build(deps): bump requests to 2.32.4
Metadata
Current evaluation
Merged PR #5553 as commit 3cfe7a1a3, upgrading requests to 2.32.4 and setting it as the minimum version to mitigate a CVE.
Resolution: closed resolved
Reason: The approved dependency update was merged in PR #5553 as commit 3cfe7a1a3.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [x] Have you followed the [guidelines for contributing](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md)?
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint`?
- [ ] Have you successfully run `make test`?
---
Bump and set a minimum version of requests for a CVE.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #5553 as commit 3cfe7a1a3, upgrading requests to 2.32.4 and setting it as the minimum version to mitigate a CVE. | |
| stealth/space-bunny-alpha | — | closed resolved | PR #5553 by maintainer mr-cal was merged as commit 3cfe7a1a3, bumping requests to 2.32.4 and setting it as the minimum version to mitigate a CVE. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #5553 as commit 3cfe7a1a3, upgrading requests to 2.32.4 and setting it as the minimum version to mitigate a CVE. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #5553 as 3cfe7a1a3, raising requests to 2.32.4 and enforcing that minimum to address a CVE. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a dependency update bumping requests to 2.32.4 to patch a security vulnerability. Approved by two reviewers and passed core CI checks before integration. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged to address a CVE by updating the requests dependency to version 2.32.4 and setting it as the minimum required version. The change was successfully integrated into the main branch. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #6127 build(deps): bump requests from 2.32.5 to 2.33.0 | snapcraft | merged | Merged #6127 as fce681014, updating requests from 2.32.5 to 2.33.0, including upstream hardening for CVE-2026-25645. | |
| #5064 build(deps): update dependency requests to v2.32.2 [security] (main) | snapcraft | merged | Merged PR #5064 as ec4f9b16f, updating requests from 2.31.0 to 2.32.2 to remediate CVE-2024-35195. | |
| #1516 build(deps): update dependency requests to v2.33.0 [security] (main) | craft-parts | merged | Merged PR #1516 as commit 3d099307, upgrading requests from 2.32.5 to 2.33.0 to remediate CVE-2026-25645. | |
| #122 build(deps): bump requests from 2.32.5 to 2.33.0 | starflow | merged | Updated requests from 2.32.5 to 2.33.0; PR #122 was merged as commit cf593d0 after two approvals and with all CI checks passing. | |
| #505 build(deps): unpin requests, release 4.2.6 | craft-application | merged | Merged in PR #505 (commit 8236c3d3) and released as 4.2.6, removing the requests<2.32.0 constraint to address CVE-2024-35195. | |
| #4813 build(deps): bump requests from 2.31.0 to 2.32.0 | snapcraft | closed | Dependabot's requests 2.32.0 bump was closed unmerged; #5064 later advanced requests from 2.31.0 to 2.32.2 in commit ec4f9b16f. | |
| #5549 build(deps): update dependency requests to v2.32.4 [security] (main) | snapcraft | closed | Renovate PR to bump requests 2.32.3 -> 2.32.4 (CVE-2024-47081) on main was closed unmerged; the fix shipped via hotfix PR #5551 (fc81a5369) and reached main in #5557 (3a614faa3). | |
| #106 build(deps): bump requests from 2.32.5 to 2.33.0 | debcraft | merged | Merged in debcraft#106 via commit 1aae105, updating requests from 2.32.5 to 2.33.0 in the lockfile; all CI checks passed. | |
| #1110 build(deps): bump requests from 2.28.2 to 2.31.0 | charmcraft | merged | Dependabot PR #1110 merged as commit 10d6d55a, bumping requests 2.28.2 → 2.31.0 in requirements.txt files, picking up the CVE-2023-32681 Proxy-Authorization leak fix. | |
| #4171 build(deps): bump requests from 2.30.0 to 2.31.0 | snapcraft | merged | Merged Dependabot PR #4171 bumping requests 2.30.0→2.31.0 to fix CVE-2023-32681 (Proxy-Authorization header leakage on HTTPS redirects); landed in commit a9f538468. |