build(deps): update deps to resolve OSV vulnerabilities
Metadata
Current evaluation
Merged as f0b08615, updating nine dependencies to address OSV findings and adding scoped python-apt and cryptography scanner exceptions.
Resolution: closed resolved
Reason: PR #1278 was approved and merged as commit f0b08615. It upgraded the affected Python dependencies and excluded non-applicable vulnerabilities from OSV scanning.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Updated cryptography v46.0.6 -> v49.0.0
Updated dulwich v1.1.0 -> v1.2.7
Updated idna v3.11 -> v3.18
Updated lxml v6.0.2 -> v6.1.1
Updated poetry v2.3.3 -> v2.4.1
Updated poetry-core v2.3.2 -> v2.4.0
Updated pytest v9.0.2 -> v9.1.1
Updated urllib3 v2.6.3 -> v2.7.0
Updated msgpack v1.1.2 -> v1.2.1
Also add a python-apt exception on osv-scanner, as the detected CVEs are quite
old and not applicable (false-positive?), and an exception for 'cryptography',
because we can't update and the CVE affects the pre-built wheel that we don't
use.
---
- [ ] I've followed the [contribution guidelines](https://github.com/canonical/rockcraft/blob/main/CONTRIBUTING.md).
- [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
- [ ] I've updated the relevant release notes.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as f0b08615, updating nine dependencies to address OSV findings and adding scoped python-apt and cryptography scanner exceptions. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR updated dependencies to address OSV findings, adding OSV-scanner exceptions for python-apt and cryptography. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged dependency updates for cryptography, dulwich, idna, lxml, poetry, pytest, urllib3, and msgpack to resolve OSV vulnerabilities. Added osv-scanner exceptions for python-apt and cryptography. Approved and passed CI. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #313 build(deps): resolve osvs | imagecraft | merged | Merged in commit 10f3370, updating Pygments and cryptography to resolve OSV findings. | |
| #940 build(deps): update cryptography, pygments, requests | craft-providers | merged | Merged PR #940 as commit eb8549f, updating cryptography, Pygments, and requests to resolve three OSV warnings. | |
| #945 build(deps): resolve OSVs | craft-providers | merged | Merged Dependabot-style OSV remediation PR into main as commit ee7d5be, re-locking pytest and cryptography; final conflict resolution kept main's cryptography 48.0.0. | |
| #180 build(deps): resolve OSVs | craft-grammar | merged | Merged #180 in commit 983ae56, updating uv.lock to pytest 9.0.3 from 9.0.2 to resolve OSV findings; all CI checks passed. | |
| #407 OSV-scanner findings: outdated transitive dependencies (cryptography, httplib2, python-apt, setuptools) | imagecraft | closed | Resolved by merged PR canonical/imagecraft#421 (commit 71a1ee0), upgrading cryptography 49.0.0→50.0.0 and httplib2 0.31.2→0.32.0; the OSV-scanner check passed. | |
| #131 build(deps): resolve OSVs | debcraft | merged | Merged as commit 509e420: routine 'build(deps): resolve OSVs' uv.lock update (cryptography 46.0.7, pygments 2.20.0, pytest 9.0.3, requests 2.33.1) that incidentally bumped craft-parts, causing a StepInfo regression. | |
| #143 build(deps): resolve OSVs | debcraft | merged | Merged in canonical/debcraft#143 as commit 3e9db88, updating idna 3.10→3.18 and urllib3 2.6.3→2.7.0 to resolve OSV findings. All CI checks passed. | |
| #421 build: bump dependencies for OSVs | imagecraft | merged | Maintainer dependabot-style PR merged as commit 71a1ee0: cryptography 49.0.0 -> 50.0.0 and httplib2 0.31.2 -> 0.32.0 to clear OSV dependency findings. Approved by 2 reviewers; OSV-scanner check passed, though build/snap-builds checks failed. | |
| #418 build: bump cryptography for OSV | craft-store | merged | PR #418 (maintainer bepri) bumped the cryptography dependency in2 files (+56/-56) to clear an OSV vulnerability. Approved and merged as commit e8fef67, with the OSV-scanner security check passing. | |
| #6221 build(deps): bump pip | snapcraft | merged | Merged PR #6221 in commit 948f284fa, updating the pip build dependency to resolve an OSV security vulnerability. |