build: fix CVEs
Metadata
Current evaluation
Merged #6011 (commit a8213b7ce), fixing #5968 by ignoring the already patched PyNaCl/libsodium CVE and updating pip and protobuf for two other CVEs.
Resolution: closed resolved
Reason: PR #6011 was merged after approval, resolving #5968: the patched PyNaCl/libsodium CVE was suppressed while pip and protobuf were updated for the other CVEs. The issue tracker records #5968 as closed by merged PR #6011 at commit a8213b7ce.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Ignores a fixed CVE for PyNaCl/libsodium.
Updates pip and protobuf for 2 other CVEs.
Fixes #5968
---
- [x] I've followed the [contribution guidelines](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md).
- [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] I've updated the relevant release notes.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged #6011 (commit a8213b7ce), fixing #5968 by ignoring the already patched PyNaCl/libsodium CVE and updating pip and protobuf for two other CVEs. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #6011 via commit a8213b7ce, updating pip and protobuf for CVEs and ignoring an already-patched PyNaCl/libsodium alert, resolving #5968. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/snapcraft#6011: updated pip and protobuf for two CVEs, ignored a fixed PyNaCl/libsodium CVE, and resolved #5968. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged. Updates pip and protobuf to patch two CVEs and ignores a resolved PyNaCl/libsodium vulnerability, resolving issue #5968. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged build dependency updates addressing three CVEs. Pip and protobuf were upgraded to resolve two vulnerabilities, while a resolved PyNaCl/libsodium CVE was ignored. Fixes #5968. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/snapcraft#5968
(confidence 100%)
The PR explicitly states “Fixes #5968,” and #5968 is recorded as closed by this merge.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #5968 Update PyNaCl and libsodium | snapcraft | closed | Resolved by merged PR #6011 (commit a8213b7ce), which ignored GHSA-mrfv-m5wm-5w6w because the PyNaCl/libsodium vulnerability was already patched in the build environment. | |
| #6221 build(deps): bump pip | snapcraft | merged | Merged PR #6221 in commit 948f284fa, updating the pip build dependency to resolve an OSV security vulnerability. | |
| #6008 build(deps-dev): bump pip from 25.3 to 26.0 | snapcraft | closed | Dependabot's pip 25.3→26.0 bump was closed unmerged; @bepri noted "Fixed by #6011" and Dependabot stopped notifying. PR #6011 (build: fix CVEs, commit a8213b7c) updated pip and protobuf in uv.lock. |