build: update requests to 2.33.0
Metadata
Current evaluation
Merged requests 2.33.0 in canonical/imagecraft#308 via commit cbca1c1 to address an OSV advisory.
Resolution: closed resolved
Reason: PR #308 was merged in commit cbca1c1, updating requests from 2.32.3 to 2.33.0 to address the reported OSV. It was approved with no unresolved review comments.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps requests to 2.33.0 to resolve an osv
---
- [x] I've followed the [contribution guidelines](https://github.com/canonical/imagecraft/blob/main/CONTRIBUTING.md).
- [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged requests 2.33.0 in canonical/imagecraft#308 via commit cbca1c1 to address an OSV advisory. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/imagecraft#308 via commit cbca1c1, updating requests from 2.32.3 to 2.33.0 to address an OSV advisory. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a dependency update bumping requests to 2.33.0 to resolve an OSV. Approved by two reviewers and passed CI, the single-file change addresses the security vulnerability. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged dependency update to requests 2.33.0 to resolve an OSV. Authored by maintainer smethnani, the change was successfully integrated into the codebase. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #40 Update dependency requests to v2.32.2 [SECURITY] | imagecraft | closed | Renovate PR #40 updating requests 2.31.0 to 2.32.2 was closed unmerged as already handled by canonical/imagecraft#39. | |
| #106 build(deps): bump requests from 2.32.5 to 2.33.0 | debcraft | merged | Merged in debcraft#106 via commit 1aae105, updating requests from 2.32.5 to 2.33.0 in the lockfile; all CI checks passed. | |
| #6127 build(deps): bump requests from 2.32.5 to 2.33.0 | snapcraft | merged | Merged #6127 as fce681014, updating requests from 2.32.5 to 2.33.0, including upstream hardening for CVE-2026-25645. | |
| #1119 build(deps): update dependency requests to v2.32.4 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | Autoclosed unmerged; canonical/craft-parts#1121 replaced the requests update and landed as commit 53f7d360, using a version that passed OSV scanning. | |
| #1516 build(deps): update dependency requests to v2.33.0 [security] (main) | craft-parts | merged | Merged PR #1516 as commit 3d099307, upgrading requests from 2.32.5 to 2.33.0 to remediate CVE-2026-25645. | |
| #122 build(deps): bump requests from 2.32.5 to 2.33.0 | starflow | merged | Updated requests from 2.32.5 to 2.33.0; PR #122 was merged as commit cf593d0 after two approvals and with all CI checks passing. | |
| #1117 build(deps): update dependency requests to v2.32.4 [security] (main) - autoclosed | craft-parts | closed | Autoclosed without merge after the requests 2.32.4 security bump landed through merged PR canonical/craft-parts#1121 in commit 53f7d360. | |
| #107 build(deps): refresh uv.lock | imagecraft | merged | Merged in canonical/imagecraft#107 via commit bca90dd (build(deps): refresh uv.lock), updating2 files (+365/-360) to refresh pinned dependency versions. Approved by 2 reviewers with no CI failures. | |
| #348 build(deps): update dependency requests to v2.33.0 [security] (main) | craft-store | merged | Renovate dependency bump of requests 2.32.4 → 2.33.0 in craft-store, fixing CVE-2026-25645 (GHSA-gc5v-m9x4-r6x2). PR approved by 2 reviewers and merged into main as commit c4200cc (+3/-3 in pyproject.toml). |