build(deps): update filelock for OSV
Metadata
Current evaluation
Merged PR #262 bumped the filelock dependency for an OSV advisory; landed on main as commit 96ff5ed ("build(deps): update filelock for OSV (#262)"), with all CI checks green.
Resolution: closed resolved
Reason: The PR was approved by 2 reviewers and merged, appearing in main as commit 96ff5ed. The +3/-3 single-file diff updates the filelock pin, clearing the OSV-scanner finding.
Evaluated by: mr-cal-bot
No scores available.
Issue body
<!-- Describe your changes -->
---
- [x] I've followed the [contribution guidelines](https://github.com/canonical/imagecraft/blob/main/CONTRIBUTING.md).
- [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [x] I've successfully run `make lint && make test`.
- [x] I've added or updated any relevant documentation.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #262 bumped the filelock dependency for an OSV advisory; landed on main as commit 96ff5ed ("build(deps): update filelock for OSV (#262)"), with all CI checks green. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #262 updated filelock for OSV compliance in commit 96ff5ed, with all CI checks passing. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged after approval from two reviewers and passing all CI checks. Updated the filelock dependency to address OSV scanning requirements. Changes were minimal, affecting only one file with three lines modified. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged dependency update for filelock to resolve OSV security scanning alerts. Maintainer verified lint and test suites passed before integrating the changes into the codebase. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/craft-providers#1000
(confidence 45%)
Separate cross-project OSV dependency-bump PR; same remediation pattern but not linked from this repo.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #774 build(deps): lock file maintenance for OSV bugs | craft-providers | merged | Merged PR #774 (commit 3a4e72e) updating uv.lock to resolve OSV advisories GHSA-9hjg-9r4m-mvj7, GHSA-48p4-8xcf-vxj5q and GHSA-pq67-6m6q-mj2v; +6/-6 lines in uv.lock only. | |
| #227 build(deps): lock file maintenance (main) | craft-archives | merged | Renovate lock file maintenance PR merged into main as commit 14e2bba, refreshing all locks (uv.lock, +1144/-1118) after two reviewer approvals despite a failing OSV-scanner job. | |
| #228 build(deps): lock file maintenance (main) | craft-archives | merged | Renovate lock file maintenance PR merged into main as commit 1b6bf12, refreshing uv.lock (+1144/-1118). Merged despite two red "Security scan / OSV-scanner" checks; lint, test and CLA jobs all passed. | |
| #963 build(deps): update lockfile for OSVs | craft-providers | merged | Merged PR canonical/craft-providers#963 by lengau refreshed uv.lock (uv lock -P cryptography -P idna -P pytest -P urllib3) to clear OSV-scanner CI alerts. Related Plucky test fixes landed in #962. | |
| #231 build(deps): lock file maintenance (main) | craft-archives | merged | Renovate lock file maintenance merged into main as commit ddae56d, refreshing uv.lock (+1144/-1118). Lint, fast/slow tests, minimum-deps and CLA checks passed; only the flaky OSV-scanner check was red. | |
| #95 build(deps): lock file maintenance | starflow | merged | Renovate lock file maintenance PR merged to main as commit 77c3b79 ("build(deps): lock file maintenance (#95)"), refreshing uv.lock (+412/-334) with 2 approvals and all CI checks green. | |
| #184 build(deps): lock file maintenance (main) | craft-platforms | merged | Renovate lock file maintenance PR #184 merged into main via squashed commit ce66dd8, refreshing uv.lock (+260/-203) with 2 approvals and all CI checks green. | |
| #5698 build(deps): lock file maintenance (main) | snapcraft | merged | Renovate lock file maintenance PR merged into main as commit 2f92cecf3, refreshing all dependency locks in uv.lock (+209/-215) after 2 approvals and a fully green CI run. | |
| #2782 build(deps): lock file maintenance (main) | charmcraft | merged | Renovate lock file maintenance merged as commit e4d619c4 (build(deps): lock file maintenance (#2782)), refreshing all locks (uv.lock, +755/-665). Approved by 1 reviewer; merged despite some snap-store-tests/OSV-scanner job failures. | |
| #478 build(deps): lock file maintenance (main) | craft-cli | merged | Renovate lock file maintenance PR merged into main as commit 3af3124, refreshing uv.lock with all dependency locks updated (+1471/-825); approved with all 50 CI checks passing. |