chore(deps): update dependency cryptography to v41.0.4 [security]
Metadata
Current evaluation
Renovate security bump of cryptography 41.0.3 -> 41.0.4 was closed unmerged by @lengau on 2023-09-21 (flaky store test) in favour of #1271, which landed as commit 431c7387.
Resolution: closed superseded
Reason: Maintainer lengau commented "Closing this in favour of #1271 because this one failed a flaky store test"; the same cryptography 41.0.4 update was merged via PR #1271 in commit 431c7387.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cryptography](https://togithub.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==41.0.3` -> `==41.0.4` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [GHSA-v8gr-m533-ghj9](https://togithub.com/pyca/cryptography/security/advisories/GHSA-v8gr-m533-ghj9)
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 2.5-41.0.3 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230908.txt.
If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v41.0.4`](https://togithub.com/pyca/cryptography/compare/41.0.3...41.0.4)
[Compare Source](https://togithub.com/pyca/cryptography/compare/41.0.3...41.0.4)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "before 07:00" in timezone Etc/UTC.
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi45Ny4xIiwidXBkYXRlZEluVmVyIjoiMzYuOTcuMSIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Renovate security bump of cryptography 41.0.3 -> 41.0.4 was closed unmerged by @lengau on 2023-09-21 (flaky store test) in favour of #1271, which landed as commit 431c7387. | |
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged after a flaky store test; cryptography 41.0.3→41.0.4 was handled instead by merged PR #1271 in commit 431c7387. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without merging after failing a flaky store test. Superseded by PR #1271. Renovate will ignore this cryptography v41.0.4 update until a newer version is released. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Superseded by PR #1271 after failing a flaky store test. The cryptography v41.0.4 security update was closed without merging, and Renovate will ignore this specific version. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/charmcraft#1271
(confidence 99%)
Renovate bump PR that was merged as commit 431c7387 with identical 41.0.3 -> 41.0.4 change.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1164 chore(deps): update dependency cryptography to v41.0.2 [security] | charmcraft | merged | Merged cryptography 41.0.2 security update via commit 6d9dd818, replacing 41.0.0 to address CVE-2023-38325. | |
| #1120 chore(deps): update dependency cryptography to v41 [security] - autoclosed | charmcraft | closed | Autoclosed unmerged; the same cryptography 40.0.2→41.0.0 security update was merged via #1119 in commit 42365b41. | |
| #1537 chore(deps): update dependency cryptography to v42.0.4 [security] | charmcraft | closed | Renovate PR to bump cryptography 42.0.2->42.0.4 (CVE-2024-26130) was closed unmerged by lengau on 2024-02-22, deferred to a separate env-var change; the pin later moved to 42.0.5 via merged #1601 (545b8db5) and 42.0.8 in #1694. | |
| #1201 chore(deps): update dependency cryptography to v41.0.3 [security] | charmcraft | merged | Merged as commit 31f7281c, updating cryptography from 41.0.2 to 41.0.3 to address vulnerable OpenSSL bundled in its wheels. | |
| #4564 chore(deps): update dependency cryptography to v42 [security] | snapcraft | merged | Renovate bumped cryptography from 41.0.7 to 42.0.2 (fixing CVE-2023-50782 and CVE-2024-0727); PR #4564 was approved and squash-merged into main as commit ac421ab96. | |
| #4598 chore(deps): update dependency cryptography to v42.0.4 [security] | snapcraft | merged | Merged #4598 in commit 7cfb60986, upgrading cryptography from 42.0.2 to 42.0.4 to address CVE-2024-26130. | |
| #1396 chore(deps): update dependency cryptography to v41.0.6 [security] | charmcraft | merged | Merged PR #1396 upgraded cryptography from 41.0.4 to 41.0.6 via commit d8a889db, fixing the PKCS#7 NULL-pointer denial-of-service vulnerability CVE-2023-49083. | |
| #1529 chore(deps): update dependency cryptography to v42.0.2 [security] | charmcraft | merged | Renovate security bump of cryptography 42.0.1 -> 42.0.2 (CVE-2024-0727 PKCS12 DoS) merged to main as commit f80f2cd4, a 2-line requirements.txt pin change. | |
| #1056 chore(deps): update dependency cryptography to v39 [security] | charmcraft | closed | Renovate's cryptography 3.4.8->39.0.1 security bump was closed unmerged; maintainer lengau pointed to #1024, which merged as commit 96f6a183 upgrading to 39.0 (plus Rust build deps) and closing #991. | |
| #1057 chore(deps): update dependency cryptography [security] - autoclosed | charmcraft | closed | Renovate’s cryptography 3.4.8→39/40 update was autoclosed unmerged; PR #1119 (commit 42365b41) later merged 40.0.2→41.0.0, superseding it. |