chore(deps): update dependency pip to v23 [security] - autoclosed
Metadata
Current evaluation
Renovate PR #4773 was autoclosed without merge; Dependabot PR #4776 superseded it by merging the same pip 22.0.2→23.3 docs upgrade in commit 99387d281.
Resolution: closed superseded
Reason: The equivalent update was merged through Dependabot PR #4776 with two approvals in commit 99387d281. PR #4773 was therefore autoclosed unmerged after the superseding change landed.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [pip](https://togithub.com/pypa/pip) ([changelog](https://pip.pypa.io/en/stable/news/)) | `==22.0.2` -> `==23.3` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2023-5752](https://nvd.nist.gov/vuln/detail/CVE-2023-5752)
When installing a package from a Mercurial VCS URL, e.g. `pip install hg+...`, with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the `hg clone` call (e.g. `--config`). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
---
### Release Notes
<details>
<summary>pypa/pip (pip)</summary>
### [`v23.3`](https://togithub.com/pypa/pip/compare/23.2.1...23.3)
[Compare Source](https://togithub.com/pypa/pip/compare/23.2.1...23.3)
### [`v23.2.1`](https://togithub.com/pypa/pip/compare/23.2...23.2.1)
[Compare Source](https://togithub.com/pypa/pip/compare/23.2...23.2.1)
### [`v23.2`](https://togithub.com/pypa/pip/compare/23.1.2...23.2)
[Compare Source](https://togithub.com/pypa/pip/compare/23.1.2...23.2)
### [`v23.1.2`](https://togithub.com/pypa/pip/compare/23.1.1...23.1.2)
[Compare Source](https://togithub.com/pypa/pip/compare/23.1.1...23.1.2)
### [`v23.1.1`](https://togithub.com/pypa/pip/compare/23.1...23.1.1)
[Compare Source](https://togithub.com/pypa/pip/compare/23.1...23.1.1)
### [`v23.1`](https://togithub.com/pypa/pip/compare/23.0.1...23.1)
[Compare Source](https://togithub.com/pypa/pip/compare/23.0.1...23.1)
### [`v23.0.1`](https://togithub.com/pypa/pip/compare/23.0...23.0.1)
[Compare Source](https://togithub.com/pypa/pip/compare/23.0...23.0.1)
### [`v23.0`](https://togithub.com/pypa/pip/compare/22.3.1...23.0)
[Compare Source](https://togithub.com/pypa/pip/compare/22.3.1...23.0)
### [`v22.3.1`](https://togithub.com/pypa/pip/compare/22.3...22.3.1)
[Compare Source](https://togithub.com/pypa/pip/compare/22.3...22.3.1)
### [`v22.3`](https://togithub.com/pypa/pip/compare/22.2.2...22.3)
[Compare Source](https://togithub.com/pypa/pip/compare/22.2.2...22.3)
### [`v22.2.2`](https://togithub.com/pypa/pip/compare/22.2.1...22.2.2)
[Compare Source](https://togithub.com/pypa/pip/compare/22.2.1...22.2.2)
### [`v22.2.1`](https://togithub.com/pypa/pip/compare/22.2...22.2.1)
[Compare Source](https://togithub.com/pypa/pip/compare/22.2...22.2.1)
### [`v22.2`](https://togithub.com/pypa/pip/compare/22.1.2...22.2)
[Compare Source](https://togithub.com/pypa/pip/compare/22.1.2...22.2)
### [`v22.1.2`](https://togithub.com/pypa/pip/compare/22.1.1...22.1.2)
[Compare Source](https://togithub.com/pypa/pip/compare/22.1.1...22.1.2)
### [`v22.1.1`](https://togithub.com/pypa/pip/compare/22.1...22.1.1)
[Compare Source](https://togithub.com/pypa/pip/compare/22.1...22.1.1)
### [`v22.1`](https://togithub.com/pypa/pip/compare/22.0.4...22.1)
[Compare Source](https://togithub.com/pypa/pip/compare/22.0.4...22.1)
### [`v22.0.4`](https://togithub.com/pypa/pip/compare/22.0.3...22.0.4)
[Compare Source](https://togithub.com/pypa/pip/compare/22.0.3...22.0.4)
### [`v22.0.3`](https://togithub.com/pypa/pip/compare/22.0.2...22.0.3)
[Compare Source](https://togithub.com/pypa/pip/compare/22.0.2...22.0.3)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC.
