build(deps): add constraint for Starlette
Metadata
Current evaluation
Merged PR #547 added a constraint for the indirect Starlette dependency, excluding versions affected by the BadHost CVE; the change landed as ca8caba.
Resolution: closed resolved
Reason: PR #547 was merged after approval and passing checks, with commit ca8caba recording the dependency constraint in two files. This directly addressed the stated BadHost CVE exposure by preventing affected Starlette versions.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Pin the indirect dependency to a version not affected by BadHost CVE.
---
- [ ] I've followed the [contribution guidelines](https://github.com/canonical/starbase/blob/main/CONTRIBUTING.md).
- [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
- [ ] I've updated the relevant release notes.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #547 added a constraint for the indirect Starlette dependency, excluding versions affected by the BadHost CVE; the change landed as ca8caba. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/starbase#547 (ca8caba), adding a two-file constraint to avoid indirect Starlette versions affected by the BadHost CVE. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a dependency update pinning Starlette to a version unaffected by the BadHost CVE. Approved by two reviewers and passing all CI checks, the change adds a version constraint to mitigate the vulnerability. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a constraint update for Starlette to pin the dependency to a version unaffected by the BadHost CVE, resolving the security vulnerability. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #228 build(deps): add constraint for Starlette | craft-platforms | merged | Merged PR #228 via commit dcbf23e, constraining indirect Starlette to versions unaffected by the BadHost CVE. | |
| #1241 build(deps): add constraint for Starlette | rockcraft | merged | Merged PR #1241 in commit 703bbc20, constraining indirect Starlette to a version not affected by the BadHost CVE. | |
| #91 build(deps): add constraint for Starlette | craft-artifacts | merged | Merged in commit 5665dcb, adding a two-file constraint for indirect Starlette to avoid versions affected by the BadHost CVE. | |
| #190 build(deps): add constraint for Starlette | craft-grammar | merged | Merged PR #190 with two approvals, adding a two-file constraint to exclude indirect Starlette versions affected by the BadHost CVE. | |
| #164 build(deps): add constraint for Starlette | debcraft | merged | Merged #164 as commit 10a58dc, constraining indirect Starlette to a version unaffected by the BadHost CVE. | |
| #2716 build(deps): add constraint for Starlette | charmcraft | merged | Merged into main via commit 4a54393b, adding a Starlette dependency constraint to avoid versions affected by the BadHost CVE. | |
| #972 build(deps): add constraint for Starlette | craft-providers | merged | Merged in #972 via commit 7ed9c81, constraining indirect Starlette to >=1.0.1 to avoid versions affected by the BadHost CVE. | |
| #6277 build(deps): add constraint for Starlette | snapcraft | merged | Merged in #6277 (d3e2405d6), adding a Starlette constraint to avoid versions affected by the BadHost CVE. | |
| #376 build(deps): add constraint for Starlette | craft-store | merged | Merged #376 via ed08e00, adding a Starlette >=1.0.1 constraint to avoid versions affected by the BadHost CVE. | |
| #350 build(deps): bump starlette | imagecraft | merged | Merged PR #350 as commit 920399b, bumping Starlette from v0.52.1 to v1.2.0 to resolve an OSV advisory; all reported CI checks passed. |