Update dependency certifi to v2023 [SECURITY] - autoclosed
Metadata
Current evaluation
Renovate PR #15 proposed certifi 2023.7.22 for security fixes but was autoclosed unmerged after inactivity; no resolving merge or commit was recorded.
Resolution: closed stale
Reason: The PR remained pending with no reviewers, comments, or CI checks and was automatically closed without merging after prolonged inactivity.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [certifi](https://togithub.com/certifi/python-certifi) | `==2022.9.24` -> `==2023.7.22` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
### GitHub Vulnerability Alerts
#### [CVE-2022-23491](https://togithub.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8)
Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store.
TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found [here](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ).
#### [CVE-2023-37920](https://togithub.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7)
Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. These are in the process of being removed from Mozilla's trust store.
e-Tugra's root certificates are being removed pursuant to an investigation prompted by reporting of security issues in their systems. Conclusions of Mozilla's investigation can be found [here](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A).
---
### Release Notes
<details>
<summary>certifi/python-certifi (certifi)</summary>
### [`v2023.7.22`](https://togithub.com/certifi/python-certifi/compare/2023.05.07...2023.07.22)
[Compare Source](https://togithub.com/certifi/python-certifi/compare/2023.05.07...2023.07.22)
### [`v2023.5.7`](https://togithub.com/certifi/python-certifi/compare/2022.12.07...2023.05.07)
[Compare Source](https://togithub.com/certifi/python-certifi/compare/2022.12.07...2023.05.07)
### [`v2022.12.7`](https://togithub.com/certifi/python-certifi/compare/2022.09.24...2022.12.07)
[Compare Source](https://togithub.com/certifi/python-certifi/compare/2022.09.24...2022.12.07)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC.
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/imagecraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy44Ny4yIiwidXBkYXRlZEluVmVyIjoiMzcuODcuMiIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Renovate PR #15 proposed certifi 2023.7.22 for security fixes but was autoclosed unmerged after inactivity; no resolving merge or commit was recorded. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate's proposed security update of certifi from 2022.9.24 to 2023.7.22 was autoclosed without merging after inactivity. | |
| qwen/qwen3.6-35b-a3b | — | — | Security update PR for certifi to v2023.7.22 was autoclosed without merging. Renovate automatically closed the pull request due to expiration or branch updates, leaving the dependency unupdated. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate pull request to update certifi to v2023.7.22 for security patches was autoclosed without merging. Automerge was disabled by configuration, causing the PR to be abandoned due to inactivity. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #45 Update dependency certifi to v2024.7.4 [SECURITY] - autoclosed | imagecraft | closed | Renovate's certifi 2024.7.4 security update was autoclosed without merging after prolonged inactivity. | |
| #1181 chore(deps): update dependency certifi to v2023.7.22 [security] - autoclosed | charmcraft | closed | Autoclosed after the same certifi 2023.7.22 security update was merged via Dependabot PR #1182 in commit 8350a166. | |
| #4897 chore(deps): update dependency certifi to v2024 [security] - autoclosed | snapcraft | closed | Autoclosed unmerged as redundant; certifi 2024.7.4 landed via #4896 (a4e2895da), with the matching docs update later merged in #4903. | |
| #946 Update dependency certifi to v2022.12.7 [SECURITY] | charmcraft | merged | Renovate security bump of certifi 2022.6.15 -> 2022.12.7 (removes TrustCor roots, CVE-2022-23491) merged via PR #946 (commit 8ab4b1bd, merge 9103c49c), pinning the version in requirements. | |
| #1234 build(deps): update dependency certifi to v2024.12.14 (hotfix/1.5) | rockcraft | closed | Certifi 2024.12.14 hotfix PR was closed unmerged after 113 days of inactivity; no resolving PR or commit was found. | |
| #3 Update dependency future to v0.18.3 [SECURITY] - autoclosed | imagecraft | closed | Renovate PR #3 was autoclosed without merging after prolonged inactivity, so the future 0.18.3 update for CVE-2022-40899 was not delivered. | |
| #4 Update dependency reportlab to v3.6.13 [SECURITY] - autoclosed | imagecraft | closed | Renovate PR #4 proposed reportlab 3.6.13 for CVE-2023-33733, but was autoclosed unmerged after prolonged inactivity; no resolving commit or successor PR was found. | |
| #4000 build(deps): bump certifi from 2022.9.24 to 2022.12.7 | snapcraft | closed | Closed unmerged as obsolete after certifi 2023.5.7 was adopted in #4129 (fc9f9ae44), superseding the proposed 2022.12.7 update. |