build(deps): bump lxml
Metadata
Current evaluation
Merged a dependency update to bump lxml, resolving an OSV vulnerability. Approved by two reviewers and validated by CI checks before integration.
Suggested action: —
No scores available.
Issue body
Resolves an OSV.
---
- [ ] I've followed the [contribution guidelines](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md).
- [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
- [ ] I've updated the relevant release notes.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged a dependency update to bump lxml, resolving an OSV vulnerability. Approved by two reviewers and validated by CI checks before integration. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged dependency update bumping lxml to resolve an OSV vulnerability. Changes passed linting and tests before integration. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a dependency update to bump lxml, resolving an OSV. The maintainer submitted the change, which passed checks and was integrated without discussion. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1072 build(deps): bump lxml | craft-application | merged | Merged a dependency update bumping lxml from 6.0.2 to 6.1.0 to resolve an OSV vulnerability. Approved by two reviewers and passed all CI checks prior to integration. | |
| #540 build(deps): bump lxml | starbase | merged | Merged after bumping lxml to resolve an OSV vulnerability. Approved by two reviewers with all CI checks passing. The update modified a single file, adding 114 lines and removing 120. | |
| #1563 build(deps): bump lxml | craft-parts | merged | Merged dependency update bumping lxml from v6.0.2 to v6.1.0 to resolve an OSV vulnerability. Approved by two reviewers and passed all CI checks. | |
| #86 build(deps): bump lxml | craft-artifacts | merged | Merged a dependency update bumping lxml from v6.0.2 to v6.1.1 to resolve an OSV security advisory. Approved by two reviewers and integrated after passing CI checks. | |
| #362 build(deps): bump lxml | craft-store | merged | Merged dependency update bumping lxml from 5.4.0 to 6.1.0 to address an OSV security vulnerability. Approved by two reviewers with all CI checks passing. | |
| #331 build(deps): update lxml | imagecraft | merged | Updated lxml dependency to resolve an OSV. Merged after approval by two reviewers and passing all CI checks. Changes affect one file with 98 additions and 98 deletions. | |
| #3485 build(deps): bump lxml from 4.6.2 to 4.6.3 | snapcraft | merged | Merged Dependabot update bumping lxml 4.6.2 to 4.6.3. Resolves CVE-2021-28957, patching an HTML Cleaner vulnerability allowing JavaScript injection. Approved by two reviewers, passed CI, and merged. | |
| #3606 build(deps): bump lxml from 4.6.3 to 4.6.5 | snapcraft | merged | Merged Dependabot update bumping lxml from 4.6.3 to 4.6.5. The upgrade patches two HTML cleaner security vulnerabilities enabling script injection. Approved by reviewer and passed CI. | |
| #3404 build(deps): bump lxml from 4.5.0 to 4.6.2 | snapcraft | merged | Merged a Dependabot update bumping lxml from 4.5.0 to 4.6.2 to resolve security vulnerabilities and bugs. CI checks passed and the dependency upgrade was successfully integrated. | |
| #3829 build(deps): bump lxml from 4.9.0 to 4.9.1 | snapcraft | merged | Merged Dependabot update bumping lxml from 4.9.0 to 4.9.1, resolving a crash in iterwalk() and canonicalize() with malformed input. Approved by one reviewer, passed CI, and merged with a two-line dependency version change. |