← Back to issue list

update uv.lock, fix docs

View original Github issue

Metadata

Project
snapcraft
Number
#5436
Type
pull request
State
merged
Author
mr-cal
Labels
—
Created
Updated
Closed

Current evaluation

Merged as 146b215b1: refreshed uv.lock to fix h11 CVE GHSA-vqfr-h8mv-ghfj, removed a leftover confdb import, and fixed local docs build errors.

Resolution: closed resolved

Reason: The PR itself was merged into main as commit 146b215b1 ("chore: drop extra confdb import"), approved by two reviewers. It updated uv.lock to resolve h11 GHSA-vqfr-h8mv-ghfj, deleted a stray confdb import, and corrected docs so they build locally; the maintainer comment (2025-04-25) confirms RTD had been silently ignoring the errors.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [x] Have you followed the [guidelines for contributing](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md)? - [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [x] Have you successfully run `make lint`? - [x] Have you successfully run `make test`? --- * Update the lock file to resolve the [h11 CVE](https://osv.dev/GHSA-vqfr-h8mv-ghfj) * Drop a leftover confdb import * Fix some minor issues with the docs. The docs were building despite [errors on RTD](https://app.readthedocs.com/projects/canonical-snapcraft/builds/2998028/#34333748--198) but failed building locally.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged as 146b215b1: refreshed uv.lock to fix h11 CVE GHSA-vqfr-h8mv-ghfj, removed a leftover confdb import, and fixed local docs build errors.
stealth/space-bunny-alpha — closed resolved Merged as 146b215b1: updated uv.lock for h11 CVE GHSA-vqfr-h8mv-ghfj, removed a leftover confdb import, and fixed documentation build errors.
stealth/space-bunny-alpha — closed resolved Merged lockfile update resolving the h11 CVE, removal of a leftover confdb import, and minor documentation fixes for locally failing builds.
stealth/space-bunny-alpha — closed resolved Merged the uv.lock update for h11 CVE GHSA-vqfr-h8mv-ghfj, removed a leftover confdb import, and fixed local documentation build errors.
qwen/qwen3.6-35b-a3b — — Merged following two approvals. Updated uv.lock to patch the h11 CVE, removed a leftover confdb import, and resolved local documentation build errors. CI checks passed.
qwen3.6-35b-a3b-mtp-q6 — — Merged changes to uv.lock resolve the h11 CVE, remove a leftover confdb import, and fix local documentation build failures previously ignored by Read the Docs.

Update history

No update history recorded yet.

Related work

  • Likely Fixed By: canonical/snapcraft#5356 (confidence 60%)

    Commit de5ab3e29 renamed confdbs to confdb-schema; the 'leftover confdb import' dropped by 146b215b1 originated from that rename.

  • Related To: canonical/snapcraft#5830 (confidence 40%)

    Later routine 'uv lock --upgrade' refresh (46671340e) continuing maintenance of the same lock file.

Related issues

Issue Project State Summary Similarity
#774 build(deps): lock file maintenance for OSV bugs craft-providers merged Merged PR #774 (commit 3a4e72e) updating uv.lock to resolve OSV advisories GHSA-9hjg-9r4m-mvj7, GHSA-48p4-8xcf-vxj5q and GHSA-pq67-6m6q-mj2v; +6/-6 lines in uv.lock only.
76%
#2413 docs: clarify how to use the uv plugin charmcraft merged Merged PR #2413 as commit 2154ccbd, fixing #2238: uv examples now install astral-uv, while migration docs clarify runtime dependencies and uv.lock.
71%
#782 build(deps): update uv lockfile craft-providers merged Merged PR #782 (commit 0a7d389) refreshed uv.lock via `uv lock -U`, bumping dev/docs deps including flake8 7.3.0, mypy 1.17.0, pydantic 2.11.7, lxml 6.0.0 and uvicorn 0.35.0.
71%