build(autogen): bump pip for OSV
Metadata
Current evaluation
Merged after three approvals. Bumps pip to 25.3 to resolve OSV vulnerability GHSA-4xh5-x5gv-qwph. All required CI checks passed prior to merge.
Suggested action: —
No scores available.
Issue body
- [ ] Have you followed the [guidelines for contributing](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md)?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint`?
- [ ] Have you successfully run `make test`?
---
Bumps pip to 25.3 for [this OSV](https://osv.dev/vulnerability/GHSA-4xh5-x5gv-qwph).
```
❯ uv lock --upgrade-package pip
Resolved 226 packages in 2.58s
Updated pip v25.2 -> v25.3
Updated python-apt v2.4.0+ubuntu4, v2.7.7+ubuntu3, v2.9.9, v3.0.0 -> v2.4.0+ubuntu4, v2.7.7+ubuntu3, v2.9.9, v3.0.0+ubuntu1
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged after three approvals. Bumps pip to 25.3 to resolve OSV vulnerability GHSA-4xh5-x5gv-qwph. All required CI checks passed prior to merge. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a dependency update bumping pip from 25.2 to 25.3 to resolve OSV vulnerability GHSA-4xh5-x5gv-qwph. The change was applied via uv lock and successfully integrated, patching the security advisory. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Bumped pip to 25.3 and merged to address OSV security vulnerability GHSA-4xh5-x5gv-qwph. The dependency was resolved via uv lock, successfully integrating the security fix. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #247 build(autogen): bump dependencies to resolve OSVs | imagecraft | merged | Merged after passing CI and receiving two approvals. Updated filelock, fonttools, and urllib3 to resolve OSV security warnings. An unrelated Spread test failure was noted but did not block the merge. | |
| #6286 build(deps): bump pip | snapcraft | merged | Merged a dependency update bumping pip from v26.1 to v26.1.2 to resolve an OSV security vulnerability. Approved by reviewers and integrated after passing CI checks. | |
| #342 build(autogen): bump libraries to fix OSVs | craft-store | merged | Merged dependency updates for cffi, filelock, jaraco-context, protobuf, pynacl, urllib3, and wheel to resolve OSV security vulnerabilities. Approved by two reviewers and passed all CI checks. | |
| #457 build(autogen): bump dependencies | craft-cli | merged | Merged after reviewer approval and passing all CI checks. Bumped dependencies across two files to resolve multiple OSV security vulnerabilities. All tests, linting, and security scans passed successfully. | |
| #6221 build(deps): bump pip | snapcraft | merged | Merged a dependency update to bump pip, resolving an OSV security vulnerability. Approved by two reviewers, the change was accepted after passing CI checks and involved a minor version bump in one file. | |
| #180 build(deps): resolve OSVs | craft-grammar | merged | Merged following two approvals and successful CI checks. Updated pytest from v9.0.2 to v9.0.3 to resolve OSV security vulnerabilities across one dependency file. | |
| #1121 build: bump requests to avoid OSV | craft-parts | merged | Merged after bumping the requests dependency to resolve an OSV vulnerability. Approved by two reviewers with all CI checks passing. The update modifies three files with 136 additions and 10 deletions. | |
| #182 build: bump deps, fix security scan | debcraft | merged | Merged following approval and passing CI checks. Bumped cryptography, httplib2, and setuptools to resolve OSV vulnerabilities and corrected the security scan workflow. Closes #181. |