build: bump cryptography for OSV
Metadata
Current evaluation
PR #418 (maintainer bepri) bumped the cryptography dependency in2 files (+56/-56) to clear an OSV vulnerability. Approved and merged as commit e8fef67, with the OSV-scanner security check passing.
Resolution: closed resolved
Reason: The pull request itself was the fix: it was approved by a reviewer and merged into main as commit e8fef67, updating the cryptography pin to a version without the reported OSV. The 'Security scan / OSV-scanner' check passed on the PR, confirming the advisory was remediated.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Resolves an OSV.
---
- [ ] I've followed the [contribution guidelines](https://github.com/canonical/craft-store/blob/main/CONTRIBUTING.md).
- [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
- [ ] I've updated the relevant release notes.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | PR #418 (maintainer bepri) bumped the cryptography dependency in2 files (+56/-56) to clear an OSV vulnerability. Approved and merged as commit e8fef67, with the OSV-scanner security check passing. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged canonical/craft-store#418 as commit e8fef67, updating cryptography in two files to address an OSV vulnerability. The PR was approved and passed the OSV security scan. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged to bump the cryptography dependency and resolve an OSV vulnerability. Approved by a reviewer, passed CI checks, and modified two files. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
0
Complexity:
10
Confidence:
90
|
needs review | Bumps the cryptography dependency to resolve an OSV security advisory. The PR is newly opened, CI checks are passing or pending, and requires maintainer review. |
Update history
| Date | Change |
|---|---|
| updated | |
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1061 build(deps): bump cryptography | craft-application | merged | Merged PR #1061 in commit 4b0e00ae, bumping cryptography to remediate an OSV; two approvals and all reported CI checks passed. | |
| #1151 build(auto): bump cryptography | craft-application | merged | Merged PR #1151 as commit 4ff7e624, updating the cryptography dependency to resolve an OSV security vulnerability. | |
| #1055 build(deps): bump cryptography | craft-application | merged | Merged PR #1055 (commit df46c84a) bumped the cryptography dependency to fix an OSV advisory, with 2 approvals and all CI checks passing; a later near-identical bump landed as #1061 (4b0e00ae). | |
| #1003 build(auto): bump cryptography | craft-providers | merged | Merged PR #1003 bumps the cryptography dependency to remediate an OSV; both reviews approved and all CI, security, test, lint, and policy checks passed. | |
| #356 build(deps): bump cryptography | craft-store | merged | Merged PR #356 as commit fcbad5c, bumping cryptography to remediate OSV GHSA-p423-j2cm-9vmq. | |
| #421 build: bump dependencies for OSVs | imagecraft | merged | Maintainer dependabot-style PR merged as commit 71a1ee0: cryptography 49.0.0 -> 50.0.0 and httplib2 0.31.2 -> 0.32.0 to clear OSV dependency findings. Approved by 2 reviewers; OSV-scanner check passed, though build/snap-builds checks failed. | |
| #318 build: bump cryptography to 46.0.7 | imagecraft | merged | Merged PR #318 (commit 8a390e6) by smethnani bumped cryptography to 46.0.7 in uv.lock to clear an OSV vulnerability; later superseded by #357 (49.0.0) and #421 (50.0.2). | |
| #6307 build(deps): bump cryptography | snapcraft | merged | Merged as commit 1cba705c5: bumped the cryptography dependency to patch a CVE. Approved with lint/fast/minimum-dep tests and security scans passing; spread/publish job failures were unrelated to the bump. | |
| #1098 build(deps): bump cryptography | craft-application | merged | Merged in #1098 via commit 239b3af7, updating cryptography 48.0.0 to 49.0.0 to resolve OSV GHSA-537c-gmf6-5ccf. | |
| #357 build(deps): bump cryptography and starlette | imagecraft | merged | Merged PR #357 (commit a868324) bumping cryptography v46.0.7 to v49.0.0 and adding a starlette>=1.3.1 constraint to clear OSV findings; approved with 1 reviewer and most CI checks passing. |