← Back to issue list

build(deps): bump pip

View original Github issue

Metadata

Project
snapcraft
Number
#6286
Type
pull request
State
merged
Author
smethnani
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #6286 (commit ff4e5adfd) bumped pip v26.1 -> v26.1.2 in the spread-test workflow requirements to clear an OSV advisory.

Resolution: closed resolved

Reason: The PR itself was merged by a maintainer with 2 approvals, landing as commit ff4e5adfd 'build(deps): bump pip (#6286)'. Pickaxe search confirms that commit is the one introducing the 26.1.2 version string, addressing the reported OSV.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Updates pip v26.1 -> v26.1.2 to resolve an OSV --- - [x] I've followed the [contribution guidelines](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md). - [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing. - [ ] I've updated the relevant release notes.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #6286 (commit ff4e5adfd) bumped pip v26.1 -> v26.1.2 in the spread-test workflow requirements to clear an OSV advisory.
stealth/space-bunny-alpha — closed resolved Merged PR #6286 (commit ff4e5adfd), bumping pip from v26.1 to v26.1.2 to resolve an OSV security vulnerability.
qwen/qwen3.6-35b-a3b — — Merged a dependency update bumping pip from v26.1 to v26.1.2 to resolve an OSV security vulnerability. Approved by reviewers and integrated after passing CI checks.
qwen3.6-35b-a3b-mtp-q6 — — Merged a dependency update bumping pip from v26.1 to v26.1.2 to resolve an OSV vulnerability. The change was integrated by maintainer smethnani without additional review comments or documentation updates.

Update history

No update history recorded yet.

Related work

  • Superseded By: canonical/snapcraft#6392 (confidence 45%)

    Later 'build(deps): update deps' commit (3d6f104c7) also touches the 26.1.2 pin, indicating a subsequent dependency refresh

Related issues

Issue Project State Summary Similarity
#6221 build(deps): bump pip snapcraft merged Merged PR #6221 in commit 948f284fa, updating the pip build dependency to resolve an OSV security vulnerability.
85%
#6008 build(deps-dev): bump pip from 25.3 to 26.0 snapcraft closed Dependabot's pip 25.3→26.0 bump was closed unmerged; @bepri noted "Fixed by #6011" and Dependabot stopped notifying. PR #6011 (build: fix CVEs, commit a8213b7c) updated pip and protobuf in uv.lock.
79%
#4776 build(deps): bump pip from 22.0.2 to 23.3 in /docs snapcraft merged Dependabot PR merged: bumped pip 22.0.2 to 23.3 in docs requirements (commit 99387d281, "build(deps): bump pip from 22.0.2 to 23.3 in /docs (#4776)"), approved by 2 reviewers.
76%
#1336 build(deps): update dependency pip to v25 [security] (hotfix/2.20) - autoclosed craft-parts closed Renovate PR #1336 proposed upgrading pip from 24.0 to 25.2 for CVE-2025-8869 on hotfix/2.20, but was autoclosed unmerged despite passing CI.
74%
#321 build(deps): bump pytest imagecraft merged Merged PR #321 (commit e1b9241) bumped pytest to resolve an OSV advisory; lint, tests, builds, and security checks passed.
73%
#5871 build(autogen): bump pip for OSV snapcraft merged Merged as commit 1581acb11, upgrading pip 25.2→25.3 for GHSA-4xh5-x5gv-qwph and refreshing python-apt lock entries.
72%
#959 build(deps): update dependency pip to v24.3.1 (main) - autoclosed craft-parts closed Renovate PR #959 proposed updating pip from 24.0 to 24.3.1 but was autoclosed unmerged after 623 days; no replacement or resolving commit was identified.
71%
#1337 build(deps): update dependency pip to v25 [security] (hotfix/2.7) - autoclosed craft-parts closed Renovate's pip 24.0-to-25.2 security update for hotfix/2.7 was auto-closed unmerged; no replacement PR or resolving commit was found.
71%
#1335 build(deps): update dependency pip to v25 [security] (main) - autoclosed craft-parts closed Renovate's pip 24.0 to 25.2 security update for CVE-2025-8869 was autoclosed unmerged after 359 days; no resolving PR or commit was found.
71%