ci: ignore unresolvable OSV
Metadata
Current evaluation
Merged a PR to ignore an unresolvable OSV scan failure in CI. The vulnerability cannot be resolved until pip 25.3 releases on October 30th. Approved by two reviewers and passed all CI checks.
Suggested action: —
No scores available.
Issue body
- [ ] Have you followed the [guidelines for contributing](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md)?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint`?
- [ ] Have you successfully run `make test`?
---
This OSV has been failing on every PR, and won't be fixed until pip 25.3, which isn't scheduled for release until at least Oct. 30th
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged a PR to ignore an unresolvable OSV scan failure in CI. The vulnerability cannot be resolved until pip 25.3 releases on October 30th. Approved by two reviewers and passed all CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a CI update to ignore an unresolvable OSV check failing on every PR. The vulnerability requires a pip 25.3 fix scheduled for late October. The change bypasses the failing check until upstream resolves it. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a CI update to bypass a failing OSV security check. The scan blocked all pull requests and remains unfixable until pip 25.3 releases on October 30th. The change unblocks development by ignoring the unresolvable vulnerability. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #247 ci: ignore unfixable OSVs | craft-platforms | merged | Merged a pull request adding a single configuration line to CI to ignore unfixable OSV scanner findings. The change passed all CI checks, received one approval, and was successfully integrated into the main branch. | |
| #181 CI: OSV-scanner security-scan check persistently failing on main | debcraft | closed | Fixed by bumping vulnerable transitive dependencies to patch reported CVEs, resolving the persistent OSV-scanner CI failure on main. | |
| #2773 ci: ignore unfixable OSVs | charmcraft | merged | Merged CI configuration to ignore unfixable OSV warnings, replacing #2765 with the starbase #573 pattern. Approved by two reviewers and merged despite failing snap-store-tests and spread-select checks. | |
| #143 build(deps): resolve OSVs | debcraft | merged | Resolved OSV security vulnerabilities by updating idna to v3.18 and urllib3 to v2.7.0. Approved by a reviewer, passed all CI checks, and merged. | |
| #2821 ci: fix osv workflow errors | charmcraft | merged | Merged fix for CI OSV workflow errors by updating the cryptography dependency. Approved by two reviewers and passed all required checks, successfully restoring the security scanning pipeline. |