chore(deps): update dependency cryptography [security] - autoclosed
Metadata
Current evaluation
Security update for cryptography was autoclosed by Renovate without merging. The bot is configured to automatically recreate the PR upon closure.
Suggested action: —
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cryptography](https://togithub.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==3.4.8` -> `==40.0.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
| [cryptography](https://togithub.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==3.4.8` -> `==39.0.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
### ⚠ Dependency Lookup Warnings ⚠
Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.
### GitHub Vulnerability Alerts
#### [CVE-2023-23931](https://togithub.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r)
Previously, `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers:
```pycon
>>> outbuf = b"\x00" * 32
>>> c = ciphers.Cipher(AES(b"\x00" * 32), modes.ECB()).encryptor()
>>> c.update_into(b"\x00" * 16, outbuf)
16
>>> outbuf
b'\xdc\x95\xc0x\xa2@​\x89\x89\xadH\xa2\x14\x92\x84 \x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
```
This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python. This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone.
This now correctly raises an exception.
This issue has been present since `update_into` was originally introduced in cryptography 1.8.
#### [CVE-2023-0286](https://togithub.com/pyca/cryptography/security/advisories/GHSA-x4qr-2fvf-3mr5)
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8.1-39.0.0 are vulnerable to a security issue. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221213.txt and https://www.openssl.org/news/secadv/20230207.txt.
If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
---
### Release Notes
<details>
<summary>pyca/cryptography</summary>
### [`v40.0.1`](https://togithub.com/pyca/cryptography/compare/40.0.0...40.0.1)
[Compare Source](https://togithub.com/pyca/cryptography/compare/40.0.0...40.0.1)
### [`v40.0.0`](https://togithub.com/pyca/cryptography/compare/39.0.2...40.0.0)
[Compare Source](https://togithub.com/pyca/cryptography/compare/39.0.2...40.0.0)
### [`v39.0.2`](https://togithub.com/pyca/cryptography/compare/39.0.1...39.0.2)
[Compare Source](https://togithub.com/pyca/cryptography/compare/39.0.1...39.0.2)
### [`v39.0.1`](https://togithub.com/pyca/cryptography/compare/39.0.0...39.0.1)
[Compare Source](https://togithub.com/pyca/cryptography/compare/39.0.0...39.0.1)
### [`v39.0.0`](https://togithub.com/pyca/cryptography/compare/38.0.4...39.0.0)
[Compare Source](https://togithub.com/pyca/cryptography/compare/38.0.4...39.0.0)
### [`v38.0.4`](https://togithub.com/pyca/cryptography/compare/38.0.3...38.0.4)
[Compare Source](https://togithub.com/pyca/cryptography/compare/38.0.3...38.0.4)
### [`v38.0.3`](https://togithub.com/pyca/cryptography/compare/38.0.2...38.0.3)
[Compare Source](https://togithub.com/pyca/cryptography/compare/38.0.2...38.0.3)
### [`v38.0.2`](https://togithub.com/pyca/cryptography/compare/38.0.1...38.0.2)
[Compare Source](https://togithub.com/pyca/cryptography/compare/38.0.1...38.0.2)
### [`v38.0.1`](https://togithub.com/pyca/cryptography/compare/38.0.0...38.0.1)
[Compare Source](https://togithub.com/pyca/cryptography/compare/38.0.0...38.0.1)
### [`v38.0.0`](https://togithub.com/pyca/cryptography/compare/37.0.4...38.0.0)
[Compare Source](https://togithub.com/pyca/cryptography/compare/37.0.4...38.0.0)
### [`v37.0.4`](https://togithub.com/pyca/cryptography/compare/37.0.3...37.0.4)
[Compare Source](https://togithub.com/pyca/cryptography/compare/37.0.3...37.0.4)
### [`v37.0.3`](https://togithub.com/pyca/cryptography/compare/37.0.2...37.0.3)
[Compare Source](https://togithub.com/pyca/cryptography/compare/37.0.2...37.0.3)
### [`v37.0.2`](https://togithub.com/pyca/cryptography/compare/37.0.1...37.0.2)
[Compare Source](https://togithub.com/pyca/cryptography/compare/37.0.1...37.0.2)
### [`v37.0.1`](https://togithub.com/pyca/cryptography/compare/37.0.0...37.0.1)
[Compare Source](https://togithub.com/pyca/cryptography/compare/37.0.0...37.0.1)
### [`v37.0.0`](https://togithub.com/pyca/cryptography/compare/36.0.2...37.0.0)
[Compare Source](https://togithub.com/pyca/cryptography/compare/36.0.2...37.0.0)
### [`v36.0.2`](https://togithub.com/pyca/cryptography/compare/36.0.1...36.0.2)
[Compare Source](https://togithub.com/pyca/cryptography/compare/36.0.1...36.0.2)
### [`v36.0.1`](https://togithub.com/pyca/cryptography/compare/36.0.0...36.0.1)
[Compare Source](https://togithub.com/pyca/cryptography/compare/36.0.0...36.0.1)
### [`v36.0.0`](https://togithub.com/pyca/cryptography/compare/35.0.0...36.0.0)
[Compare Source](https://togithub.com/pyca/cryptography/compare/35.0.0...36.0.0)
### [`v35.0.0`](https://togithub.com/pyca/cryptography/compare/3.4.8...35.0.0)
[Compare Source](https://togithub.com/pyca/cryptography/compare/3.4.8...35.0.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "after 1 am and before 7 am" in timezone Etc/UTC.
