chore(deps): update dependency cryptography [security] - autoclosed
Metadata
Current evaluation
Renovate’s cryptography 3.4.8→39/40 update was autoclosed unmerged; PR #1119 (commit 42365b41) later merged 40.0.2→41.0.0, superseding it.
Resolution: closed superseded
Reason: Renovate closed #1057 without merging. The cryptography update was superseded by merged PR canonical/charmcraft#1119, commit 42365b41, which upgraded 40.0.2 to 41.0.0.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cryptography](https://togithub.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==3.4.8` -> `==40.0.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
| [cryptography](https://togithub.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==3.4.8` -> `==39.0.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
### ⚠ Dependency Lookup Warnings ⚠
Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.
### GitHub Vulnerability Alerts
#### [CVE-2023-23931](https://togithub.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r)
Previously, `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers:
```pycon
>>> outbuf = b"\x00" * 32
>>> c = ciphers.Cipher(AES(b"\x00" * 32), modes.ECB()).encryptor()
>>> c.update_into(b"\x00" * 16, outbuf)
16
>>> outbuf
b'\xdc\x95\xc0x\xa2@​\x89\x89\xadH\xa2\x14\x92\x84 \x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
```
This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python. This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone.
This now correctly raises an exception.
This issue has been present since `update_into` was originally introduced in cryptography 1.8.
#### [CVE-2023-0286](https://togithub.com/pyca/cryptography/security/advisories/GHSA-x4qr-2fvf-3mr5)
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8.1-39.0.0 are vulnerable to a security issue. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221213.txt and https://www.openssl.org/news/secadv/20230207.txt.
If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
---
### Release Notes
<details>
<summary>pyca/cryptography</summary>
### [`v40.0.1`](https://togithub.com/pyca/cryptography/compare/40.0.0...40.0.1)
[Compare Source](https://togithub.com/pyca/cryptography/compare/40.0.0...40.0.1)
### [`v40.0.0`](https://togithub.com/pyca/cryptography/compare/39.0.2...40.0.0)
[Compare Source](https://togithub.com/pyca/cryptography/compare/39.0.2...40.0.0)
### [`v39.0.2`](https://togithub.com/pyca/cryptography/compare/39.0.1...39.0.2)
[Compare Source](https://togithub.com/pyca/cryptography/compare/39.0.1...39.0.2)
### [`v39.0.1`](https://togithub.com/pyca/cryptography/compare/39.0.0...39.0.1)
[Compare Source](https://togithub.com/pyca/cryptography/compare/39.0.0...39.0.1)
### [`v39.0.0`](https://togithub.com/pyca/cryptography/compare/38.0.4...39.0.0)
[Compare Source](https://togithub.com/pyca/cryptography/compare/38.0.4...39.0.0)
### [`v38.0.4`](https://togithub.com/pyca/cryptography/compare/38.0.3...38.0.4)
[Compare Source](https://togithub.com/pyca/cryptography/compare/38.0.3...38.0.4)
### [`v38.0.3`](https://togithub.com/pyca/cryptography/compare/38.0.2...38.0.3)
[Compare Source](https://togithub.com/pyca/cryptography/compare/38.0.2...38.0.3)
### [`v38.0.2`](https://togithub.com/pyca/cryptography/compare/38.0.1...38.0.2)
[Compare Source](https://togithub.com/pyca/cryptography/compare/38.0.1...38.0.2)
### [`v38.0.1`](https://togithub.com/pyca/cryptography/compare/38.0.0...38.0.1)
[Compare Source](https://togithub.com/pyca/cryptography/compare/38.0.0...38.0.1)
### [`v38.0.0`](https://togithub.com/pyca/cryptography/compare/37.0.4...38.0.0)
[Compare Source](https://togithub.com/pyca/cryptography/compare/37.0.4...38.0.0)
### [`v37.0.4`](https://togithub.com/pyca/cryptography/compare/37.0.3...37.0.4)
[Compare Source](https://togithub.com/pyca/cryptography/compare/37.0.3...37.0.4)
### [`v37.0.3`](https://togithub.com/pyca/cryptography/compare/37.0.2...37.0.3)
[Compare Source](https://togithub.com/pyca/cryptography/compare/37.0.2...37.0.3)
### [`v37.0.2`](https://togithub.com/pyca/cryptography/compare/37.0.1...37.0.2)
[Compare Source](https://togithub.com/pyca/cryptography/compare/37.0.1...37.0.2)
### [`v37.0.1`](https://togithub.com/pyca/cryptography/compare/37.0.0...37.0.1)
[Compare Source](https://togithub.com/pyca/cryptography/compare/37.0.0...37.0.1)
### [`v37.0.0`](https://togithub.com/pyca/cryptography/compare/36.0.2...37.0.0)
[Compare Source](https://togithub.com/pyca/cryptography/compare/36.0.2...37.0.0)
### [`v36.0.2`](https://togithub.com/pyca/cryptography/compare/36.0.1...36.0.2)
[Compare Source](https://togithub.com/pyca/cryptography/compare/36.0.1...36.0.2)
### [`v36.0.1`](https://togithub.com/pyca/cryptography/compare/36.0.0...36.0.1)
[Compare Source](https://togithub.com/pyca/cryptography/compare/36.0.0...36.0.1)
### [`v36.0.0`](https://togithub.com/pyca/cryptography/compare/35.0.0...36.0.0)
[Compare Source](https://togithub.com/pyca/cryptography/compare/35.0.0...36.0.0)
### [`v35.0.0`](https://togithub.com/pyca/cryptography/compare/3.4.8...35.0.0)
[Compare Source](https://togithub.com/pyca/cryptography/compare/3.4.8...35.0.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "after 1 am and before 7 am" in timezone Etc/UTC.
