build(deps): resolve OSVs
Metadata
Current evaluation
Merged dependency updates to resolve OSV vulnerabilities. Updated cryptography, pygments, pytest, requests, and craft-parts via uv lock. Approved by two reviewers with all CI checks passing. Changes accepted despite minor pinning discussions.
Suggested action: —
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
---
Note the bump of Craft Parts - I'm not sure why it had that pin or why my command bumped it here. I couldn't figure out a way to only update Craft Parts without manual fiddling of the lockfile, which I'd rather avoid, so I guess it's just gonna be bundled here.
```
❯ uv lock -P cryptography -P pygments -P requests -P pytest
Resolved 152 packages in 1.70s
Updated craft-parts v2.30.1.post8+g8e4daf5d (8e4daf5d) -> v2.33.0
Updated cryptography v46.0.5 -> v46.0.7
Updated pygments v2.19.2 -> v2.20.0
Updated pytest v9.0.1 -> v9.0.3
Updated requests v2.32.5 -> v2.33.1
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged dependency updates to resolve OSV vulnerabilities. Updated cryptography, pygments, pytest, requests, and craft-parts via uv lock. Approved by two reviewers with all CI checks passing. Changes accepted despite minor pinning discussions. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged to resolve OSVs by updating cryptography, pygments, pytest, requests, and craft-parts. The dependency bump was accepted despite minor lockfile mismatches. A related StepInfo issue was resolved in PR #132. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged dependency updates to resolve OSVs, bumping cryptography, pygments, pytest, requests, and craft-parts. Reviewers noted a missing lint target and suggested pinning craft-parts via pyproject.toml. A related StepInfo issue was fixed in PR #132. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #353 build(deps): bump libraries for OSVs | craft-store | merged | Merged after updating cryptography, markdown, and pygments to patch OSV vulnerabilities. Approved by two reviewers and passed all CI checks. | |
| #81 build(deps): resolve OSVs | craft-artifacts | merged | Merged after two approvals. Updates pygments to 2.20.0 and pytest to 9.0.3 to resolve OSV security vulnerabilities. CI checks passed, and the six-line dependency lock update was successfully integrated. | |
| #1278 build(deps): update deps to resolve OSV vulnerabilities | rockcraft | merged | Merged dependency updates for cryptography, dulwich, idna, lxml, poetry, pytest, urllib3, and msgpack to resolve OSV vulnerabilities. Added osv-scanner exceptions for python-apt and cryptography. Approved and passed CI. | |
| #945 build(deps): resolve OSVs | craft-providers | merged | Merged dependency updates resolving OSV vulnerabilities. Bumps cryptography to 46.0.7 and pytest to 9.0.3 to fix minimum dependency test failures. Conflicts resolved automatically before final merge. | |
| #313 build(deps): resolve osvs | imagecraft | merged | Merged after approval by two reviewers. Bumps pygments and cryptography dependencies to resolve OSVs. Integrated despite failing spread tests on Ubuntu versions. | |
| #180 build(deps): resolve OSVs | craft-grammar | merged | Merged following two approvals and successful CI checks. Updated pytest from v9.0.2 to v9.0.3 to resolve OSV security vulnerabilities across one dependency file. | |
| #143 build(deps): resolve OSVs | debcraft | merged | Resolved OSV security vulnerabilities by updating idna to v3.18 and urllib3 to v2.7.0. Approved by a reviewer, passed all CI checks, and merged. | |
| #963 build(deps): update lockfile for OSVs | craft-providers | merged | Merged after two approvals. Updated lockfile via uv lock on cryptography, idna, pytest, and urllib3 to fix OSV CI. Approved and passed checks. | |
| #1055 build(deps): bump cryptography | craft-application | merged | Merged after bumping the cryptography dependency to resolve an OSV security vulnerability. Approved by two reviewers and passed all CI checks, including security scans and multi-platform tests. | |
| #6179 build(deps): update pytest | snapcraft | merged | Merged a pytest dependency update to resolve an OSV vulnerability. Approved by two reviewers and passed CI checks. The change modifies one file with minimal adjustments. |