← Back to issue list

build(deps): bump certifi and setuptools for CVEs

View original Github issue

Metadata

Project
snapcraft
Number
#6522
Type
pull request
State
merged
Author
mr-cal-bot
Labels
PR: Rebase
Created
Updated
Closed

Current evaluation

Merged PR #6522 cherry-picks dependency bumps for certifi and setuptools from main to address CVEs, updating certifi to 2026.10.19 and setuptools to 84.1.0.

Resolution: closed resolved

Reason: The PR was merged, applying cherry-picked CVE fixes for certifi and setuptools from main. It updates certifi to 2026.10.19 and setuptools to 84.1.0 as documented in the PR body.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Cherry-pick CVE/OSV dependency bumps from main: - #6512: bump certifi to 2026.10.19 - #6521: bump setuptools to 84.1.0 --- - [x] I've followed the [contribution guidelines](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md). - [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [x] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing. - [ ] I've updated the relevant release notes.

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b — closed resolved Merged PR #6522 cherry-picks dependency bumps for certifi and setuptools from main to address CVEs, updating certifi to 2026.10.19 and setuptools to 84.1.0.

Update history

Date Change
merged
updated
created

Related work

Related issues

Issue Project State Summary Similarity
#1182 build(deps): bump certifi from 2023.5.7 to 2023.7.22 charmcraft merged Merged PR #1182 in commit 8350a166, upgrading certifi from 2023.5.7 to 2023.7.22.
81%
#6512 build(deps): bump certifi to 2026.10.19 snapcraft merged Bump certifi dependency to 2026.10.19 to resolve an OSV vulnerability. Merged into main.
80%
#4896 build(deps): bump certifi from 2023.11.17 to 2024.7.4 snapcraft merged Merged PR #4896, updating certifi from 2023.11.17 to 2024.7.4 in commit a4e2895da.
78%
#4291 build(deps): bump certifi from 2022.12.7 to 2023.7.22 in /docs/.sphinx snapcraft merged Dependabot PR merged as commit 363d2bd47, bumping certifi 2022.12.7 -> 2023.7.22 in docs/.sphinx requirements. Companion PR #4292 did the same for the main requirements file.
77%
#1936 build(deps): update dependency certifi to v2024.8.30 (main) charmcraft merged Merged #1936 via commit 2f076407, updating certifi from 2024.7.4 to 2024.8.30 across two dependency files.
76%
#4292 build(deps): bump certifi from 2023.5.7 to 2023.7.22 snapcraft merged Dependabot PR #4292 merged via commit 423826a11, bumping certifi 2023.5.7 → 2023.7.22 in snapcraft's requirements. Companion docs bump in #4291 (commit 363d2bd47).
75%
#4903 build(deps): bump certifi from 2023.7.22 to 2024.7.4 in /docs/.sphinx snapcraft merged Merged PR #4903 in commit ccbc7b3d9, updating the Sphinx docs dependency certifi from 2023.7.22 to 2024.7.4.
74%
#4000 build(deps): bump certifi from 2022.9.24 to 2022.12.7 snapcraft closed Closed unmerged as obsolete after certifi 2023.5.7 was adopted in #4129 (fc9f9ae44), superseding the proposed 2022.12.7 update.
74%
#4114 build(deps): bump certifi from 2022.9.24 to 2022.12.7 in /docs/.sphinx snapcraft merged Merged PR #4114, updating certifi from 2022.9.24 to 2022.12.7 in the Sphinx documentation environment.
74%
#454 build(deps): update dependency certifi to v2026.10.23 craft-store merged Merged PR #454 updates certifi to v2026.10.23 in uv.lock to resolve a critical OSV security scan failure.
74%