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zMjEuMiIsInVwZGF0ZWRJblZlciI6IjM3LjMyMS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Renovate PR #4773 was autoclosed without merge; Dependabot PR #4776 superseded it by merging the same pip 22.0.2→23.3 docs upgrade in commit 99387d281. | |
| stealth/space-bunny-alpha | — | closed superseded | Renovate's pip 23.3 security update was autoclosed without merge; the equivalent docs dependency update landed via #4776 (commit 99387d281). | |
| stealth/space-bunny-alpha | — | closed superseded | Renovate's pip 22.0.2-to-23.3 docs update was autoclosed; equivalent PR canonical/snapcraft#4776 was merged as commit 99387d281. | |
| stealth/space-bunny-alpha | — | closed superseded | Autoclosed unmerged; the same pip 22.0.2 to 23.3 security update was merged in #4776 via commit 99387d281. | |
| stealth/space-bunny-alpha | — | closed superseded | Autoclosed without merging; the equivalent pip 22.0.2 to 23.3 docs upgrade was merged in #4776 (commit 99387d281). | |
| qwen/qwen3.6-35b-a3b | — | — | Automatically closed without merging. The Renovate bot dependency update upgrading pip to v23.3 to address CVE-2023-5752 was abandoned, likely due to staleness or repository configuration. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate bot opened a dependency update for pip to v23.3 to address CVE-2023-5752. The pull request was autoclosed due to inactivity without review or merge. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/snapcraft#4776
(confidence 100%)
Merged the identical pip 22.0.2 to 23.3 upgrade in commit 99387d281.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4774 chore(deps): update dependency setuptools to v65 [security] - autoclosed | snapcraft | closed | Renovate's setuptools 65.5.1 security update was autoclosed without merge after inactivity. Dependabot merged the same docs dependency bump in #4775 via d83f1ddb8. | |
| #1111 chore(deps): update dependency requests to v2.31.0 [security] - abandoned | charmcraft | closed | Renovate's requests 2.28.2 -> 2.31.0 security PR was closed empty (0 files) after autoclosing was skipped due to a modified branch; the identical CVE-2023-32681 upgrade landed via merged Dependabot PR #1110 (10d6d55a). | |
| #68 chore(deps): update dependency pydantic_core to v2.27.2 - autoclosed | imagecraft | closed | Renovate's pydantic_core 2.27.2 bump in #68 was autoclosed unmerged after inactivity; no resolving commit or replacement PR was identified. | |
| #986 chore(deps): update dependency packaging to v23 | charmcraft | merged | Merged PR #986, updating packaging from 22.0 to 23.0 after maintainer approval; tox, pytest, and snap-helpers were reported working with it. | |
| #61 chore(deps): update dependency requests to v2.32.2 [security] - autoclosed | imagecraft | closed | Renovate's requests 2.32.2 update was autoclosed unmerged; requests was later updated to 2.33.0 by merged PR #308 (commit cbca1c1). | |
| #4812 chore(deps): update dependency requests to v2.32.0 [security] - autoclosed | snapcraft | closed | Renovate PR #4812 was autoclosed unmerged after 856 days; the security upgrade was later delivered by #5064 (commit ec4f9b16f), raising requests from 2.31.0 to 2.32.2. | |
| #28 chore(deps): update dependency pydantic to v2 - autoclosed | craft-grammar | closed | Renovate's Pydantic 2 bump was closed unmerged and superseded by dedicated migration PR #33, which landed in commit 5e225fb. | |
| #1689 chore(deps): update dependency requests to v2.32.0 [security] - autoclosed | charmcraft | closed | Renovate’s requests 2.32.0 security update was autoclosed unmerged after 864 days, with no reviews, comments, or CI checks. | |
| #4902 chore(deps): update dependency zipp to v3.19.1 [security] - autoclosed | snapcraft | closed | Renovate's zipp 3.17.0/3.18.1 -> 3.19.1 security bump (CVE-2024-5569) was autoclosed because Dependabot PR #4901 merged the identical update in commit de7f1d5ad. | |
| #1181 chore(deps): update dependency certifi to v2023.7.22 [security] - autoclosed | charmcraft | closed | Autoclosed after the same certifi 2023.7.22 security update was merged via Dependabot PR #1182 in commit 8350a166. |