build(deps): update lxml
Metadata
Current evaluation
Merged as commit eae7ded: uv.lock-only bump of lxml to 6.1.1 clearing an OSV advisory. All CI passed, including OSV-scanner and Trivy scans; 2 approvals. Later superseded by lxml bump #540 (663c1b4).
Resolution: closed resolved
Reason: The PR merged into main as commit eae7ded, updating lxml to 6.1.1 in uv.lock to resolve the reported OSV; all CI checks including Security scan / OSV-scanner and Trivy passed with no failures, and review was approved with 0 unresolved comments.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Resolves an osv
---
- [x] I've followed the [contribution guidelines](https://github.com/canonical/imagecraft/blob/main/CONTRIBUTING.md).
- [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [x] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit eae7ded: uv.lock-only bump of lxml to 6.1.1 clearing an OSV advisory. All CI passed, including OSV-scanner and Trivy scans; 2 approvals. Later superseded by lxml bump #540 (663c1b4). | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #331 as commit eae7ded, updating lxml to 6.1.1 in the lock file to resolve the reported OSV vulnerability; all CI checks passed. | |
| qwen/qwen3.6-35b-a3b | — | — | Updated lxml dependency to resolve an OSV. Merged after approval by two reviewers and passing all CI checks. Changes affect one file with 98 additions and 98 deletions. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged to update the lxml dependency and resolve an open source vulnerability. The maintainer verified lint and test compliance, and the change was integrated without further discussion. |
Update history
No update history recorded yet.
Related work
-
Related To:
imagecraft#540
(confidence 85%)
Later commit 663c1b4 'build(deps): bump lxml (#540)' bumps the same dependency again, following this OSV-driven update; no imagecraft#540 issue record was retrievable, so the reference is inferred from git history.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1563 build(deps): bump lxml | craft-parts | merged | Merged PR #1563 (commit 3495de62) bumped lxml from 6.0.2 to 6.1.0 in uv.lock to clear an OSV advisory; all CI and OSV/Trivy security scans passed with no reviewer comments. | |
| #86 build(deps): bump lxml | craft-artifacts | merged | Merged PR #86 via commit 3149b0b, updating lxml from 6.0.2 to 6.1.1 in uv.lock to resolve an OSV vulnerability. | |
| #1072 build(deps): bump lxml | craft-application | merged | Merged #1072 via commit e8c8a384, updating lxml from v6.0.2 to v6.1.0 to resolve an OSV vulnerability. | |
| #540 build(deps): bump lxml | starbase | merged | Merged #540, bumping lxml to resolve an OSV vulnerability. The update landed as commit 663c1b4 with all CI checks passing. | |
| #6210 build(deps): bump lxml | snapcraft | merged | Merged PR #6210 and commit 76f9fdaca bumped lxml to resolve an OSV security advisory. | |
| #141 build(deps): update lxml to 6.1.0 | debcraft | merged | Renovate-style dependency bump of lxml from 6.0.2 to 6.1.0 merged into debcraft via commit 434c271 (PR #141), updating only uv.lock; all CI checks passed. | |
| #362 build(deps): bump lxml | craft-store | merged | Merged PR canonical/craft-store#362 in commit 4719100, upgrading lxml from 5.4.0 to 6.1.0 to resolve an OSV advisory. | |
| #3404 build(deps): bump lxml from 4.5.0 to 4.6.2 | snapcraft | merged | Merged PR #3404 as commit ebb14936e, updating lxml from 4.5.0 to 4.6.2 and including HTML Cleaner JavaScript-pass-through fixes such as CVE-2020-27783. | |
| #3485 build(deps): bump lxml from 4.6.2 to 4.6.3 | snapcraft | merged | Dependabot security bump of lxml 4.6.2 -> 4.6.3 (CVE-2021-28957 HTML cleaner fix) was approved and merged into snapcraft as commit d4d7721e3, updating requirements.txt. | |
| #3829 build(deps): bump lxml from 4.9.0 to 4.9.1 | snapcraft | merged | Dependabot PR #3829 bumping lxml 4.9.0 -> 4.9.1 was approved and squash-merged into main as commit a61c6032a ('build(deps): bump lxml from 4.9.0 to 4.9.1 (#3829)'), updating requirements/setup pinning. |