ci: ignore unresolvable OSV
Metadata
Current evaluation
Merged PR #5822 via commit ab206ab45, adding a CI exception for an unresolvable OSV until pip 25.3 so it would not fail every PR.
Resolution: closed resolved
Reason: PR #5822 was approved by two reviewers, passed all listed CI checks, and merged as commit ab206ab45. The merge suppresses the recurring OSV scan failure pending pip 25.3.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [ ] Have you followed the [guidelines for contributing](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md)?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint`?
- [ ] Have you successfully run `make test`?
---
This OSV has been failing on every PR, and won't be fixed until pip 25.3, which isn't scheduled for release until at least Oct. 30th
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #5822 via commit ab206ab45, adding a CI exception for an unresolvable OSV until pip 25.3 so it would not fail every PR. | |
| stealth/space-bunny-alpha | — | closed resolved | PR #5822 (commit ab206ab45) merged, adding an IgnoredVulns entry to osv-scanner.toml for a CVE that only resolves once pip 25.3 ships, unblocking CI. pip was later bumped to 25.3 in #5871. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #5822 (commit ab206ab45) to suppress an unresolvable OSV scan finding until pip 25.3 is released; all CI checks passed. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #5822 (commit ab206ab4), ignoring an unresolvable OSV until pip 25.3 is available so security-scan CI no longer blocks every PR. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #5822 as commit ab206ab45, making OSV scanning ignore the unresolved vulnerability blocking CI until pip 25.3 is available. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a PR to ignore an unresolvable OSV scan failure in CI. The vulnerability cannot be resolved until pip 25.3 releases on October 30th. Approved by two reviewers and passed all CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a CI update to ignore an unresolvable OSV check failing on every PR. The vulnerability requires a pip 25.3 fix scheduled for late October. The change bypasses the failing check until upstream resolves it. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #247 ci: ignore unfixable OSVs | craft-platforms | merged | PR #247 merged into main, updating CI to ignore OSV findings with no available fix. | |
| #2773 ci: ignore unfixable OSVs | charmcraft | merged | Merged as ca4a9950, updating CI to ignore unfixable OSVs; #2773 replaced the unmerged #2765 using the starbase #573 fix pattern. |