← Back to issue list

build: bump dependencies for OSVs

View original Github issue

Metadata

Project
imagecraft
Number
#421
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Maintainer dependabot-style PR merged as commit 71a1ee0: cryptography 49.0.0 -> 50.0.0 and httplib2 0.31.2 -> 0.32.0 to clear OSV dependency findings. Approved by 2 reviewers; OSV-scanner check passed, though build/snap-builds checks failed.

Resolution: closed resolved

Reason: PR #421 was approved by 2 reviewers with no unresolved comments and merged to main as commit 71a1ee0, updating the locked cryptography and httplib2 versions that the OSV-scanner job flagged. The Security scan / OSV-scanner check passed, confirming the dependency findings were addressed.

Evaluated by: mr-cal-bot

No scores available.

Issue body

``` ❯ uv lock -P cryptography -P httplib2 -P setuptools Resolved 139 packages in 1.70s Updated cryptography v49.0.0 -> v50.0.0 Updated httplib2 v0.31.2 -> v0.32.0 ``` --- - [ ] I've followed the [contribution guidelines](https://github.com/canonical/imagecraft/blob/main/CONTRIBUTING.md). - [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Maintainer dependabot-style PR merged as commit 71a1ee0: cryptography 49.0.0 -> 50.0.0 and httplib2 0.31.2 -> 0.32.0 to clear OSV dependency findings. Approved by 2 reviewers; OSV-scanner check passed, though build/snap-builds checks failed.
stealth/space-bunny-alpha — closed resolved Merged PR #421 as commit 71a1ee0, bumping cryptography 49.0.0 to 50.0.0 and httplib2 0.31.2 to 0.32.0 to address OSV dependency findings.
qwen/qwen3.6-35b-a3b — — Merged after two approvals. Updated cryptography to 50.0.0 and httplib2 to 0.32.0 via uv lock to address OSV vulnerabilities. Test and lint checks passed; snap build failures were bypassed to proceed with the dependency update.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 15
Confidence: 85
needs review Bumps cryptography, httplib2, and setuptools to address OSV security advisories. Approved by one reviewer, but CI fails on snap-builds and build steps.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 15
Confidence: 90
needs review Updates cryptography, httplib2, and setuptools to latest versions to address OSV security advisories. CI is passing, awaiting maintainer review.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 15
Confidence: 90
needs review Updates cryptography, httplib2, and setuptools to address OSV security vulnerabilities. Currently pending maintainer review with one failing OSV-scanner CI check.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 15
Confidence: 85
needs review Updates cryptography, httplib2, and setuptools to address OSV security advisories. Currently pending maintainer review with failing snap-build and OSV-scanner CI checks.

Update history

Date Change
updated
updated
updated
updated
created

Related issues

Issue Project State Summary Similarity
#418 build: bump cryptography for OSV craft-store merged PR #418 (maintainer bepri) bumped the cryptography dependency in2 files (+56/-56) to clear an OSV vulnerability. Approved and merged as commit e8fef67, with the OSV-scanner security check passing.
82%
#407 OSV-scanner findings: outdated transitive dependencies (cryptography, httplib2, python-apt, setuptools) imagecraft closed Resolved by merged PR canonical/imagecraft#421 (commit 71a1ee0), upgrading cryptography 49.0.0→50.0.0 and httplib2 0.31.2→0.32.0; the OSV-scanner check passed.
81%
#353 build(deps): bump libraries for OSVs craft-store merged Merged dependabot-style PR bumping cryptography 44.0.2→46.0.6, Markdown 3.8→3.10.2 and Pygments 2.19.1→2.20.0 in uv.lock to clear outstanding OSVs (commit 98818d8).
77%
#945 build(deps): resolve OSVs craft-providers merged Merged Dependabot-style OSV remediation PR into main as commit ee7d5be, re-locking pytest and cryptography; final conflict resolution kept main's cryptography 48.0.0.
76%
#357 build(deps): bump cryptography and starlette imagecraft merged Merged PR #357 (commit a868324) bumping cryptography v46.0.7 to v49.0.0 and adding a starlette>=1.3.1 constraint to clear OSV findings; approved with 1 reviewer and most CI checks passing.
75%
#1055 build(deps): bump cryptography craft-application merged Merged PR #1055 (commit df46c84a) bumped the cryptography dependency to fix an OSV advisory, with 2 approvals and all CI checks passing; a later near-identical bump landed as #1061 (4b0e00ae).
75%
#1061 build(deps): bump cryptography craft-application merged Merged PR #1061 in commit 4b0e00ae, bumping cryptography to remediate an OSV; two approvals and all reported CI checks passed.
75%
#182 build: bump deps, fix security scan debcraft merged Merged PR #182 (bepri) fixed #181: corrected the security-scan workflow and bumped cryptography 46.0.7→50.0.0, httplib2 0.31.0→0.32.0, setuptools 80.9.0→84.0.0. Approved with 2 reviewers; all CI checks passed.
74%
#1327 build: bump dependencies constrained by rustc version rockcraft merged PR #1327 merged as commit d9756725, unpinning dependencies previously held back by the older rustc and clearing a cryptography OSV found by the OSV-scanner check.
74%
#1003 build(auto): bump cryptography craft-providers merged Merged PR #1003 bumps the cryptography dependency to remediate an OSV; both reviews approved and all CI, security, test, lint, and policy checks passed.
73%