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired.
---
- [x] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://app.renovatebot.com/dashboard#github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNS4yMy4zIiwidXBkYXRlZEluVmVyIjoiMzUuMzIuMSJ9-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Renovate’s cryptography 3.4.8→39/40 update was autoclosed unmerged; PR #1119 (commit 42365b41) later merged 40.0.2→41.0.0, superseding it. | |
| stealth/space-bunny-alpha | — | closed superseded | Autoclosed unmerged by Renovate; the cryptography update was superseded by merged PR #1119 (commit 42365b41), which upgraded the already-landed 40.0.2 to 41.0.0. | |
| stealth/space-bunny-alpha | — | closed superseded | Renovate’s cryptography security update (3.4.8→40.0.1) was autoclosed unmerged; a later upgrade landed through #1119 in commit 42365b41. | |
| stealth/space-bunny-alpha | — | closed superseded | Autoclosed cryptography 40.0.1/39.0.1 update; the v39 upgrade was subsequently merged in #1024, addressing the outdated dependency. | |
| qwen/qwen3.6-35b-a3b | — | — | Security update for cryptography was autoclosed by Renovate without merging. The bot is configured to automatically recreate the PR upon closure. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate bot PR to update cryptography for security vulnerabilities was automatically closed without merging. The dependency update was abandoned and superseded by newer Renovate updates. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/charmcraft#1119
(confidence 99%)
Merged PR #1119 carried the cryptography dependency forward to 41.0.0.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1120 chore(deps): update dependency cryptography to v41 [security] - autoclosed | charmcraft | closed | Autoclosed unmerged; the same cryptography 40.0.2→41.0.0 security update was merged via #1119 in commit 42365b41. | |
| #1056 chore(deps): update dependency cryptography to v39 [security] | charmcraft | closed | Renovate's cryptography 3.4.8->39.0.1 security bump was closed unmerged; maintainer lengau pointed to #1024, which merged as commit 96f6a183 upgrading to 39.0 (plus Rust build deps) and closing #991. | |
| #1272 chore(deps): update dependency cryptography to v41.0.4 [security] | charmcraft | closed | Renovate security bump of cryptography 41.0.3 -> 41.0.4 was closed unmerged by @lengau on 2023-09-21 (flaky store test) in favour of #1271, which landed as commit 431c7387. | |
| #1537 chore(deps): update dependency cryptography to v42.0.4 [security] | charmcraft | closed | Renovate PR to bump cryptography 42.0.2->42.0.4 (CVE-2024-26130) was closed unmerged by lengau on 2024-02-22, deferred to a separate env-var change; the pin later moved to 42.0.5 via merged #1601 (545b8db5) and 42.0.8 in #1694. | |
| #4564 chore(deps): update dependency cryptography to v42 [security] | snapcraft | merged | Renovate bumped cryptography from 41.0.7 to 42.0.2 (fixing CVE-2023-50782 and CVE-2024-0727); PR #4564 was approved and squash-merged into main as commit ac421ab96. | |
| #1164 chore(deps): update dependency cryptography to v41.0.2 [security] | charmcraft | merged | Merged cryptography 41.0.2 security update via commit 6d9dd818, replacing 41.0.0 to address CVE-2023-38325. | |
| #1201 chore(deps): update dependency cryptography to v41.0.3 [security] | charmcraft | merged | Merged as commit 31f7281c, updating cryptography from 41.0.2 to 41.0.3 to address vulnerable OpenSSL bundled in its wheels. | |
| #4598 chore(deps): update dependency cryptography to v42.0.4 [security] | snapcraft | merged | Merged #4598 in commit 7cfb60986, upgrading cryptography from 42.0.2 to 42.0.4 to address CVE-2024-26130. | |
| #1396 chore(deps): update dependency cryptography to v41.0.6 [security] | charmcraft | merged | Merged PR #1396 upgraded cryptography from 41.0.4 to 41.0.6 via commit d8a889db, fixing the PKCS#7 NULL-pointer denial-of-service vulnerability CVE-2023-49083. | |
| #1019 chore(deps): update dependency cryptography to v39 [security] | charmcraft | closed | Renovate PR #1019 (cryptography 3.4.8 -> 39.0.1) was closed unmerged by lengau on 2023-02-15 as superseded by canonical/charmcraft#1024, which merged the same v39.0 bump (commit 96f6a183) and added Rust build deps to snapcraft.yaml. |