build(deps): resolve OSVs
Metadata
Current evaluation
Merged as commit 509e420: routine 'build(deps): resolve OSVs' uv.lock update (cryptography 46.0.7, pygments 2.20.0, pytest 9.0.3, requests 2.33.1) that incidentally bumped craft-parts, causing a StepInfo regression.
Resolution: closed resolved
Reason: PR #131 was approved by 2 reviewers with all CI checks green and merged as commit 509e420, updating the requested dependencies in uv.lock. The side-effect craft-parts bump regressed organize-from-build, which maintainer cmatsuoka said is fixed by follow-up PR #132 (commit 252ee71) pinning craft-parts.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
---
Note the bump of Craft Parts - I'm not sure why it had that pin or why my command bumped it here. I couldn't figure out a way to only update Craft Parts without manual fiddling of the lockfile, which I'd rather avoid, so I guess it's just gonna be bundled here.
```
❯ uv lock -P cryptography -P pygments -P requests -P pytest
Resolved 152 packages in 1.70s
Updated craft-parts v2.30.1.post8+g8e4daf5d (8e4daf5d) -> v2.33.0
Updated cryptography v46.0.5 -> v46.0.7
Updated pygments v2.19.2 -> v2.20.0
Updated pytest v9.0.1 -> v9.0.3
Updated requests v2.32.5 -> v2.33.1
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 509e420: routine 'build(deps): resolve OSVs' uv.lock update (cryptography 46.0.7, pygments 2.20.0, pytest 9.0.3, requests 2.33.1) that incidentally bumped craft-parts, causing a StepInfo regression. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #131 as 509e420, updating cryptography, Pygments, pytest, requests and craft-parts to resolve OSVs; follow-up #132 pinned craft-parts after a StepInfo regression. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 509e420 in PR #131, updating uv.lock to resolve OSVs: cryptography 46.0.5→46.0.7, pygments 2.19.2→2.20.0, requests 2.32.5→2.33.1, and pytest 9.0.1→9.0.3, plus Craft Parts 2.33.0. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #131 to update cryptography, Pygments, pytest and requests for OSV fixes. Its bundled craft-parts 2.33.0 bump exposed a StepInfo regression, addressed separately by #132. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged dependency updates to resolve OSV vulnerabilities. Updated cryptography, pygments, pytest, requests, and craft-parts via uv lock. Approved by two reviewers with all CI checks passing. Changes accepted despite minor pinning discussions. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged to resolve OSVs by updating cryptography, pygments, pytest, requests, and craft-parts. The dependency bump was accepted despite minor lockfile mismatches. A related StepInfo issue was resolved in PR #132. |
Update history
No update history recorded yet.
Related work
-
Caused By:
debcraft#132
(confidence 92%)
The bundled craft-parts bump in this PR caused the StepInfo regression; maintainer cmatsuoka noted it should be fixed by #132, which pins craft-parts to preserve organize-from-build.
-
Related To:
debcraft#143
(confidence 55%)
Later 'build(deps): resolve OSVs' commit 3e9db88 (#143) continued the same periodic lockfile OSV resolution work.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #180 build(deps): resolve OSVs | craft-grammar | merged | Merged #180 in commit 983ae56, updating uv.lock to pytest 9.0.3 from 9.0.2 to resolve OSV findings; all CI checks passed. | |
| #81 build(deps): resolve OSVs | craft-artifacts | merged | Merged as commit 32dec6c in craft-artifacts, bumping Pygments 2.19.2→2.20.0 and pytest 9.0.2→9.0.3 in uv.lock to clear OSV-scanner advisories. Approved by 2 reviewers despite a failing typecheck-with-ty job. | |
| #313 build(deps): resolve osvs | imagecraft | merged | Merged in commit 10f3370, updating Pygments and cryptography to resolve OSV findings. | |
| #945 build(deps): resolve OSVs | craft-providers | merged | Merged Dependabot-style OSV remediation PR into main as commit ee7d5be, re-locking pytest and cryptography; final conflict resolution kept main's cryptography 48.0.0. | |
| #353 build(deps): bump libraries for OSVs | craft-store | merged | Merged dependabot-style PR bumping cryptography 44.0.2→46.0.6, Markdown 3.8→3.10.2 and Pygments 2.19.1→2.20.0 in uv.lock to clear outstanding OSVs (commit 98818d8). | |
| #143 build(deps): resolve OSVs | debcraft | merged | Merged in canonical/debcraft#143 as commit 3e9db88, updating idna 3.10→3.18 and urllib3 2.6.3→2.7.0 to resolve OSV findings. All CI checks passed. | |
| #1550 build(deps): bump pytest | craft-parts | merged | Merged craft-parts#1550 in commit e5a6febb, updating pytest to resolve an OSV finding; all lint, test, and security checks passed. | |
| #940 build(deps): update cryptography, pygments, requests | craft-providers | merged | Merged PR #940 as commit eb8549f, updating cryptography, Pygments, and requests to resolve three OSV warnings. | |
| #963 build(deps): update lockfile for OSVs | craft-providers | merged | Merged PR canonical/craft-providers#963 by lengau refreshed uv.lock (uv lock -P cryptography -P idna -P pytest -P urllib3) to clear OSV-scanner CI alerts. Related Plucky test fixes landed in #962. | |
| #1278 build(deps): update deps to resolve OSV vulnerabilities | rockcraft | merged | Merged as f0b08615, updating nine dependencies to address OSV findings and adding scoped python-apt and cryptography scanner exceptions. |