build(deps): add constraint for Starlette
Metadata
Current evaluation
Merged #164 as commit 10a58dc, constraining indirect Starlette to a version unaffected by the BadHost CVE.
Resolution: closed resolved
Reason: PR #164 was merged with the Starlette security constraint in commit 10a58dc. The change came from canonical/rockcraft#1241, merged as 703bbc20.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
---
Pin the indirect dependency to a version not affected by BadHost CVE.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged #164 as commit 10a58dc, constraining indirect Starlette to a version unaffected by the BadHost CVE. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged via commit 10a58dc 'build(deps): add constraint for Starlette (#164)', pinning the indirect Starlette dependency (pyproject.toml + uv.lock) to a version unaffected by the BadHost CVE. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/rockcraft#1241 (703bbc20), constraining indirect Starlette to a version unaffected by the BadHost CVE. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #2716 in commit 4a54393b, constraining the indirect Starlette dependency to a version unaffected by the BadHost CVE. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged to pin the Starlette indirect dependency to a version unaffected by the BadHost CVE. Approved by two reviewers and passed CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a dependency update pinning Starlette to a version unaffected by the BadHost CVE. The maintainer added the constraint to mitigate security risks and ensure safe indirect dependency resolution. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
canonical/rockcraft#1241
(confidence 98%)
Upstream Starlette constraint merged in commit 703bbc20 and carried into debcraft.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1241 build(deps): add constraint for Starlette | rockcraft | merged | Merged PR #1241 in commit 703bbc20, constraining indirect Starlette to a version not affected by the BadHost CVE. | |
| #228 build(deps): add constraint for Starlette | craft-platforms | merged | Merged PR #228 via commit dcbf23e, constraining indirect Starlette to versions unaffected by the BadHost CVE. | |
| #91 build(deps): add constraint for Starlette | craft-artifacts | merged | Merged in commit 5665dcb, adding a two-file constraint for indirect Starlette to avoid versions affected by the BadHost CVE. | |
| #972 build(deps): add constraint for Starlette | craft-providers | merged | Merged in #972 via commit 7ed9c81, constraining indirect Starlette to >=1.0.1 to avoid versions affected by the BadHost CVE. | |
| #2716 build(deps): add constraint for Starlette | charmcraft | merged | Merged into main via commit 4a54393b, adding a Starlette dependency constraint to avoid versions affected by the BadHost CVE. | |
| #6277 build(deps): add constraint for Starlette | snapcraft | merged | Merged in #6277 (d3e2405d6), adding a Starlette constraint to avoid versions affected by the BadHost CVE. | |
| #190 build(deps): add constraint for Starlette | craft-grammar | merged | Merged PR #190 with two approvals, adding a two-file constraint to exclude indirect Starlette versions affected by the BadHost CVE. | |
| #547 build(deps): add constraint for Starlette | starbase | merged | Merged PR #547 added a constraint for the indirect Starlette dependency, excluding versions affected by the BadHost CVE; the change landed as ca8caba. | |
| #376 build(deps): add constraint for Starlette | craft-store | merged | Merged #376 via ed08e00, adding a Starlette >=1.0.1 constraint to avoid versions affected by the BadHost CVE. | |
| #350 build(deps): bump starlette | imagecraft | merged | Merged PR #350 as commit 920399b, bumping Starlette from v0.52.1 to v1.2.0 to resolve an OSV advisory; all reported CI checks passed. |