78%
#1061 build(deps): bump cryptography craft-application merged Merged PR #1061 in commit 4b0e00ae, bumping cryptography to remediate an OSV; two approvals and all reported CI checks passed.
77%
#421 build: bump dependencies for OSVs imagecraft merged Maintainer dependabot-style PR merged as commit 71a1ee0: cryptography 49.0.0 -> 50.0.0 and httplib2 0.31.2 -> 0.32.0 to clear OSV dependency findings. Approved by 2 reviewers; OSV-scanner check passed, though build/snap-builds checks failed.
77%
#945 build(deps): resolve OSVs craft-providers merged Merged Dependabot-style OSV remediation PR into main as commit ee7d5be, re-locking pytest and cryptography; final conflict resolution kept main's cryptography 48.0.0.
77%