OSV-scanner findings: outdated transitive dependencies (cryptography, httplib2, python-apt, setuptools)
Metadata
Current evaluation
OSV-scanner reports outdated transitive dependencies (cryptography, httplib2, python-apt, setuptools). Issue has no maintainer response; referenced file doesn't exist in current repo layout.
Suggested action: needs triage
Reason: The issue has no maintainer response, no labels, and no assignee after 24 days. The referenced file `requirements/uv-requirements.--all-extras.txt` does not exist in the current repo layout, and `uv.lock` already shows `cryptography` at version 50.0.0 (the fixed version), suggesting partial resolution. A maintainer needs to validate whether the issue is still relevant or if it has been addressed.
Impact:
75
Quick Win:
56.25
Staleness:
45
Complexity:
25
Confidence:
60
Support Request:
15
Issue body
🤖 [BEEP BOOP, A BOT WROTE THIS COMMENT - Claude Sonnet 5, GitHub Copilot CLI]
Found while validating the Starbase sync PR #402 (\`Security scan / OSV-scanner\` is red there). Confirmed via a worktree diff against the pre-merge commit (\`14e2332\`) that these dependency versions are unchanged by the merge — this is a pre-existing issue, not something introduced by #402.
Current OSV-scanner findings (from \`requirements/uv-requirements.--all-extras.txt\`):
| Package | Version | Fixed version | Advisory |
|---|---|---|---|
| cryptography | 49.0.0 | 50.0.0 | https://osv.dev/PYSEC-2026-3552 |
| httplib2 | 0.31.2 | 0.32.0 | https://osv.dev/PYSEC-2026-3444 |
| python-apt | 3.0.0+ubuntu1 | -- (no fix available) | https://osv.dev/GHSA-pj65-3pf6-c5q4, https://osv.dev/GHSA-rp8m-h266-53jh |
| setuptools | 81.0.0 | 83.0.0 | https://osv.dev/PYSEC-2026-3447 |
Suggested next step: bump \`cryptography\`, \`httplib2\`, and \`setuptools\` to the fixed versions (likely via Renovate or a manual \`uv lock --upgrade-package\`); \`python-apt\`'s findings have no fixed version yet upstream, so those may just need to be tracked/monitored.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen3.6-35b-a3b-mtp-q6 |
Impact:
75
Quick Win:
56.25
Staleness:
45
Complexity:
25
Confidence:
60
Support Request:
15
|
needs triage | OSV-scanner reports outdated transitive dependencies (cryptography, httplib2, python-apt, setuptools). Issue has no maintainer response; referenced file doesn't exist in current repo layout. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
90
Support Request:
5
|
needs triage | Reports OSV-scanner findings for outdated transitive dependencies with known security advisories. Currently unlabelled and awaiting maintainer triage. Suggests version bumps or tracking. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Related To:
debcraft#181
(confidence 70%)
Similar OSV-scanner vulnerability issue in debcraft that was resolved by bumping transitive dependencies to patch CVEs.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1278 build(deps): update deps to resolve OSV vulnerabilities | rockcraft | merged | Merged dependency updates for cryptography, dulwich, idna, lxml, poetry, pytest, urllib3, and msgpack to resolve OSV vulnerabilities. Added osv-scanner exceptions for python-apt and cryptography. Approved and passed CI. |