OSV-scanner findings: outdated transitive dependencies (cryptography, httplib2, python-apt, setuptools)
Metadata
Current evaluation
Resolved by merged PR canonical/imagecraft#421 (commit 71a1ee0), upgrading cryptography 49.0.0→50.0.0 and httplib2 0.31.2→0.32.0; the OSV-scanner check passed.
Resolution: closed resolved
Reason: PR canonical/imagecraft#421 was merged as commit 71a1ee0 and addressed the actionable OSV findings with dependency upgrades; its OSV-scanner check passed.
Evaluated by: mr-cal-bot
No scores available.
Issue body
🤖 [BEEP BOOP, A BOT WROTE THIS COMMENT - Claude Sonnet 5, GitHub Copilot CLI]
Found while validating the Starbase sync PR #402 (\`Security scan / OSV-scanner\` is red there). Confirmed via a worktree diff against the pre-merge commit (\`14e2332\`) that these dependency versions are unchanged by the merge — this is a pre-existing issue, not something introduced by #402.
Current OSV-scanner findings (from \`requirements/uv-requirements.--all-extras.txt\`):
| Package | Version | Fixed version | Advisory |
|---|---|---|---|
| cryptography | 49.0.0 | 50.0.0 | https://osv.dev/PYSEC-2026-3552 |
| httplib2 | 0.31.2 | 0.32.0 | https://osv.dev/PYSEC-2026-3444 |
| python-apt | 3.0.0+ubuntu1 | -- (no fix available) | https://osv.dev/GHSA-pj65-3pf6-c5q4, https://osv.dev/GHSA-rp8m-h266-53jh |
| setuptools | 81.0.0 | 83.0.0 | https://osv.dev/PYSEC-2026-3447 |
Suggested next step: bump \`cryptography\`, \`httplib2\`, and \`setuptools\` to the fixed versions (likely via Renovate or a manual \`uv lock --upgrade-package\`); \`python-apt\`'s findings have no fixed version yet upstream, so those may just need to be tracked/monitored.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Resolved by merged PR canonical/imagecraft#421 (commit 71a1ee0), upgrading cryptography 49.0.0→50.0.0 and httplib2 0.31.2→0.32.0; the OSV-scanner check passed. | |
| stealth/space-bunny-alpha |
Impact:
45
Quick Win:
27
Complexity:
30
Confidence:
60
Actionability:
85
|
needs triage | Bot-reported OSV-scanner findings for 4 transitive deps (cryptography, httplib2, python-apt, setuptools); three have fixes, python-apt does not. Pre-existing per PR #402; unlabelled, no maintainer response, awaiting triage. | |
| stealth/space-bunny-alpha |
Impact:
55
Quick Win:
36
Complexity:
28
Confidence:
98
Actionability:
92
|
close resolved | All four reported OSV dependency findings were addressed by commit 71a1ee0 (PR #421), although the issue remains open. | |
| qwen3.6-35b-a3b-mtp-q6 |
Impact:
75
Quick Win:
56
Staleness:
45
Complexity:
25
Confidence:
60
Support Request:
15
|
needs triage | OSV-scanner reports outdated transitive dependencies (cryptography, httplib2, python-apt, setuptools). Issue has no maintainer response; referenced file doesn't exist in current repo layout. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
90
Support Request:
5
|
needs triage | Reports OSV-scanner findings for outdated transitive dependencies with known security advisories. Currently unlabelled and awaiting maintainer triage. Suggests version bumps or tracking. |
Update history
| Date | Change |
|---|---|
| closed | |
| created |
Related work
-
Likely Fixed By:
canonical/imagecraft#421
(confidence 99%)
Merged dependency update for the OSV findings.
-
Related To:
canonical/imagecraft#402
(confidence 90%)
The findings were identified while validating the Starbase sync PR.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #421 build: bump dependencies for OSVs | imagecraft | merged | Maintainer dependabot-style PR merged as commit 71a1ee0: cryptography 49.0.0 -> 50.0.0 and httplib2 0.31.2 -> 0.32.0 to clear OSV dependency findings. Approved by 2 reviewers; OSV-scanner check passed, though build/snap-builds checks failed. | |
| #181 CI: OSV-scanner security-scan check persistently failing on main | debcraft | closed | OSV-scanner CI failure on main fixed by merged PR #182 ("build: bump deps, fix security scan"), which corrected the security-scan workflow and bumped cryptography, httplib2 and setuptools; all checks passed and the issue was closed. | |
| #418 build: bump cryptography for OSV | craft-store | merged | PR #418 (maintainer bepri) bumped the cryptography dependency in2 files (+56/-56) to clear an OSV vulnerability. Approved and merged as commit e8fef67, with the OSV-scanner security check passing. | |
| #1278 build(deps): update deps to resolve OSV vulnerabilities | rockcraft | merged | Merged as f0b08615, updating nine dependencies to address OSV findings and adding scoped python-apt and cryptography scanner exceptions. |