build(deps): bump oauthlib from 3.2.0 to 3.2.1
Metadata
Current evaluation
Dependabot PR merged: oauthlib bumped 3.2.0 -> 3.2.1 in snapcraft via commit 9e10fd1b6, pulling in the CVE-2022-36087 fix and non-HTTPS issuer/IPv6 signature fixes.
Resolution: closed resolved
Reason: The PR was approved and merged into main as commit 9e10fd1b6 ("build(deps): bump oauthlib from 3.2.0 to 3.2.1 (#3914)"), updating the requirements files (+2/-2 lines) to pin 3.2.1.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps [oauthlib](https://github.com/oauthlib/oauthlib) from 3.2.0 to 3.2.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/oauthlib/oauthlib/releases">oauthlib's releases</a>.</em></p>
<blockquote>
<h2>3.2.1</h2>
<h2>In short</h2>
<p>OAuth2.0 Provider:</p>
<ul>
<li><a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/issues/803">#803</a> : Metadata endpoint support of non-HTTPS</li>
<li>CVE-2022-36087</li>
</ul>
<p>OAuth1.0:</p>
<ul>
<li><a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/issues/818">#818</a> : Allow IPv6 being parsed by signature</li>
</ul>
<p>General:</p>
<ul>
<li>Improved and fixed documentation warnings.</li>
<li>Cosmetic changes based on isort</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>add missing slots to TokenBase by <a href="https://github.com/ariebovenberg"><code>@ariebovenberg</code></a> in <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/pull/804">oauthlib/oauthlib#804</a></li>
<li>Add CORS support for Refresh Token Grant. by <a href="https://github.com/luhn"><code>@luhn</code></a> in <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/pull/806">oauthlib/oauthlib#806</a></li>
<li>GitHub Action to lint Python code by <a href="https://github.com/cclauss"><code>@cclauss</code></a> in <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/pull/797">oauthlib/oauthlib#797</a></li>
<li>Docs: fix Sphinx warnings for better ReadTheDocs generation by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/pull/807">oauthlib/oauthlib#807</a></li>
<li>Allow non-HTTPS issuer when OAUTHLIB_INSECURE_TRANSPORT. by <a href="https://github.com/luhn"><code>@luhn</code></a> in <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/pull/803">oauthlib/oauthlib#803</a></li>
<li>chore: fix typo in test by <a href="https://github.com/tamanobi"><code>@tamanobi</code></a> in <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/pull/816">oauthlib/oauthlib#816</a></li>
<li>Fix typo in server.rst by <a href="https://github.com/NemanjaT"><code>@NemanjaT</code></a> in <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/pull/819">oauthlib/oauthlib#819</a></li>
<li>Fixed isort imports by <a href="https://github.com/dasm"><code>@dasm</code></a> in <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/pull/820">oauthlib/oauthlib#820</a></li>
<li>docs: Fix a few typos by <a href="https://github.com/timgates42"><code>@timgates42</code></a> in <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/pull/822">oauthlib/oauthlib#822</a></li>
<li>docs: fix typos by <a href="https://github.com/kianmeng"><code>@kianmeng</code></a> in <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/pull/823">oauthlib/oauthlib#823</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/ariebovenberg"><code>@ariebovenberg</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/pull/804">oauthlib/oauthlib#804</a></li>
<li><a href="https://github.com/tamanobi"><code>@tamanobi</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/pull/816">oauthlib/oauthlib#816</a></li>
<li><a href="https://github.com/NemanjaT"><code>@NemanjaT</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/pull/819">oauthlib/oauthlib#819</a></li>
<li><a href="https://github.com/kianmeng"><code>@kianmeng</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/pull/823">oauthlib/oauthlib#823</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/oauthlib/oauthlib/compare/v3.2.0...v3.2.1">https://github.com/oauthlib/oauthlib/compare/v3.2.0...v3.2.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/oauthlib/oauthlib/blob/master/CHANGELOG.rst">oauthlib's changelog</a>.</em></p>
<blockquote>
