build(autogen): bump pip for OSV
Metadata
Current evaluation
Merged as commit 1581acb11, upgrading pip 25.2→25.3 for GHSA-4xh5-x5gv-qwph and refreshing python-apt lock entries.
Resolution: closed resolved
Reason: PR #5871 was merged into main as commit 1581acb11, delivering the pip security update.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [ ] Have you followed the [guidelines for contributing](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md)?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint`?
- [ ] Have you successfully run `make test`?
---
Bumps pip to 25.3 for [this OSV](https://osv.dev/vulnerability/GHSA-4xh5-x5gv-qwph).
```
❯ uv lock --upgrade-package pip
Resolved 226 packages in 2.58s
Updated pip v25.2 -> v25.3
Updated python-apt v2.4.0+ubuntu4, v2.7.7+ubuntu3, v2.9.9, v3.0.0 -> v2.4.0+ubuntu4, v2.7.7+ubuntu3, v2.9.9, v3.0.0+ubuntu1
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 1581acb11, upgrading pip 25.2→25.3 for GHSA-4xh5-x5gv-qwph and refreshing python-apt lock entries. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/snapcraft#5871 (1581acb11), bumping pip from 25.2 to 25.3 for GHSA-4xh5-x5gv-qwph and refreshing python-apt lock entries. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged after three approvals. Bumps pip to 25.3 to resolve OSV vulnerability GHSA-4xh5-x5gv-qwph. All required CI checks passed prior to merge. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a dependency update bumping pip from 25.2 to 25.3 to resolve OSV vulnerability GHSA-4xh5-x5gv-qwph. The change was applied via uv lock and successfully integrated, patching the security advisory. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/snapcraft#5822
(confidence 98%)
Earlier temporary OSV suppression remained until pip 25.3 was delivered by #5871.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #6286 build(deps): bump pip | snapcraft | merged | Merged PR #6286 (commit ff4e5adfd) bumped pip v26.1 -> v26.1.2 in the spread-test workflow requirements to clear an OSV advisory. | |
| #247 build(autogen): bump dependencies to resolve OSVs | imagecraft | merged | Merged #247 via commit 603fbc3, updating filelock 3.20.2, fonttools 4.61.1, and urllib3 2.6.2 to resolve OSV warnings; all CI checks passed. | |
| #6221 build(deps): bump pip | snapcraft | merged | Merged PR #6221 in commit 948f284fa, updating the pip build dependency to resolve an OSV security vulnerability. |