← Back to issue list

build: bump dependencies constrained by rustc version

View original Github issue

Metadata

Project
rockcraft
Number
#1327
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Merged after two approvals. Bumps dependencies constrained by an older rustc version, resolving an OSV vulnerability in cryptography.

Suggested action: —

No scores available.

Issue body

Bumps dependencies that were pinned due to rustc's older version, which also resolves an OSV in cryptography. --- - [ ] I've followed the [contribution guidelines](https://github.com/canonical/rockcraft/blob/main/CONTRIBUTING.md). - [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing. - [ ] I've updated the relevant release notes. --- <sub>Stack created with <a href="https://github.com/github/gh-stack">GitHub Stacks CLI</a> • <a href="https://gh.io/stacks-feedback">Give Feedback 💬</a></sub>

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b — — Merged after two approvals. Bumps dependencies constrained by an older rustc version, resolving an OSV vulnerability in cryptography.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 25
Confidence: 85
needs review Updates pinned dependencies to align with newer rustc versions and resolves a cryptography OSV. PR is approved by one reviewer but has one unresolved comment pending maintainer attention.
qwen/qwen3.6-35b-a3b
Staleness: 10
Complexity: 20
Confidence: 90
needs review Updates dependencies pinned due to older rustc versions, resolving a cryptography OSV. Approved by one reviewer with one unresolved comment, awaiting final review.
qwen/qwen3.6-35b-a3b
Staleness: 10
Complexity: 30
Confidence: 85
needs review Bumps dependencies previously pinned due to older rustc version, resolving a cryptography OSV. Currently approved by one reviewer but has two unresolved comments and no CI checks reported.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 35
Confidence: 90
needs review Updates dependencies pinned for older rustc versions, resolving a cryptography OSV. Currently pending review with one unresolved comment and no CI checks executed.

Update history

Date Change
updated
updated
updated
updated
updated
updated
updated
created

Related issues

Issue Project State Summary Similarity
#418 build: bump cryptography for OSV craft-store merged Merged to bump the cryptography dependency and resolve an OSV vulnerability. Approved by a reviewer, passed CI checks, and modified two files.
78%
#1055 build(deps): bump cryptography craft-application merged Merged after bumping the cryptography dependency to resolve an OSV security vulnerability. Approved by two reviewers and passed all CI checks, including security scans and multi-platform tests.
77%
#1061 build(deps): bump cryptography craft-application merged Merged a dependency update to bump cryptography, resolving an OSV security vulnerability. Approved by two reviewers and passing all CI checks, the change modified one file with 51 additions and 51 deletions.
76%
#423 fix(build): upgrade rust for cryptography imagecraft merged Merged a build fix upgrading the Rust toolchain to resolve cryptography dependencies. Approved by a reviewer, all CI checks passed, and the change modified three files with a net reduction of seven lines.
76%
#1003 build(auto): bump cryptography craft-providers merged Merged to bump the cryptography dependency and resolve an OSV security vulnerability. Approved by two reviewers with all CI checks passing.
74%
#1151 build(auto): bump cryptography craft-application merged Merged a PR by bepri that bumps the cryptography dependency to resolve an OSV. Approved by two reviewers and passing CI, the update addresses a security vulnerability.
74%
#991 Dependency on an old version of cryptography charmcraft closed Fixed via PR #1024, which updated the cryptography dependency after Ubuntu updates provided sufficient Rust versions for all target platforms.
74%
#6307 build(deps): bump cryptography snapcraft merged Merged after approval. Bumps the cryptography dependency to address a CVE. Core CI checks passed despite some integration and publish job failures.
74%
#421 build: bump dependencies for OSVs imagecraft merged Merged after two approvals. Updated cryptography to 50.0.0 and httplib2 to 0.32.0 via uv lock to address OSV vulnerabilities. Test and lint checks passed; snap build failures were bypassed to proceed with the dependency update.
74%
#356 build(deps): bump cryptography craft-store merged Merged to bump the cryptography dependency and resolve OSV vulnerability GHSA-p423-j2cm-9vmq. Approved by two reviewers and passed CI checks, with one Windows test failure noted.
74%