CI: OSV-scanner security-scan check persistently failing on main
Metadata
Current evaluation
Fixed by bumping vulnerable transitive dependencies to patch reported CVEs, resolving the persistent OSV-scanner CI failure on main.
Suggested action: —
No scores available.
Issue body
## Summary
The `Security scan / OSV-scanner` check has been failing persistently on `main` for weeks (confirmed on multiple recent runs, e.g. the [2026-08-09 run](https://github.com/canonical/debcraft/actions/runs/31331479811/job/93290370531)), due to known CVEs in pinned transitive dependencies rather than anything introduced by a specific PR.
## Details
Latest failure on `main` reports:
| Package | Installed | Fixed | Advisory |
|---|---|---|---|
| cryptography | 46.0.7 | 50.0.0 | PYSEC-2026-3552 |
| cryptography | 46.0.7 | 49.0.0 | PYSEC-2026-3553 |
| cryptography | 46.0.7 | 49.0.0 | PYSEC-2026-3554 |
| cryptography | 46.0.7 | 48.0.1 | GHSA-537c-gmf6-5ccf |
| httplib2 | 0.31.0 | 0.32.0 | PYSEC-2026-3444 |
| setuptools | 80.9.0 | 83.0.0 | PYSEC-2026-3447 |
| gitpython (docs/requirements.txt) | 3.1.9 | 3.1.35+ | multiple (PYSEC-2022-42992 and others) |
## Impact
This blocks routine Starbase-merge PRs (e.g. #177) from going green, since the failure is pre-existing on `main` and unrelated to the merge content itself. Bumping `cryptography`, `httplib2`, `setuptools`, and `gitpython` (or adding scanner ignores if any are false positives/unfixable) should resolve it.
---
🤖 [BEEP BOOP, A BOT WROTE THIS COMMENT - Claude Sonnet 5, Copilot CLI]
Filed while investigating why the Starbase-merge PR #177 couldn't go green — the OSV-scanner failure reproduces identically on `main` and is unrelated to that merge.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Fixed by bumping vulnerable transitive dependencies to patch reported CVEs, resolving the persistent OSV-scanner CI failure on main. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
90
Support Request:
5
|
needs triage | CI security scan on main persistently fails due to known CVEs in transitive dependencies, blocking merge PRs. Awaiting triage to bump versions or configure scanner ignores. |
Update history
| Date | Change |
|---|---|
| closed | |
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #6347 ci(scan): fix osv scanner on docs | snapcraft | merged | Merged after approval. The change updates the CI pipeline to fix the OSV security scanner for documentation builds, resolving the scanning configuration issue. | |
| #5822 ci: ignore unresolvable OSV | snapcraft | merged | Merged a PR to ignore an unresolvable OSV scan failure in CI. The vulnerability cannot be resolved until pip 25.3 releases on October 30th. Approved by two reviewers and passed all CI checks. | |
| #1000 build: update dependencies to resolve OSVs | craft-providers | closed | Merged and closed to resolve OSVs by updating dependencies and security scan calling conventions. Passed CI checks with no comments or reviewer feedback. | |
| #2821 ci: fix osv workflow errors | charmcraft | merged | Merged fix for CI OSV workflow errors by updating the cryptography dependency. Approved by two reviewers and passed all required checks, successfully restoring the security scanning pipeline. | |
| #1130 ci: fix OSV-scanner workflow path and exclude docs-only inputs | craft-application | merged | Merged. Corrected the OSV-scanner workflow config path to align with Starbase and excluded docs from scanning. Updated the uv lockfile for httplib2 and setuptools to resolve scanner failures. All CI checks passed. | |
| #5487 ci: remove config for osv scanner | snapcraft | merged | Merged after approval by two reviewers. Removed expired OSV scanner configuration from CI. Updated one file with a four-line reduction. All required CI checks passed prior to merge. | |
| #988 ci: fix OSV scanner policy workflow | craft-providers | merged | Merged fix for OSV scanner policy workflow failures. Updated scan-python inputs, passed configuration via osv-extra-args, excluded docs from UV export, and added osv-scanner.toml. All CI checks passed. | |
| #247 ci: ignore unfixable OSVs | craft-platforms | merged | Merged a pull request adding a single configuration line to CI to ignore unfixable OSV scanner findings. The change passed all CI checks, received one approval, and was successfully integrated into the main branch. | |
| #1278 build(deps): update deps to resolve OSV vulnerabilities | rockcraft | merged | Merged dependency updates for cryptography, dulwich, idna, lxml, poetry, pytest, urllib3, and msgpack to resolve OSV vulnerabilities. Added osv-scanner exceptions for python-apt and cryptography. Approved and passed CI. |