← Back to issue list

build(deps): bump cryptography and starlette

View original Github issue

Metadata

Project
imagecraft
Number
#357
Type
pull request
State
merged
Author
smethnani
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #357 (commit a868324) bumping cryptography v46.0.7 to v49.0.0 and adding a starlette>=1.3.1 constraint to clear OSV findings; approved with 1 reviewer and most CI checks passing.

Resolution: closed resolved

Reason: The PR was approved and merged into the main branch as commit a868324, changing pyproject.toml (+53/-54). The later commit 5648cbe (PR #423) further upgraded the Rust toolchain for the new cryptography version, confirming the dependency bump landed.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Bumps cryptography v46.0.7 -> v49.0.0 and adds a starlette>=1.3.1 constraint to resolve osvs --- - [ ] I've followed the [contribution guidelines](https://github.com/canonical/imagecraft/blob/main/CONTRIBUTING.md). - [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #357 (commit a868324) bumping cryptography v46.0.7 to v49.0.0 and adding a starlette>=1.3.1 constraint to clear OSV findings; approved with 1 reviewer and most CI checks passing.
stealth/space-bunny-alpha — closed resolved Merged #357 (commit a868324), bumping cryptography 46.0.7 to 49.0.0 and adding starlette>=1.3.1 to address OSV vulnerabilities.
qwen/qwen3.6-35b-a3b — — Merged dependency update bumping cryptography to 49.0.0 and adding starlette>=1.3.1 to resolve OSV security vulnerabilities. Approved by one reviewer and merged after passing required CI checks.
qwen3.6-35b-a3b-mtp-q6 — — Merged dependency update bumping cryptography to v49.0.0 and constraining starlette to >=1.3.1 to resolve open source vulnerabilities. Changes passed linting and testing before integration.

Update history

No update history recorded yet.

Related work

  • Related To: imagecraft#423 (confidence 80%)

    Later follow-up PR (commit 5648cbe) upgrades the Rust toolchain so the newly bumped cryptography 49.0.0 builds.

  • Related To: imagecraft#318 (confidence 70%)

    Prior commit 8a390e6 bumped cryptography to 46.0.7, the baseline version this PR upgrades.

Related issues

Issue Project State Summary Similarity
#1061 build(deps): bump cryptography craft-application merged Merged PR #1061 in commit 4b0e00ae, bumping cryptography to remediate an OSV; two approvals and all reported CI checks passed.
82%
#1098 build(deps): bump cryptography craft-application merged Merged in #1098 via commit 239b3af7, updating cryptography 48.0.0 to 49.0.0 to resolve OSV GHSA-537c-gmf6-5ccf.
82%
#356 build(deps): bump cryptography craft-store merged Merged PR #356 as commit fcbad5c, bumping cryptography to remediate OSV GHSA-p423-j2cm-9vmq.
80%
#1055 build(deps): bump cryptography craft-application merged Merged PR #1055 (commit df46c84a) bumped the cryptography dependency to fix an OSV advisory, with 2 approvals and all CI checks passing; a later near-identical bump landed as #1061 (4b0e00ae).
80%
#350 build(deps): bump starlette imagecraft merged Merged PR #350 as commit 920399b, bumping Starlette from v0.52.1 to v1.2.0 to resolve an OSV advisory; all reported CI checks passed.
80%
#1003 build(auto): bump cryptography craft-providers merged Merged PR #1003 bumps the cryptography dependency to remediate an OSV; both reviews approved and all CI, security, test, lint, and policy checks passed.
78%
#122 build(deps): bump cryptography from 46.0.6 to 46.0.7 debcraft merged Dependabot PR merged as commit 0498780, bumping cryptography 46.0.6 -> 46.0.7 in debcraft's lockfile to fix CVE-2026-39892 and pick up OpenSSL 3.5.6 wheels. All CI checks passed.
78%
#6135 build(deps): bump cryptography from 46.0.5 to 46.0.6 snapcraft merged Merged #6135 as commit 1acb182bf, bumping cryptography 46.0.5 to 46.0.6 to fix CVE-2026-34073.
78%
#318 build: bump cryptography to 46.0.7 imagecraft merged Merged PR #318 (commit 8a390e6) by smethnani bumped cryptography to 46.0.7 in uv.lock to clear an OSV vulnerability; later superseded by #357 (49.0.0) and #421 (50.0.2).
78%
#418 build: bump cryptography for OSV craft-store merged PR #418 (maintainer bepri) bumped the cryptography dependency in2 files (+56/-56) to clear an OSV vulnerability. Approved and merged as commit e8fef67, with the OSV-scanner security check passing.
78%