← Back to issue list

build: bump deps, fix security scan

View original Github issue

Metadata

Project
debcraft
Number
#182
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #182 (bepri) fixed #181: corrected the security-scan workflow and bumped cryptography 46.0.7→50.0.0, httplib2 0.31.0→0.32.0, setuptools 80.9.0→84.0.0. Approved with 2 reviewers; all CI checks passed.

Resolution: closed resolved

Reason: The PR was merged into main with all CI checks passing, including 'Security scan / OSV-scanner'. It explicitly states 'Fixes #181', and issue #181 (OSV-scanner security-scan check failing on main) is now closed by this change.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [ ] Have you followed the guidelines for contributing? - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `make lint && make test`? --- Fixes some problems with the security scan workflow and bumps some packages with OSVs. ``` ❯ uv lock -P cryptography -P httplib2 -P setuptools Resolved 133 packages in 1.45s Updated cryptography v46.0.7 -> v50.0.0 Updated httplib2 v0.31.0 -> v0.32.0 Updated setuptools v80.9.0 -> v84.0.0 ``` Fixes #181

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #182 (bepri) fixed #181: corrected the security-scan workflow and bumped cryptography 46.0.7→50.0.0, httplib2 0.31.0→0.32.0, setuptools 80.9.0→84.0.0. Approved with 2 reviewers; all CI checks passed.
stealth/space-bunny-alpha — closed resolved Merged PR #182 fixed #181 by correcting the security-scan workflow and updating cryptography, httplib2, and setuptools to address OSV findings. Approval and all CI checks passed.
stealth/space-bunny-alpha — closed resolved Merged PR #182 fixed the failing OSV security scan and bumped cryptography to 50.0.0, httplib2 to 0.32.0, and setuptools to 84.0.0; all CI checks passed.
qwen/qwen3.6-35b-a3b — — Merged following approval and passing CI checks. Bumped cryptography, httplib2, and setuptools to resolve OSV vulnerabilities and corrected the security scan workflow. Closes #181.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 25
Confidence: 95
needs review Updates cryptography, httplib2, and setuptools to latest versions to fix security scan workflow and resolve issue #181. All CI checks pass and the PR has one maintainer approval.
qwen/qwen3.6-35b-a3b
Staleness: 0
Complexity: 15
Confidence: 95
needs review Bumps cryptography, httplib2, and setuptools to latest versions and fixes the security scan workflow. Approved by one reviewer, all CI checks passing, and ready to merge.
qwen/qwen3.6-35b-a3b
Staleness: 0
Complexity: 15
Confidence: 90
needs review Bumps cryptography, httplib2, and setuptools while fixing the security scan workflow. Currently passing CI, awaiting maintainer review with two unresolved comments.

Update history

Date Change
updated
updated
created

Related work

  • Likely Fixed By: canonical/debcraft#181 (confidence 97%)

    The PR body states 'Fixes #181'; issue #181 on the persistently failing OSV-scanner security-scan check is now closed.

Related issues

Issue Project State Summary Similarity
#421 build: bump dependencies for OSVs imagecraft merged Maintainer dependabot-style PR merged as commit 71a1ee0: cryptography 49.0.0 -> 50.0.0 and httplib2 0.31.2 -> 0.32.0 to clear OSV dependency findings. Approved by 2 reviewers; OSV-scanner check passed, though build/snap-builds checks failed.
74%
#1061 build(deps): bump cryptography craft-application merged Merged PR #1061 in commit 4b0e00ae, bumping cryptography to remediate an OSV; two approvals and all reported CI checks passed.
74%
#1055 build(deps): bump cryptography craft-application merged Merged PR #1055 (commit df46c84a) bumped the cryptography dependency to fix an OSV advisory, with 2 approvals and all CI checks passing; a later near-identical bump landed as #1061 (4b0e00ae).
74%
#122 build(deps): bump cryptography from 46.0.6 to 46.0.7 debcraft merged Dependabot PR merged as commit 0498780, bumping cryptography 46.0.6 -> 46.0.7 in debcraft's lockfile to fix CVE-2026-39892 and pick up OpenSSL 3.5.6 wheels. All CI checks passed.
73%
#6307 build(deps): bump cryptography snapcraft merged Merged as commit 1cba705c5: bumped the cryptography dependency to patch a CVE. Approved with lint/fast/minimum-dep tests and security scans passing; spread/publish job failures were unrelated to the bump.
73%
#418 build: bump cryptography for OSV craft-store merged PR #418 (maintainer bepri) bumped the cryptography dependency in2 files (+56/-56) to clear an OSV vulnerability. Approved and merged as commit e8fef67, with the OSV-scanner security check passing.
72%
#1003 build(auto): bump cryptography craft-providers merged Merged PR #1003 bumps the cryptography dependency to remediate an OSV; both reviews approved and all CI, security, test, lint, and policy checks passed.
72%
#1271 build(deps): bump cryptography from 41.0.3 to 41.0.4 charmcraft merged Dependabot PR #1271 bumping cryptography 41.0.3 -> 41.0.4 in requirements.txt was approved and merged as commit 431c7387, updating wheels to OpenSSL 3.1.3 builds.
72%
#6029 build(deps): bump cryptography from 46.0.3 to 46.0.5 snapcraft merged Merged as edb2a7453, updating cryptography from 46.0.3 to 46.0.5 to address CVE-2026-26007 and related security fixes.
71%
#6135 build(deps): bump cryptography from 46.0.5 to 46.0.6 snapcraft merged Merged #6135 as commit 1acb182bf, bumping cryptography 46.0.5 to 46.0.6 to fix CVE-2026-34073.
71%