build(deps): resolve osvs
Metadata
Current evaluation
Merged in commit 10f3370, updating Pygments and cryptography to resolve OSV findings.
Resolution: closed resolved
Reason: PR #313 merged after two approvals and was committed as 10f3370. The dependency bumps addressed the reported OSV findings and passed the security scans.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps `pygments` and `cryptography` to resolve osvs
---
- [ ] I've followed the [contribution guidelines](https://github.com/canonical/imagecraft/blob/main/CONTRIBUTING.md).
- [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged in commit 10f3370, updating Pygments and cryptography to resolve OSV findings. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged canonical/imagecraft#313 after two approvals, updating pygments and cryptography dependencies to resolve OSVs. Spread tests failed on listed Ubuntu jobs but did not prevent merge. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged after approval by two reviewers. Bumps pygments and cryptography dependencies to resolve OSVs. Integrated despite failing spread tests on Ubuntu versions. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged dependency updates for pygments and cryptography to resolve open source vulnerabilities. Changes were reviewed and integrated into the main branch by maintainer smethnani. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #940 build(deps): update cryptography, pygments, requests | craft-providers | merged | Merged PR #940 as commit eb8549f, updating cryptography, Pygments, and requests to resolve three OSV warnings. | |
| #131 build(deps): resolve OSVs | debcraft | merged | Merged as commit 509e420: routine 'build(deps): resolve OSVs' uv.lock update (cryptography 46.0.7, pygments 2.20.0, pytest 9.0.3, requests 2.33.1) that incidentally bumped craft-parts, causing a StepInfo regression. | |
| #945 build(deps): resolve OSVs | craft-providers | merged | Merged Dependabot-style OSV remediation PR into main as commit ee7d5be, re-locking pytest and cryptography; final conflict resolution kept main's cryptography 48.0.0. | |
| #81 build(deps): resolve OSVs | craft-artifacts | merged | Merged as commit 32dec6c in craft-artifacts, bumping Pygments 2.19.2→2.20.0 and pytest 9.0.2→9.0.3 in uv.lock to clear OSV-scanner advisories. Approved by 2 reviewers despite a failing typecheck-with-ty job. | |
| #180 build(deps): resolve OSVs | craft-grammar | merged | Merged #180 in commit 983ae56, updating uv.lock to pytest 9.0.3 from 9.0.2 to resolve OSV findings; all CI checks passed. | |
| #517 build(deps): bump pygments | starbase | merged | Merged the Pygments dependency bump in #517 (commit c9fecdf), clearing the reported OSV security warning. | |
| #177 build(deps): bump pygments | craft-grammar | merged | Merged the Pygments dependency bump in #177 via commit de39544, resolving an OSV warning with all CI checks passing. | |
| #353 build(deps): bump libraries for OSVs | craft-store | merged | Merged dependabot-style PR bumping cryptography 44.0.2→46.0.6, Markdown 3.8→3.10.2 and Pygments 2.19.1→2.20.0 in uv.lock to clear outstanding OSVs (commit 98818d8). | |
| #1278 build(deps): update deps to resolve OSV vulnerabilities | rockcraft | merged | Merged as f0b08615, updating nine dependencies to address OSV findings and adding scoped python-apt and cryptography scanner exceptions. | |
| #1529 build(deps): bump pygments to 2.20.0 | craft-parts | merged | Merged PR #1529 as commit 5ed85e12, updating Pygments to 2.20.0 to resolve an OSV; all listed CI checks passed. |