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired.
---
- [x] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://app.renovatebot.com/dashboard#github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNS4yMy4zIiwidXBkYXRlZEluVmVyIjoiMzUuMzIuMSJ9-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Security update for cryptography was autoclosed by Renovate without merging. The bot is configured to automatically recreate the PR upon closure. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate bot PR to update cryptography for security vulnerabilities was automatically closed without merging. The dependency update was abandoned and superseded by newer Renovate updates. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate bot pull request updating cryptography for security vulnerabilities was autoclosed and abandoned. The dependency update was not merged, and Renovate will recreate it if needed. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1120 chore(deps): update dependency cryptography to v41 [security] - autoclosed | charmcraft | closed | The cryptography v41 security update pull request was autoclosed without merging. Renovate automatically closed it due to inactivity or because the dependency was already updated. No reviews or CI checks were performed. | |
| #1537 chore(deps): update dependency cryptography to v42.0.4 [security] | charmcraft | closed | Maintainer closed the cryptography v42.0.4 security update without merging. The patch requires an environment variable change and will be handled separately. Renovate will ignore this specific version. | |
| #1056 chore(deps): update dependency cryptography to v39 [security] | charmcraft | closed | Closed unmerged and superseded by PR #1024, which addresses the cryptography v39 security update. Renovate will ignore future 39.x releases for this branch. | |
| #1019 chore(deps): update dependency cryptography to v39 [security] | charmcraft | closed | Superseded by PR #1024. The automated cryptography v39 security update was closed unmerged to prevent duplication with a newer dependency upgrade. | |
| #1396 chore(deps): update dependency cryptography to v41.0.6 [security] | charmcraft | merged | Merged automated dependency update upgrading cryptography from 41.0.4 to 41.0.6 to resolve CVE-2023-49083, preventing a denial of service from NULL-pointer dereference during PKCS7 parsing. Approved and merged automatically by Renovate. | |
| #4856 chore(deps): update dependency requests to v2.32.2 [security] - autoclosed | snapcraft | closed | Renovate's dependency update PR for requests to v2.32.2 was autoclosed without merging. The bot automatically closed the stale pull request, leaving the CVE-2024-35195 security fix unapplied. | |
| #1272 chore(deps): update dependency cryptography to v41.0.4 [security] | charmcraft | closed | Closed without merging after failing a flaky store test. Superseded by PR #1271. Renovate will ignore this cryptography v41.0.4 update until a newer version is released. | |
| #1164 chore(deps): update dependency cryptography to v41.0.2 [security] | charmcraft | merged | Merged automated dependency update upgrading cryptography from v41.0.0 to v41.0.2 to resolve CVE-2023-38325 SSH certificate vulnerability. Approved, passed CI checks, and successfully merged via Renovate bot. | |
| #4564 chore(deps): update dependency cryptography to v42 [security] | snapcraft | merged | Merged automated dependency update upgrading cryptography from v41.0.7 to v42.0.2 to patch CVE-2023-50782 and CVE-2024-0727. The change passed CI checks, received two approvals, and was merged into main. | |
| #5011 build(deps): update dependency cryptography to v43 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Superseded by a newer dependency update and autoclosed by Renovate bot. The security patch updating cryptography to v43 was not manually merged. |