build(deps): raise oauthlib constraint floor for OSV findings
Metadata
Current evaluation
Fixed OSV security findings by raising oauthlib>=4.0.0 and urllib3>=2.8.0 constraints in tool.uv.constraint-dependencies. Merged with passing CI checks.
Resolution: closed resolved
Reason: Resolved by merging PR #204, which raised oauthlib>=4.0.0 and urllib3>=2.8.0 constraints in tool.uv.constraint-dependencies to address OSV security findings. All CI checks passed except Canonical CLA.
Evaluated by: mr-cal-bot
No scores available.
Issue body
🤖 [BEEP BOOP, A BOT WROTE THIS PR - Mistral Large 4, opencode]
Pre-existing security findings, split into a preparation PR per the Starbase merge policy (unrelated dependency bump driven by an external factor; main's `Check policy` workflow has been failing on these since the OSV entries were published on 2026-10-01).
OSV-scanner flags two transitive dependencies in the `uv export --all-extras` scan:
| Package | Locked | Vulnerabilities | Fixed in |
| --- | --- | --- | --- |
| oauthlib | 3.3.1 (via lazr-restfulclient) | PYSEC-2026-4113, PYSEC-2026-4114 | 4.0.0 |
| urllib3 | 2.7.0 (via requests) | PYSEC-2026-4175, PYSEC-2026-4176, GHSA-gh4c-6fx4-qh6g | 2.8.0 |
Fix: raise the minimum versions in `tool.uv.constraint-dependencies` to the fixed releases (`oauthlib>=4.0.0`, `urllib3>=2.8.0`) — the mechanism starbase provides for applications to avoid CVEs in transitive dependencies — and regenerate `uv.lock`.
Notes:
- The lock regeneration also brings `craft-platforms` 0.10.0 -> 0.12.0: the existing lock was stale (`craft-application` 7.3.0 requires `craft-platforms>=0.12.0`) and any re-resolution corrects it. Not a chosen upgrade.
- `oauthlib` 4.0.0 is a major-version bump for a transitive dependency (via `lazr-restfulclient`, used for Launchpad auth). The full fast test suite passes (245 passed); runtime Launchpad-auth paths are not covered by the test suite, so reviewers may want to sanity-check store/Launchpad flows.
- `urllib3` 2.8.0 is within `requests`' `urllib3<3,>=1.26` requirement.
- Validation: `uv lock --check` passes; `pytest -m 'not slow'` passes (245 passed, 1 skipped).
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | closed resolved | Fixed OSV security findings by raising oauthlib>=4.0.0 and urllib3>=2.8.0 constraints in tool.uv.constraint-dependencies. Merged with passing CI checks. | |
| ~deepseek/deepseek-pro-latest |
Impact:
50
Quick Win:
16
Complexity:
45
Confidence:
70
Actionability:
60
|
needs review | Raises oauthlib and urllib3 constraint floors to 4.0.0/2.8.0 and regenerates uv.lock to fix OSV findings; all CI passes except lint/files. |
Update history
| Date | Change |
|---|---|
| merged | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #260 build(deps): raise oauthlib constraint to 4.0.0 | craft-archives | merged | Merged PR #260 raising the oauthlib dependency constraint to >=4.0.0 to resolve OSV security scan failures caused by advisories against version 3.3.1. | |
| #1383 build(deps): constraints for oauthlib and urllib3 | rockcraft | merged | PR #1383 merged to add constraints for oauthlib and urllib3, resolving multiple OSV-reported security vulnerabilities. | |
| #1204 build(deps): constraints for oauthlib and urllib3 | craft-application | merged | Merged PR #1204 added oauthlib and urllib3 dependency constraints, remediating five cited GHSA/OSV vulnerabilities. | |
| #267 build(deps): raise oauthlib and urllib3 constraints | craft-archives | closed | PR #267 was closed without merging due to failing CI checks. It replaced #260 to update oauthlib and urllib3 constraints. | |
| #102 build: fix urllib3 osv | craft-grammar | merged | Merged PR #102 in commit c936b0f, fixing an OSV workflow error related to urllib3; all lint, test, policy, and security checks passed. |