build(autogen): bump starlette for OSV
Metadata
Current evaluation
Merged as commit cd48836, bumping Starlette in imagecraft's lockfile (uv lock --upgrade-package starlette) to clear an OSV advisory; all CI checks passed.
Resolution: closed resolved
Reason: The PR was approved and merged into main as commit cd48836 ("build(autogen): bump starlette for OSV (#230)"), updating the Starlette pin in the lockfile to remediate an OSV-scanner warning; OSV-scanner, Trivy, build and all test jobs passed.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
---
Fixes an OSV warning from Starlette. Just ran `uv lock --upgrade-package starlette`
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit cd48836, bumping Starlette in imagecraft's lockfile (uv lock --upgrade-package starlette) to clear an OSV advisory; all CI checks passed. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/imagecraft#230 as commit cd48836, updating Starlette in the lockfile to resolve an OSV warning. All CI checks passed. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit cd48836 via PR #230, updating Starlette in the lock file to clear an OSV security warning. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged to bump the Starlette dependency, resolving an OSV security warning. Approved by two reviewers, passed all CI checks, and updated the lock file with a minimal version change. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged an update to upgrade the Starlette dependency, resolving an OSV security warning. The change was applied using uv lock --upgrade-package starlette. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/imagecraft#350
(confidence 72%)
Later dependabot commit 920399b 'build(deps): bump starlette' continues bumping the same dependency.
-
Related To:
canonical/imagecraft#357
(confidence 68%)
Commit a868324 bumps cryptography and starlette together, superseding the earlier manual bump as routine dependency maintenance.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #350 build(deps): bump starlette | imagecraft | merged | Merged PR #350 as commit 920399b, bumping Starlette from v0.52.1 to v1.2.0 to resolve an OSV advisory; all reported CI checks passed. | |
| #1629 build: bump starlette | craft-parts | merged | Merged PR #1629 as commit 5363f3fd, bumping Starlette to resolve an OSV; remaining python-apt findings were judged false positives. | |
| #208 build(deps): bump starlette from 0.48.0 to 0.49.1 | craft-platforms | closed | Closed unmerged as redundant after Dependabot lock-file maintenance in #211 made Starlette current. | |
| #357 build(deps): bump cryptography and starlette | imagecraft | merged | Merged PR #357 (commit a868324) bumping cryptography v46.0.7 to v49.0.0 and adding a starlette>=1.3.1 constraint to clear OSV findings; approved with 1 reviewer and most CI checks passing. | |
| #333 build: bump urllib3 and starlette | craft-store | merged | Merged PR #333 in commit 0d45cae, bumping urllib3 and Starlette to resolve OSV security advisories; all CI checks passed. | |
| #5118 build(deps): bump starlette from 0.38.5 to 0.40.0 | snapcraft | closed | Dependabot's starlette 0.38.5→0.40.0 PR touched no files (0 files changed) and was closed unmerged. The same security fix landed via Renovate PR #5119 (commit 9fa59f7c4, main) and #5120 (commit fceb8c169, hotfix/8.4). | |
| #247 build(autogen): bump dependencies to resolve OSVs | imagecraft | merged | Merged #247 via commit 603fbc3, updating filelock 3.20.2, fonttools 4.61.1, and urllib3 2.6.2 to resolve OSV warnings; all CI checks passed. |