chore(deps): update dependency certifi to v2024 [security] - autoclosed
Metadata
Current evaluation
Autoclosed unmerged as redundant; certifi 2024.7.4 landed via #4896 (a4e2895da), with the matching docs update later merged in #4903.
Resolution: closed superseded
Reason: The Renovate branch was not merged because the certifi update had already landed in commit a4e2895da through canonical/snapcraft#4896. The corresponding docs dependency update was also merged separately in canonical/snapcraft#4903.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [certifi](https://togithub.com/certifi/python-certifi) | `==2023.7.22` -> `==2024.7.4` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-39689](https://togithub.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc)
Certifi 2024.07.04 removes root certificates from "GLOBALTRUST" from the root store. These are in the process of being removed from Mozilla's trust store.
GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues". Conclusions of Mozilla's investigation can be found [here]( https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI).
---
### Release Notes
<details>
<summary>certifi/python-certifi (certifi)</summary>
### [`v2024.7.4`](https://togithub.com/certifi/python-certifi/compare/2024.06.02...2024.07.04)
[Compare Source](https://togithub.com/certifi/python-certifi/compare/2024.06.02...2024.07.04)
### [`v2024.6.2`](https://togithub.com/certifi/python-certifi/compare/2024.02.02...2024.06.02)
[Compare Source](https://togithub.com/certifi/python-certifi/compare/2024.02.02...2024.06.02)
### [`v2024.2.2`](https://togithub.com/certifi/python-certifi/compare/2023.11.17...2024.02.02)
[Compare Source](https://togithub.com/certifi/python-certifi/compare/2023.11.17...2024.02.02)
### [`v2023.11.17`](https://togithub.com/certifi/python-certifi/compare/2023.07.22...2023.11.17)
[Compare Source](https://togithub.com/certifi/python-certifi/compare/2023.07.22...2023.11.17)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC.
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MjEuOSIsInVwZGF0ZWRJblZlciI6IjM3LjQyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Autoclosed unmerged as redundant; certifi 2024.7.4 landed via #4896 (a4e2895da), with the matching docs update later merged in #4903. | |
| stealth/space-bunny-alpha | — | closed superseded | Autoclosed unmerged as redundant after certifi 2024.7.4 landed via canonical/snapcraft#4896 in commit a4e2895da. | |
| stealth/space-bunny-alpha | — | closed superseded | Renovate's certifi 2024.7.4 bump was autoclosed unmerged: Dependabot PR #4896 (commit a4e2895da) had already landed certifi 2024.7.4 in main, and #4903 did the docs pin. | |
| stealth/space-bunny-alpha | — | closed superseded | Renovate's certifi 2024.7.4 security bump was closed unmerged once the identical update landed via Dependabot PR #4896 (commit a4e2895da); a later bump to 2024.12.14 merged in #5376. | |
| stealth/space-bunny-alpha | — | closed superseded | Renovate PR bumping certifi 2023.7.22 -> 2024.7.4 was auto-closed unmerged after Dependabot PR #4896 already landed the same version in commit a4e2895da. | |
| stealth/space-bunny-alpha | — | closed superseded | Autoclosed unmerged after certifi 2024.7.4 landed via Dependabot PR #4896 (a4e2895da), making the Renovate update redundant. | |
| qwen/qwen3.6-35b-a3b | — | — | The certifi v2024.7.4 security update was automatically closed without merging. Renovate bot generated the dependency change, but it was abandoned due to inactivity, leaving the repository on the previous version. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | A Renovate bot update to certifi v2024.7.4 was autoclosed. Automerge was disabled, and the branch was automatically closed due to staleness or being superseded by a newer dependency update. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/snapcraft#4896
(confidence 99%)
Merged certifi 2024.7.4 in commit a4e2895da before this PR was autoclosed as redundant.
-
Superseded By:
canonical/snapcraft#4903
(confidence 96%)
Merged commit ccbc7b3d9, updating certifi from 2023.7.22 to 2024.7.4 in the Sphinx docs environment.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1181 chore(deps): update dependency certifi to v2023.7.22 [security] - autoclosed | charmcraft | closed | Autoclosed after the same certifi 2023.7.22 security update was merged via Dependabot PR #1182 in commit 8350a166. | |
| #1720 chore(deps): update dependency certifi to v2024.7.4 [security] | charmcraft | merged | Renovate security bump of certifi from 2024.6.2 to 2024.7.4 merged via commit 38351514, addressing CVE-2024-39689 (GLOBALTRUST root removal). Later superseded by #1936 bumping to v2024.8.30. | |
| #1695 chore(deps): update dependency certifi to v2024.6.2 | charmcraft | merged | Renovate dependency bump PR: certifi 2024.2.2 → 2024.6.2 merged into main via commit 7460a6fe (+2/-2 lines in 2 requirements files), approved by 2 reviewers. | |
| #4856 chore(deps): update dependency requests to v2.32.2 [security] - autoclosed | snapcraft | closed | PR #4856 was autoclosed without merge; the same requests 2.32.2 security update later landed via #5064 (ec4f9b16f). | |
| #45 Update dependency certifi to v2024.7.4 [SECURITY] - autoclosed | imagecraft | closed | Renovate's certifi 2024.7.4 security update was autoclosed without merging after prolonged inactivity. | |
| #1689 chore(deps): update dependency requests to v2.32.0 [security] - autoclosed | charmcraft | closed | Renovate’s requests 2.32.0 security update was autoclosed unmerged after 864 days, with no reviews, comments, or CI checks. | |
| #4812 chore(deps): update dependency requests to v2.32.0 [security] - autoclosed | snapcraft | closed | Renovate PR #4812 was autoclosed unmerged after 856 days; the security upgrade was later delivered by #5064 (commit ec4f9b16f), raising requests from 2.31.0 to 2.32.2. | |
| #1111 chore(deps): update dependency requests to v2.31.0 [security] - abandoned | charmcraft | closed | Renovate's requests 2.28.2 -> 2.31.0 security PR was closed empty (0 files) after autoclosing was skipped due to a modified branch; the identical CVE-2023-32681 upgrade landed via merged Dependabot PR #1110 (10d6d55a). | |
| #1057 chore(deps): update dependency cryptography [security] - autoclosed | charmcraft | closed | Renovate’s cryptography 3.4.8→39/40 update was autoclosed unmerged; PR #1119 (commit 42365b41) later merged 40.0.2→41.0.0, superseding it. | |
| #61 chore(deps): update dependency requests to v2.32.2 [security] - autoclosed | imagecraft | closed | Renovate's requests 2.32.2 update was autoclosed unmerged; requests was later updated to 2.33.0 by merged PR #308 (commit cbca1c1). |