<h2>3.2.1 (2022-09-09)</h2>
<p>OAuth2.0 Provider:</p>
<ul>
<li><a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/issues/803">#803</a>: Metadata endpoint support of non-HTTPS</li>
<li>CVE-2022-36087</li>
</ul>
<p>OAuth1.0:</p>
<ul>
<li><a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/issues/818">#818</a>: Allow IPv6 being parsed by signature</li>
</ul>
<p>General:</p>
<ul>
<li>Improved and fixed documentation warnings.</li>
<li>Cosmetic changes based on isort</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/oauthlib/oauthlib/commit/88bb1562930a9bd9368bf26120655794d90d9585"><code>88bb156</code></a> Updated date and authors</li>
<li><a href="https://github.com/oauthlib/oauthlib/commit/1a45d9790543673208e603e13a7be4aa4cba7339"><code>1a45d97</code></a> Prepare 3.2.1 release</li>
<li><a href="https://github.com/oauthlib/oauthlib/commit/0adbbe10ed8ef822d1c780987fffc56670ce3f9f"><code>0adbbe1</code></a> docs: fix typos</li>
<li><a href="https://github.com/oauthlib/oauthlib/commit/6569ec3c062be7268f4a17f5a371aa29f1bcfa4a"><code>6569ec3</code></a> docs: Fix a few typos</li>
<li><a href="https://github.com/oauthlib/oauthlib/commit/bdc486e2bc3a188027a4ebec3a3013e64023ce62"><code>bdc486e</code></a> Fixed isort imports</li>
<li><a href="https://github.com/oauthlib/oauthlib/commit/7db45bda96ea6f5fde1186e8fd43d75ce6b95ab5"><code>7db45bd</code></a> Fix typo in server.rst</li>
<li><a href="https://github.com/oauthlib/oauthlib/commit/b14ad85921db2406ecaf5927a8be08a7566c236e"><code>b14ad85</code></a> chore: s/bode_code_verifier/body_code_verifier/g</li>
<li><a href="https://github.com/oauthlib/oauthlib/commit/b123283ba3d41acb3e787fdf68bd5907972b4bad"><code>b123283</code></a> Allow non-HTTPS issuer when OAUTHLIB_INSECURE_TRANSPORT. (<a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/issues/803">#803</a>)</li>
<li><a href="https://github.com/oauthlib/oauthlib/commit/2f887b5a070bf617a471c573ad52fb58251c61af"><code>2f887b5</code></a> Docs: fix Sphinx warnings for better ReadTheDocs generation (<a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/issues/807">#807</a>)</li>
<li><a href="https://github.com/oauthlib/oauthlib/commit/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914"><code>d4bafd9</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/oauthlib/oauthlib/issues/797">#797</a> from cclauss/patch-2</li>
<li>Additional commits viewable in <a href="https://github.com/oauthlib/oauthlib/compare/v3.2.0...v3.2.1">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/snapcore/snapcraft/network/alerts).
</details>
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Dependabot PR merged: oauthlib bumped 3.2.0 -> 3.2.1 in snapcraft via commit 9e10fd1b6, pulling in the CVE-2022-36087 fix and non-HTTPS issuer/IPv6 signature fixes. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/snapcraft#3914 via commit 9e10fd1b6, updating oauthlib from 3.2.0 to 3.2.1 with CVE-2022-36087 and related fixes. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged Dependabot PR updating oauthlib from 3.2.0 to 3.2.1. The update resolves CVE-2022-36087 and includes minor fixes. Approved by one reviewer, passed CI, and merged with minimal changes. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged Dependabot update bumping oauthlib from 3.2.0 to 3.2.1. The release patches CVE-2022-36087, enables non-HTTPS metadata endpoints, and fixes IPv6 signature parsing. Merged without impacting code coverage. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #260 build(deps): raise oauthlib constraint to 4.0.0 | craft-archives | merged | Merged PR #260 raising the oauthlib dependency constraint to >=4.0.0 to resolve OSV security scan failures caused by advisories against version 3.3.1. | |
| #1204 build(deps): constraints for oauthlib and urllib3 | craft-application | merged | Merged PR #1204 added oauthlib and urllib3 dependency constraints, remediating five cited GHSA/OSV vulnerabilities. | |
| #1383 build(deps): constraints for oauthlib and urllib3 | rockcraft | merged | PR #1383 merged to add constraints for oauthlib and urllib3, resolving multiple OSV-reported security vulnerabilities. |