← Back to issue list

build(deps): constraints for oauthlib and urllib3

View original Github issue

Metadata

Project
rockcraft
Number
#1383
Type
pull request
State
merged
Author
tigarmo
Labels
—
Created
Updated
Closed

Current evaluation

PR #1383 merged to add constraints for oauthlib and urllib3, resolving multiple OSV-reported security vulnerabilities.

Resolution: closed resolved

Reason: The pull request was merged, updating dependency constraints for oauthlib and urllib3 to resolve several OSV security advisories.

Evaluated by: mr-cal-bot

No scores available.

Issue body

These address the following vulnerabilities: - https://osv.dev/GHSA-hj66-6f7g-4r5v - https://osv.dev/GHSA-xpv3-w29h-x7cv - https://osv.dev/GHSA-8988-9cw3-xx77 - https://osv.dev/GHSA-gh4c-6fx4-qh6g - https://osv.dev/GHSA-vxq7-64xx-v4gw --- - [ ] I've followed the [contribution guidelines](https://github.com/canonical/rockcraft/blob/main/CONTRIBUTING.md). - [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing. - [ ] I've updated the relevant release notes.

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b — closed resolved PR #1383 merged to add constraints for oauthlib and urllib3, resolving multiple OSV-reported security vulnerabilities.
~deepseek/deepseek-pro-latest
Impact: 50
Quick Win: 20
Complexity: 20
Confidence: 75
Actionability: 50
keep open Raises oauthlib and urllib3 dependency constraints to remediate five GHSA/OSV vulnerabilities; approved by two reviewers but build and source-spread-tests CI failing.
~deepseek/deepseek-pro-latest
Impact: 50
Quick Win: 21
Complexity: 15
Confidence: 75
Actionability: 50
keep open Raises oauthlib and urllib3 dependency constraints to remediate five GHSA/OSV vulnerabilities; approved but build and source-spread-tests CI failing.
~deepseek/deepseek-pro-latest
Impact: 50
Quick Win: 12
Complexity: 30
Confidence: 70
Actionability: 35
keep open Raises oauthlib and urllib3 dependency constraints to remediate five GHSA/OSV vulnerabilities. CI failing in build and source-spread-tests; no reviews yet.
~deepseek/deepseek-pro-latest
Impact: 50
Quick Win: 29
Complexity: 10
Confidence: 80
Actionability: 65
needs review Bumps oauthlib constraint to >=4.0.0 and urllib3 to >=2.8 in pyproject.toml/uv.lock to remediate five GHSA vulnerabilities. Most CI green; source-spread-tests failing.
~deepseek/deepseek-pro-latest
Impact: 50
Quick Win: 30
Complexity: 20
Confidence: 85
Actionability: 75
needs review Bumps oauthlib and urllib3 uv constraints to remediate five GHSA/OSV vulnerabilities; CI mostly passing, pending OSV-scanner/build.
~deepseek/deepseek-pro-latest
Impact: 50
Quick Win: 36
Complexity: 10
Confidence: 85
Actionability: 80
needs review Bumps oauthlib constraint to >=4.0.0 and urllib3 to >=2.8 in pyproject.toml and uv.lock, addressing five OSV/GHSA vulnerabilities. CI passing, awaiting review.
~deepseek/deepseek-pro-latest
Impact: 50
Quick Win: 36
Complexity: 10
Confidence: 88
Actionability: 80
needs review Bumps oauthlib to >=4.0.0 and urllib3 to >=2.8 in pyproject.toml and uv.lock, addressing five OSV/GHSA vulnerabilities. Open, no reviewers; CI partially pending, no failures.

Update history

Date Change
merged
updated
updated
updated
updated
updated
created

Related issues

Issue Project State Summary Similarity
#1204 build(deps): constraints for oauthlib and urllib3 craft-application merged Merged PR #1204 added oauthlib and urllib3 dependency constraints, remediating five cited GHSA/OSV vulnerabilities.
93%
#267 build(deps): raise oauthlib and urllib3 constraints craft-archives closed PR #267 was closed without merging due to failing CI checks. It replaced #260 to update oauthlib and urllib3 constraints.
87%
#204 build(deps): raise oauthlib constraint floor for OSV findings debcraft merged Fixed OSV security findings by raising oauthlib>=4.0.0 and urllib3>=2.8.0 constraints in tool.uv.constraint-dependencies. Merged with passing CI checks.
81%
#260 build(deps): raise oauthlib constraint to 4.0.0 craft-archives merged Merged PR #260 raising the oauthlib dependency constraint to >=4.0.0 to resolve OSV security scan failures caused by advisories against version 3.3.1.
78%
#909 build(deps): bump cryptography and urllib3 craft-providers merged Merged cryptography and urllib3 dependency updates in PR #909 to resolve OSV findings; landed as commit 922e691.
77%
#1430 build: update urllib3 craft-parts merged Merged PR #1430 (commit 1b60eff6) updated urllib3 to resolve an OSV vulnerability.
75%
#102 build: fix urllib3 osv craft-grammar merged Merged PR #102 in commit c936b0f, fixing an OSV workflow error related to urllib3; all lint, test, policy, and security checks passed.
75%
#5912 build: bump urllib3 snapcraft merged Merged PR #5912 (commit 99a19a09a) bumped urllib3 to resolve an OSV vulnerability.
74%
#63 build: bump urllib3 debcraft merged Merged PR #63 updated urllib3 to resolve an OSV vulnerability; commit 5f83429 passed all CI checks.
74%
#220 build(deps): update urllib3 to 2.8.0 craft-grammar merged Merged PR #220 updating urllib3 from 2.7.0 to 2.8.0 to address three OSV security vulnerabilities (PYSEC-2026-4175/4176/4177).
74%