build(autogen): bump urllib3
Metadata
Current evaluation
Merged as commit 4443100: bumped urllib3 via `uv sync --upgrade-package urllib3` (+3/-3, 1 file) to stop shipping a vulnerable version, despite spread test failures on Ubuntu 20.04/22.04/24.04.
Resolution: closed resolved
Reason: PR #164 was approved by two reviewers and merged into main as commit 4443100, updating the urllib3 pin. Maintainer lengau confirmed the failing spread runs on older Ubuntu bases were acceptable since imagecraft still works with the older vulnerable urllib3 versions. Later bumps continued in imagecraft#256 (f288fec) and imagecraft#344 (033c84e).
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [x] Have you followed the guidelines for contributing?
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [x] Have you successfully run `make lint && make test`?
---
Bumped with `uv sync --upgrade-package urllib3`
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 4443100: bumped urllib3 via `uv sync --upgrade-package urllib3` (+3/-3, 1 file) to stop shipping a vulnerable version, despite spread test failures on Ubuntu 20.04/22.04/24.04. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 4443100 (approved by 2 reviewers): uv.lock-only urllib3 bump (+3/-3) via `uv sync --upgrade-package urllib3`, dropping OSV-flagged versions; failing spread jobs on Ubuntu 20.04/22.04/24.04 were accepted. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in #164 via commit 4443100, updating uv.lock to ship a patched urllib3 release rather than an older vulnerable version. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #164 as 4443100, upgrading urllib3 with uv sync --upgrade-package urllib3 despite spread failures on older Ubuntu releases to avoid shipping vulnerable versions. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #164, upgrading urllib3 with uv to ship a secure dependency. Two reviewers approved; lint, tests and security scans passed, while spread failed only on older Ubuntu releases. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged to bump urllib3 for security. Approved by two reviewers and applied via uv sync --upgrade-package urllib3. Merged despite failing spread tests on older Ubuntu releases to ensure secure dependencies are shipped. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged. The urllib3 dependency was upgraded using uv sync. Reviewers agreed to enforce the newer version to prevent shipping vulnerable indirect dependencies, despite older versions remaining functional. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/imagecraft#256
(confidence 70%)
Later 'build: bump urllib3' PR merged as f288fec, continuing the same dependency upgrade track.
-
Related To:
canonical/imagecraft#344
(confidence 60%)
Later 'build(deps): bump urllib3' commit 033c84e, a subsequent urllib3 bump in the same dependency chain.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1135 build(autogen): bump urllib3 | craft-parts | merged | Autogenerated dependency bump PR merged as commit 74e21521: urllib3 upgraded via `uv sync --upgrade-package urllib3` (+7/-7 across pyproject.toml and uv.lock). Approved by 3 reviewers with all CI checks green. | |
| #344 build(deps): bump urllib3 | imagecraft | merged | Merged urllib3 dependency bump (uv.lock, +3/-3) fixing an OSV advisory; commit 033c84e landed PR #344 with 2 approvals and all CI checks green. | |
| #5912 build: bump urllib3 | snapcraft | merged | Merged PR #5912 (commit 99a19a09a) bumped urllib3 to resolve an OSV vulnerability. | |
| #63 build: bump urllib3 | debcraft | merged | Merged PR #63 updated urllib3 to resolve an OSV vulnerability; commit 5f83429 passed all CI checks. | |
| #5930 build: bump urllib3 | snapcraft | merged | Merged PR #5930 as commit a473ada2c, bumping urllib3 to address an OSV vulnerability. | |
| #165 build: bump urllib3 | craft-grammar | merged | Merged PR #165 as commit 9deba2e, bumping urllib3 in a one-file lock update to resolve an OSV advisory; all CI checks passed. | |
| #972 build: bump urllib3 | craft-application | merged | PR #972 merged as commit 6e9b7307, raising the urllib3 lower bound in pyproject.toml (now ">=2.8" in uv.lock) to clear an OSV vulnerability; all CI checks passed. | |
| #159 build: bump urllib3 | craft-grammar | merged | Merged PR #159 (commit f6dd80b) into craft-grammar: a +3/-3 uv.lock-only bump of urllib3 to clear an OSV advisory. Approved by 2 reviewers; all CI green except the Ubuntu 24.04/Py3.10 slow tests. | |
| #74 build: bump urllib3 | debcraft | merged | Merged PR #74 bumped urllib3 to resolve an OSV security warning; the change landed in commit 8eb280d. | |
| #1336 build(deps): bump urllib3 from 1.26.17 to 1.26.18 | charmcraft | closed | Superseded unmerged by commit 25d6160d, which updated urllib3 to 1.26.18; Dependabot closed #1336 as already up to date. |