build: bump deps, fix security scan
Metadata
Current evaluation
Merged following approval and passing CI checks. Bumped cryptography, httplib2, and setuptools to resolve OSV vulnerabilities and corrected the security scan workflow. Closes #181.
Suggested action: —
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
---
Fixes some problems with the security scan workflow and bumps some packages with OSVs.
```
❯ uv lock -P cryptography -P httplib2 -P setuptools
Resolved 133 packages in 1.45s
Updated cryptography v46.0.7 -> v50.0.0
Updated httplib2 v0.31.0 -> v0.32.0
Updated setuptools v80.9.0 -> v84.0.0
```
Fixes #181
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged following approval and passing CI checks. Bumped cryptography, httplib2, and setuptools to resolve OSV vulnerabilities and corrected the security scan workflow. Closes #181. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
25
Confidence:
95
|
needs review | Updates cryptography, httplib2, and setuptools to latest versions to fix security scan workflow and resolve issue #181. All CI checks pass and the PR has one maintainer approval. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
0
Complexity:
15
Confidence:
95
|
needs review | Bumps cryptography, httplib2, and setuptools to latest versions and fixes the security scan workflow. Approved by one reviewer, all CI checks passing, and ready to merge. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
0
Complexity:
15
Confidence:
90
|
needs review | Bumps cryptography, httplib2, and setuptools while fixing the security scan workflow. Currently passing CI, awaiting maintainer review with two unresolved comments. |
Update history
| Date | Change |
|---|---|
| updated | |
| updated | |
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1055 build(deps): bump cryptography | craft-application | merged | Merged after bumping the cryptography dependency to resolve an OSV security vulnerability. Approved by two reviewers and passed all CI checks, including security scans and multi-platform tests. | |
| #1278 build(deps): update deps to resolve OSV vulnerabilities | rockcraft | merged | Merged dependency updates for cryptography, dulwich, idna, lxml, poetry, pytest, urllib3, and msgpack to resolve OSV vulnerabilities. Added osv-scanner exceptions for python-apt and cryptography. Approved and passed CI. | |
| #418 build: bump cryptography for OSV | craft-store | merged | Merged to bump the cryptography dependency and resolve an OSV vulnerability. Approved by a reviewer, passed CI checks, and modified two files. | |
| #6307 build(deps): bump cryptography | snapcraft | merged | Merged after approval. Bumps the cryptography dependency to address a CVE. Core CI checks passed despite some integration and publish job failures. | |
| #356 build(deps): bump cryptography | craft-store | merged | Merged to bump the cryptography dependency and resolve OSV vulnerability GHSA-p423-j2cm-9vmq. Approved by two reviewers and passed CI checks, with one Windows test failure noted. | |
| #421 build: bump dependencies for OSVs | imagecraft | merged | Merged after two approvals. Updated cryptography to 50.0.0 and httplib2 to 0.32.0 via uv lock to address OSV vulnerabilities. Test and lint checks passed; snap build failures were bypassed to proceed with the dependency update. | |
| #1003 build(auto): bump cryptography | craft-providers | merged | Merged to bump the cryptography dependency and resolve an OSV security vulnerability. Approved by two reviewers with all CI checks passing. | |
| #1061 build(deps): bump cryptography | craft-application | merged | Merged a dependency update to bump cryptography, resolving an OSV security vulnerability. Approved by two reviewers and passing all CI checks, the change modified one file with 51 additions and 51 deletions. | |
| #353 build(deps): bump libraries for OSVs | craft-store | merged | Merged after updating cryptography, markdown, and pygments to patch OSV vulnerabilities. Approved by two reviewers and passed all CI checks. | |
| #453 build(deps): bump pytest | craft-cli | merged | Merged a dependency update to bump pytest, resolving an OSV scanner vulnerability. Approved by one reviewer and passed all CI checks across multiple platforms and Python versions. |