build(deps): switch to requests-unixsocket2, release 8.4.2
Metadata
Current evaluation
Merged in #5096, switching to requests-unixsocket2 and adding 8.4.2/7.5.7 release notes to remediate CVE-2024-35195 and address #5079.
Resolution: closed resolved
Reason: PR #5096 was approved and merged, replacing requests-unixsocket and documenting the security fix in the 8.4.2 and 7.5.7 release notes. The 8.4.2 release branch was subsequently merged into main by #5101 (82fa41a2c).
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [x] Have you followed the [guidelines for contributing](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md)?
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `tox run -m lint`?
- [ ] Have you successfully run `tox run -e test-py310`? (supported versions: `py39`, `py310`, `py311`, `py312`)
-----
Adds 8.4.2 release notes for next week.
Also adds 7.5.7 release notes, as we don't have a better solution for old releases at the moment.
Fixes [CVE-2024-35195](https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56)
Fixes #5079
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged in #5096, switching to requests-unixsocket2 and adding 8.4.2/7.5.7 release notes to remediate CVE-2024-35195 and address #5079. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #5096, switching to requests-unixsocket2 and adding Snapcraft 8.4.2 and 7.5.7 release notes to address CVE-2024-35195 and #5079. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged dependency update switching to requests-unixsocket2 and publishing release 8.4.2. Added 7.5.7 release notes. Resolved CVE-2024-35195 and issue #5079. Approved by two reviewers with passing CI. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged, updating the dependency to requests-unixsocket2 and adding release notes for versions 8.4.2 and 7.5.7. Resolves CVE-2024-35195 and issue #5079. |
Update history
No update history recorded yet.
Related work
-
Related To:
snapcraft#5079
(confidence 100%)
PR #5096 explicitly states that it fixes this Docker Unix-socket failure, although the issue remains open.
-
Related To:
snapcraft#5101
(confidence 98%)
Merged the 8.4.2 release branch into main in commit 82fa41a2c.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #663 build(deps): replace requests-unixsocket with requests-unixsocket2 | craft-providers | merged | Merged PR #663, replacing requests-unixsocket with requests-unixsocket2; commit fe786e8 updated the dependency. | |
| #853 build(deps): replace requests-unixsocket with requests-unixsocket2 | craft-parts | merged | Merged PR #853, replacing requests-unixsocket with requests-unixsocket2; the dependency change shipped in craft-parts 1.19.8, 1.25.3, and 2.1.2. | |
| #505 build(deps): unpin requests, release 4.2.6 | craft-application | merged | Merged in PR #505 (commit 8236c3d3) and released as 4.2.6, removing the requests<2.32.0 constraint to address CVE-2024-35195. | |
| #852 replace requests-unixsocket with requests-unixsocket2 | craft-parts | closed | Replaced requests-unixsocket with requests-unixsocket2; commits cf0f7286, 73e64b9e, and 441584e7 shipped the migration in releases 1.19.8, 1.25.3, and 2.1.2. | |
| #5066 build(deps): update dependency requests to v2.32.2 [security] (hotfix/8.3) | snapcraft | closed | Renovate security bump of requests 2.31.0->2.32.2 for hotfix/8.3 (CVE-2024-35195) was closed unmerged after ~724 days of inactivity; same update merged for main (#5064), hotfix/7.5 (#5065) and hotfix/8.4 (#5067). | |
| #5064 build(deps): update dependency requests to v2.32.2 [security] (main) | snapcraft | merged | Merged PR #5064 as ec4f9b16f, updating requests from 2.31.0 to 2.32.2 to remediate CVE-2024-35195. | |
| #667 build(deps): replace requests-unixsocket with requests-unixsocket2 | craft-providers | merged | Merged dependency swap from requests-unixsocket to requests-unixsocket2, backporting craft-providers#663 to the 1.20 maintenance branch (commit d3d0f89) used by Snapcraft 7 and Charmcraft 2; maintainer approved dropping interim bases. | |
| #649 build(deps): update dependency requests to <2.33 | craft-providers | closed | Closed unmerged because requests 2.32 was incompatible with requests-unixsocket; Renovate ignored the <2.33 update pending a newer release. |