build(deps): bump cryptography and starlette
Metadata
Current evaluation
Merged dependency update bumping cryptography to 49.0.0 and adding starlette>=1.3.1 to resolve OSV security vulnerabilities. Approved by one reviewer and merged after passing required CI checks.
Suggested action: —
No scores available.
Issue body
Bumps cryptography v46.0.7 -> v49.0.0 and adds a starlette>=1.3.1 constraint to resolve osvs
---
- [ ] I've followed the [contribution guidelines](https://github.com/canonical/imagecraft/blob/main/CONTRIBUTING.md).
- [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged dependency update bumping cryptography to 49.0.0 and adding starlette>=1.3.1 to resolve OSV security vulnerabilities. Approved by one reviewer and merged after passing required CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged dependency update bumping cryptography to v49.0.0 and constraining starlette to >=1.3.1 to resolve open source vulnerabilities. Changes passed linting and testing before integration. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1055 build(deps): bump cryptography | craft-application | merged | Merged after bumping the cryptography dependency to resolve an OSV security vulnerability. Approved by two reviewers and passed all CI checks, including security scans and multi-platform tests. | |
| #1061 build(deps): bump cryptography | craft-application | merged | Merged a dependency update to bump cryptography, resolving an OSV security vulnerability. Approved by two reviewers and passing all CI checks, the change modified one file with 51 additions and 51 deletions. | |
| #1098 build(deps): bump cryptography | craft-application | merged | Bumps cryptography from v48.0.0 to v49.0.0 to resolve OSV vulnerability GHSA-537c-gmf6-5ccf. Approved by two reviewers, passed CI checks, and successfully merged. | |
| #350 build(deps): bump starlette | imagecraft | merged | Merged dependency update bumping starlette from v0.52.1 to v1.2.0 to resolve an OSV vulnerability. Approved by two reviewers and passed all CI checks prior to integration. | |
| #356 build(deps): bump cryptography | craft-store | merged | Merged to bump the cryptography dependency and resolve OSV vulnerability GHSA-p423-j2cm-9vmq. Approved by two reviewers and passed CI checks, with one Windows test failure noted. | |
| #6029 build(deps): bump cryptography from 46.0.3 to 46.0.5 | snapcraft | merged | Merged a Dependabot update bumping cryptography from 46.0.3 to 46.0.5. The upgrade patches CVE-2026-26007, deprecates SECT* curves, and updates OpenSSL to 3.5.5. Approved by two reviewers and merged after passing CI checks. | |
| #6307 build(deps): bump cryptography | snapcraft | merged | Merged after approval. Bumps the cryptography dependency to address a CVE. Core CI checks passed despite some integration and publish job failures. | |
| #6030 build(deps): bump cryptography from 46.0.3 to 46.0.5 | snapcraft | merged | Merged after review and passing CI checks. Updates the cryptography dependency from 46.0.3 to 46.0.5 to address an OSV security advisory on the hotfix/8.14 branch. | |
| #5119 build(deps): update dependency starlette to v0.40.0 [security] (main) | snapcraft | merged | Merged dependency update upgrading starlette to v0.40.0 to resolve CVE-2024-47874, a denial-of-service vulnerability in multipart/form-data parsing. Approved by two reviewers with passing CI checks. | |
| #418 build: bump cryptography for OSV | craft-store | merged | Merged to bump the cryptography dependency and resolve an OSV vulnerability. Approved by a reviewer, passed CI checks, and modified two files. |