build(deps): bump urllib3 from 1.26.17 to 1.26.18
Metadata
Current evaluation
Dependabot PR #4404 bumping urllib3 1.26.17→1.26.18 (GHSA-g4mx-q9vg-27p4 HTTP 303 redirect fix) was approved by 2 reviewers and merged into main as commit bbd0a4ecd; sibling PR #4405 did the same for docs/.sphinx.
Resolution: closed resolved
Reason: The PR itself was merged into main, recorded as commit bbd0a4ecd ("build(deps): bump urllib3 from 1.26.17 to 1.26.18 (#4404)"), updating urllib3 to 1.26.18 and pulling in the GHSA-g4mx-q9vg-27p4 security fix. A parallel docs-only bump landed as c3295134f (#4405).
Evaluated by: mr-cal-bot
Issue body
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Dependabot PR #4404 bumping urllib3 1.26.17→1.26.18 (GHSA-g4mx-q9vg-27p4 HTTP 303 redirect fix) was approved by 2 reviewers and merged into main as commit bbd0a4ecd; sibling PR #4405 did the same for docs/.sphinx. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #4404 updated urllib3 from 1.26.17 to 1.26.18, incorporating the HTTP 303 redirect security fix (GHSA-g4mx-q9vg-27p4). | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a Dependabot update bumping urllib3 from 1.26.17 to 1.26.18. Approved by two reviewers and passing CI, the branch was recreated to resolve a rebase conflict before final merge. The update improves HTTP 303 redirect handling. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged Dependabot update upgrading urllib3 from 1.26.17 to 1.26.18 to patch an HTTP 303 redirect security flaw. The branch was recreated and merged into main. |
Update history
No update history recorded yet.
Related work
-
Related To:
snapcore/snapcraft#4405
(confidence 90%)
Companion Dependabot PR bumping urllib3 1.26.17→1.26.18 in docs/.sphinx, merged as commit c3295134f.
-
Related To:
snapcore/snapcraft#4859
(confidence 80%)
Later follow-up bump of urllib3 1.26.18→1.26.19 (commit 60d370276), superseding this pin.
-
Related To:
snapcore/snapcraft#4411
(confidence 40%)
Spread test failure mentioned in a PR comment; unrelated root cause, closed later by maintainer @mr-cal.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4405 build(deps): bump urllib3 from 1.26.17 to 1.26.18 in /docs/.sphinx | snapcraft | merged | Merged PR #4405 updated the Sphinx docs dependency urllib3 from 1.26.17 to 1.26.18, incorporating the HTTP 303 redirect security fix. | |
| #4859 build(deps): bump urllib3 from 1.26.18 to 1.26.19 | snapcraft | merged | Dependabot PR merged, bumping urllib3 1.26.18 to 1.26.19 in the main requirements (commit 60d370276, PR #4859); approved by 2 reviewers with no unresolved comments. | |
| #4887 build(deps): bump urllib3 from 1.26.18 to 1.26.19 in /docs/.sphinx | snapcraft | merged | Merged PR #4887 in commit 4f3c19d44, updating urllib3 from 1.26.18 to 1.26.19 for the Sphinx documentation environment. | |
| #4387 build(deps): bump urllib3 from 1.26.13 to 1.26.17 in /docs/.sphinx | snapcraft | merged | Merged into main via commit 9a0dd7227, upgrading urllib3 in the Sphinx docs environment from 1.26.13 to 1.26.17. | |
| #5562 build(deps): bump urllib3 from 1.26.20 to 2.5.0 in /docs/.sphinx | snapcraft | closed | Dependabot's urllib3 update was closed unmerged because the target requirements file was unused; merged PR #5598 later removed it in f42ae1ee4. | |
| #1307 build(deps): bump urllib3 from 1.26.16 to 1.26.17 | charmcraft | closed | Dependabot closed #1307 unmerged as obsolete: the identical urllib3 1.26.16→1.26.17 security bump had already landed via #1308 (commit 51323d0f). | |
| #3532 build(deps): bump urllib3 from 1.26.4 to 1.26.5 | snapcraft | merged | Merged PR #3532 via commit 6ddfcad68, updating urllib3 from 1.26.4 to 1.26.5 in two files. | |
| #4388 build(deps): bump urllib3 from 1.26.15 to 1.26.17 | snapcraft | merged | Merged PR #4388 upgraded urllib3 from 1.26.15 to 1.26.17 in commit 8b7202506, adding redirect Cookie stripping and pool thread-safety fixes. | |
| #1336 build(deps): bump urllib3 from 1.26.17 to 1.26.18 | charmcraft | closed | Superseded unmerged by commit 25d6160d, which updated urllib3 to 1.26.18; Dependabot closed #1336 as already up to date. | |
| #344 build(deps): bump urllib3 | imagecraft | merged | Merged urllib3 dependency bump (uv.lock, +3/-3) fixing an OSV advisory; commit 033c84e landed PR #344 with 2 approvals and all CI checks green. |