build(deps): bump pip
Metadata
Current evaluation
Merged PR #6221 in commit 948f284fa, updating the pip build dependency to resolve an OSV security vulnerability.
Resolution: closed resolved
Reason: PR #6221 was approved and merged as commit 948f284fa; its purpose was to bump pip and resolve the reported OSV.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Resolves an OSV.
---
- [ ] I've followed the [contribution guidelines](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md).
- [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
- [ ] I've updated the relevant release notes.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #6221 in commit 948f284fa, updating the pip build dependency to resolve an OSV security vulnerability. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #6286 (commit ff4e5adfd), bumping pip from v26.1 to v26.1.2 to resolve an OSV security vulnerability. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a dependency update to bump pip, resolving an OSV security vulnerability. Approved by two reviewers, the change was accepted after passing CI checks and involved a minor version bump in one file. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a dependency update to bump pip, resolving an Open Source Vulnerability. The maintainer passed lint and test checks, and the change was integrated without additional comments. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #6286 build(deps): bump pip | snapcraft | merged | Merged PR #6286 (commit ff4e5adfd) bumped pip v26.1 -> v26.1.2 in the spread-test workflow requirements to clear an OSV advisory. | |
| #6008 build(deps-dev): bump pip from 25.3 to 26.0 | snapcraft | closed | Dependabot's pip 25.3→26.0 bump was closed unmerged; @bepri noted "Fixed by #6011" and Dependabot stopped notifying. PR #6011 (build: fix CVEs, commit a8213b7c) updated pip and protobuf in uv.lock. | |
| #1336 build(deps): update dependency pip to v25 [security] (hotfix/2.20) - autoclosed | craft-parts | closed | Renovate PR #1336 proposed upgrading pip from 24.0 to 25.2 for CVE-2025-8869 on hotfix/2.20, but was autoclosed unmerged despite passing CI. | |
| #1335 build(deps): update dependency pip to v25 [security] (main) - autoclosed | craft-parts | closed | Renovate's pip 24.0 to 25.2 security update for CVE-2025-8869 was autoclosed unmerged after 359 days; no resolving PR or commit was found. | |
| #321 build(deps): bump pytest | imagecraft | merged | Merged PR #321 (commit e1b9241) bumped pytest to resolve an OSV advisory; lint, tests, builds, and security checks passed. | |
| #1337 build(deps): update dependency pip to v25 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | Renovate's pip 24.0-to-25.2 security update for hotfix/2.7 was auto-closed unmerged; no replacement PR or resolving commit was found. | |
| #4776 build(deps): bump pip from 22.0.2 to 23.3 in /docs | snapcraft | merged | Dependabot PR merged: bumped pip 22.0.2 to 23.3 in docs requirements (commit 99387d281, "build(deps): bump pip from 22.0.2 to 23.3 in /docs (#4776)"), approved by 2 reviewers. | |
| #6179 build(deps): update pytest | snapcraft | merged | Merged PR #6179 (commit 3648cbb0c) bumps the pytest dev dependency in a single file (+3/-3) to remediate an OSV vulnerability; all CI checks passed except integration-spread-tests-store. | |
| #6512 build(deps): bump certifi to 2026.10.19 | snapcraft | merged | Bump certifi dependency to 2026.10.19 to resolve an OSV vulnerability. Merged into main. | |
| #524 build(deps): bump pytest | starbase | merged | Merged pytest dependency update to resolve an OSV; commit e372177 landed with all CI checks passing. |