build(deps): update dependency certifi to v2026.10.23
Metadata
Current evaluation
Merged PR #454 updates certifi to v2026.10.23 in uv.lock to resolve a critical OSV security scan failure.
Resolution: closed resolved
Reason: The PR was merged, updating certifi to v2026.10.23 in uv.lock to address the critical PYSEC-2026-4320 security advisory and clear the failing OSV-scanner check.
Evaluated by: mr-cal-bot
No scores available.
Issue body
`main` is currently failing **Security scan / OSV-scanner** on a critical advisory for `certifi` 2026.7.22 ([PYSEC-2026-4320](https://osv.dev/PYSEC-2026-4320) / [GHSA-6q48-6c7w-9gw2](https://osv.dev/GHSA-6q48-6c7w-9gw2), fixed in 2026.10.19), so every open PR inherits the red check.
This bumps `certifi` to 2026.10.23 in `uv.lock` with `uv lock --upgrade-package certifi`. No other packages change, and `uv lock --check` passes.
---
- [x] I've followed the [contribution guidelines](https://github.com/canonical/craft-store/blob/main/CONTRIBUTING.md).
- [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
Only the lockfile changes; `uv lock --check` passes locally. Relying on CI for the rest.
- [ ] I've added or updated any relevant documentation.
- [ ] I've updated the relevant release notes.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | closed resolved | Merged PR #454 updates certifi to v2026.10.23 in uv.lock to resolve a critical OSV security scan failure. |
Update history
| Date | Change |
|---|---|
| merged | |
| updated | |
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #6512 build(deps): bump certifi to 2026.10.19 | snapcraft | merged | Bump certifi dependency to 2026.10.19 to resolve an OSV vulnerability. Merged into main. | |
| #1791 build(deps): bump dependencies for OSV warnings | craft-parts | merged | Merged PR #1791 bumping certifi and urllib3 to resolve OSV security warnings. | |
| #1936 build(deps): update dependency certifi to v2024.8.30 (main) | charmcraft | merged | Merged #1936 via commit 2f076407, updating certifi from 2024.7.4 to 2024.8.30 across two dependency files. | |
| #1182 build(deps): bump certifi from 2023.5.7 to 2023.7.22 | charmcraft | merged | Merged PR #1182 in commit 8350a166, upgrading certifi from 2023.5.7 to 2023.7.22. | |
| #4896 build(deps): bump certifi from 2023.11.17 to 2024.7.4 | snapcraft | merged | Merged PR #4896, updating certifi from 2023.11.17 to 2024.7.4 in commit a4e2895da. | |
| #6522 build(deps): bump certifi and setuptools for CVEs | snapcraft | merged | Merged PR #6522 cherry-picks dependency bumps for certifi and setuptools from main to address CVEs, updating certifi to 2026.10.19 and setuptools to 84.1.0. | |
| #180 build(deps): resolve OSVs | craft-grammar | merged | Merged #180 in commit 983ae56, updating uv.lock to pytest 9.0.3 from 9.0.2 to resolve OSV findings; all CI checks passed. | |
| #963 build(deps): update lockfile for OSVs | craft-providers | merged | Merged PR canonical/craft-providers#963 by lengau refreshed uv.lock (uv lock -P cryptography -P idna -P pytest -P urllib3) to clear OSV-scanner CI alerts. Related Plucky test fixes landed in #962. | |
| #4000 build(deps): bump certifi from 2022.9.24 to 2022.12.7 | snapcraft | closed | Closed unmerged as obsolete after certifi 2023.5.7 was adopted in #4129 (fc9f9ae44), superseding the proposed 2022.12.7 update. | |
| #774 build(deps): lock file maintenance for OSV bugs | craft-providers | merged | Merged PR #774 (commit 3a4e72e) updating uv.lock to resolve OSV advisories GHSA-9hjg-9r4m-mvj7, GHSA-48p4-8xcf-vxj5q and GHSA-pq67-6m6q-mj2v; +6/-6 lines in uv.lock only. |