← Back to issue list

build: bump dependencies constrained by rustc version

View original Github issue

Metadata

Project
rockcraft
Number
#1327
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

PR #1327 merged as commit d9756725, unpinning dependencies previously held back by the older rustc and clearing a cryptography OSV found by the OSV-scanner check.

Resolution: closed resolved

Reason: Approved by 2 reviewers and merged into main as d9756725; the change (+607/-638 across 3 files, dependency constraints only) removed the rustc-related pins and the Security scan / OSV-scanner check passes post-merge.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Bumps dependencies that were pinned due to rustc's older version, which also resolves an OSV in cryptography. --- - [ ] I've followed the [contribution guidelines](https://github.com/canonical/rockcraft/blob/main/CONTRIBUTING.md). - [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing. - [ ] I've updated the relevant release notes. --- <sub>Stack created with <a href="https://github.com/github/gh-stack">GitHub Stacks CLI</a> • <a href="https://gh.io/stacks-feedback">Give Feedback 💬</a></sub>

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved PR #1327 merged as commit d9756725, unpinning dependencies previously held back by the older rustc and clearing a cryptography OSV found by the OSV-scanner check.
stealth/space-bunny-alpha — closed resolved Merged in canonical/rockcraft#1327 as d9756725, lifting dependency pins imposed by older rustc versions and resolving a cryptography OSV.
qwen/qwen3.6-35b-a3b — — Merged after two approvals. Bumps dependencies constrained by an older rustc version, resolving an OSV vulnerability in cryptography.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 25
Confidence: 85
needs review Updates pinned dependencies to align with newer rustc versions and resolves a cryptography OSV. PR is approved by one reviewer but has one unresolved comment pending maintainer attention.
qwen/qwen3.6-35b-a3b
Staleness: 10
Complexity: 20
Confidence: 90
needs review Updates dependencies pinned due to older rustc versions, resolving a cryptography OSV. Approved by one reviewer with one unresolved comment, awaiting final review.
qwen/qwen3.6-35b-a3b
Staleness: 10
Complexity: 30
Confidence: 85
needs review Bumps dependencies previously pinned due to older rustc version, resolving a cryptography OSV. Currently approved by one reviewer but has two unresolved comments and no CI checks reported.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 35
Confidence: 90
needs review Updates dependencies pinned for older rustc versions, resolving a cryptography OSV. Currently pending review with one unresolved comment and no CI checks executed.

Update history

Date Change
updated
updated
updated
updated
updated
updated
updated
created

Related issues

Issue Project State Summary Similarity
#418 build: bump cryptography for OSV craft-store merged PR #418 (maintainer bepri) bumped the cryptography dependency in2 files (+56/-56) to clear an OSV vulnerability. Approved and merged as commit e8fef67, with the OSV-scanner security check passing.
77%
#1055 build(deps): bump cryptography craft-application merged Merged PR #1055 (commit df46c84a) bumped the cryptography dependency to fix an OSV advisory, with 2 approvals and all CI checks passing; a later near-identical bump landed as #1061 (4b0e00ae).
75%
#421 build: bump dependencies for OSVs imagecraft merged Maintainer dependabot-style PR merged as commit 71a1ee0: cryptography 49.0.0 -> 50.0.0 and httplib2 0.31.2 -> 0.32.0 to clear OSV dependency findings. Approved by 2 reviewers; OSV-scanner check passed, though build/snap-builds checks failed.
74%
#423 fix(build): upgrade rust for cryptography imagecraft merged Merged PR #423 upgraded the Rust toolchain for cryptography dependencies, fixing the build and landing as commit 5648cbe.
74%
#1061 build(deps): bump cryptography craft-application merged Merged PR #1061 in commit 4b0e00ae, bumping cryptography to remediate an OSV; two approvals and all reported CI checks passed.
74%
#991 Dependency on an old version of cryptography charmcraft closed Resolved by merged PR #1024 (96f6a183), upgrading cryptography from 3.4.8 to 39.0 and adding required Rust build dependencies for supported architectures.
73%
#1151 build(auto): bump cryptography craft-application merged Merged PR #1151 as commit 4ff7e624, updating the cryptography dependency to resolve an OSV security vulnerability.
73%
#1003 build(auto): bump cryptography craft-providers merged Merged PR #1003 bumps the cryptography dependency to remediate an OSV; both reviews approved and all CI, security, test, lint, and policy checks passed.
72%
#1018 build(deps): bump cryptography from 3.4.8 to 39.0.1 charmcraft closed Closed unmerged; the cryptography 39.0 upgrade landed through merged PR #1024 (commit 96f6a183), including required Rust build dependencies.
71%
#356 build(deps): bump cryptography craft-store merged Merged PR #356 as commit fcbad5c, bumping cryptography to remediate OSV GHSA-p423-j2cm-9vmq.
71%