build(deps): bump idna, urllib3
Metadata
Current evaluation
Merged idna and urllib3 dependency bumps to address reported OSV vulnerabilities in snapcraft#6265 (commit de6a28a9c).
Resolution: closed resolved
Reason: Pull request #6265 was merged as commit de6a28a9c, updating idna and urllib3 to address the reported OSV findings.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Resolves some osvs.
---
- [x] I've followed the [contribution guidelines](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md).
- [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
- [ ] I've updated the relevant release notes.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged idna and urllib3 dependency bumps to address reported OSV vulnerabilities in snapcraft#6265 (commit de6a28a9c). | |
| stealth/space-bunny-alpha | — | closed resolved | Merged dependency updates for idna and urllib3 in commit de6a28a9c (#6265), addressing reported OSV vulnerabilities. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a dependency update bumping idna and urllib3 to resolve OSV security vulnerabilities. Approved by two reviewers and successfully passed CI checks. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1076 build(deps): bump idna, urllib3 | craft-application | merged | Merged idna and urllib3 dependency bumps to address OSV findings; commit 80a58477 records the accepted change. | |
| #1615 build(deps): bump idna + urllib3 | craft-parts | merged | Merged #1615 in commit dd195de9, updating idna 3.11→3.18 and urllib3 2.6.3→2.7.0 to address reported OSV findings. | |
| #344 build(deps): bump urllib3 | imagecraft | merged | Merged urllib3 dependency bump (uv.lock, +3/-3) fixing an OSV advisory; commit 033c84e landed PR #344 with 2 approvals and all CI checks green. | |
| #1307 build(deps): bump urllib3 from 1.26.16 to 1.26.17 | charmcraft | closed | Dependabot closed #1307 unmerged as obsolete: the identical urllib3 1.26.16→1.26.17 security bump had already landed via #1308 (commit 51323d0f). | |
| #1753 build(deps): bump urllib3 to 2.8.0 | craft-parts | merged | Lock-only bump of urllib3 from 2.7.0 to 2.8.0 to resolve OSV security scan failures. Approved by 2 reviewers with 0 unresolved comments. CI has failing OSV-scanner and test-python-plugins checks. | |
| #220 build(deps): update urllib3 to 2.8.0 | craft-grammar | merged | Merged PR #220 updating urllib3 from 2.7.0 to 2.8.0 to address three OSV security vulnerabilities (PYSEC-2026-4175/4176/4177). | |
| #63 build: bump urllib3 | debcraft | merged | Merged PR #63 updated urllib3 to resolve an OSV vulnerability; commit 5f83429 passed all CI checks. | |
| #5912 build: bump urllib3 | snapcraft | merged | Merged PR #5912 (commit 99a19a09a) bumped urllib3 to resolve an OSV vulnerability. | |
| #4859 build(deps): bump urllib3 from 1.26.18 to 1.26.19 | snapcraft | merged | Dependabot PR merged, bumping urllib3 1.26.18 to 1.26.19 in the main requirements (commit 60d370276, PR #4859); approved by 2 reviewers with no unresolved comments. | |
| #1336 build(deps): bump urllib3 from 1.26.17 to 1.26.18 | charmcraft | closed | Superseded unmerged by commit 25d6160d, which updated urllib3 to 1.26.18; Dependabot closed #1336 as already up to date. |