build(deps): update dependency cryptography to v43.0.1 [security] (main)
Metadata
Current evaluation
Merged #1870, bumping cryptography from 43.0.0 to 43.0.1 to address GHSA-h4gh-qq45-vh27; mainline merge commit: 438cafe0.
Resolution: closed resolved
Reason: PR #1870 was merged into main as commit 438cafe0, updating the cryptography dependency to the patched 43.0.1 release.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cryptography](https://redirect.github.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==43.0.0` -> `==43.0.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [GHSA-h4gh-qq45-vh27](https://redirect.github.com/pyca/cryptography/security/advisories/GHSA-h4gh-qq45-vh27)
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-43.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20240903.txt.
If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v43.0.1`](https://redirect.github.com/pyca/cryptography/compare/43.0.0...43.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/43.0.0...43.0.1)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC41OS4yIiwidXBkYXRlZEluVmVyIjoiMzguNTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged #1870, bumping cryptography from 43.0.0 to 43.0.1 to address GHSA-h4gh-qq45-vh27; mainline merge commit: 438cafe0. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #1870 as 438cafe0, updating cryptography from 43.0.0 to 43.0.1 on main to remediate GHSA-h4gh-qq45-vh27. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged automated dependency update to cryptography v43.0.1 to address a security vulnerability in OpenSSL wheels. Approved by two reviewers, passed CI checks, and merged to main. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Automatically merged into main, upgrading cryptography from v43.0.0 to v43.0.1 to patch an OpenSSL vulnerability in prebuilt wheels. The update was applied via Renovate with automerge enabled. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/charmcraft#1871
(confidence 100%)
Parallel cryptography v43 security update for hotfix/2.7, merged as 2fa3602f.
-
Related To:
canonical/charmcraft#1872
(confidence 100%)
Parallel cryptography v43.0.1 security update for hotfix/3.2, merged as a98a8b4f.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #5010 build(deps): update dependency cryptography to v43.0.1 [security] (main) | snapcraft | merged | Merged PR #5010 in commit 31bec5200, updating cryptography 43.0.0 to 43.0.1 to address OpenSSL vulnerability GHSA-h4gh-qq45-vh27. | |
| #1872 build(deps): update dependency cryptography to v43.0.1 [security] (hotfix/3.2) | charmcraft | merged | Renovate security bump of cryptography 43.0.0 -> 43.0.1 merged into hotfix/3.2 as commit a98a8b4f, fixing vulnerable bundled OpenSSL (GHSA-h4gh-qq45-vh27). Sibling bumps landed via #1870 (438cafe0) and #1871. | |
| #5252 build(deps): update dependency cryptography to v44 [security] (main) | snapcraft | closed | Closed unmerged as a duplicate of #5251, which proposed the same cryptography 43.0.3 to 44.0.1 security update. | |
| #1871 build(deps): update dependency cryptography to v43 [security] (hotfix/2.7) | charmcraft | merged | Renovate security bump of cryptography 41.0.7 -> 43.0.1 merged into hotfix/2.7 as commit 2fa3602f, fixing GHSA-h4gh-qq45-vh27 (vulnerable OpenSSL bundled in cryptography wheels). | |
| #5012 build(deps): update dependency cryptography to v43 [security] (hotfix/8.3) - abandoned | snapcraft | closed | Cryptography 43.0.1 hotfix/8.3 bump was abandoned and closed unmerged; the equivalent main-branch security update merged via #5010 (31bec5200). | |
| #2163 build(deps): update dependency cryptography to v44.0.1 [security] (main) - autoclosed | charmcraft | closed | Renovate PR #2163 was autoclosed unmerged; the cryptography 44.0.1 update was instead merged through #2189 at commit bba6a32e. | |
| #2165 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.3) - autoclosed | charmcraft | closed | Renovate PR #2165 was autoclosed unmerged without CI or comments; cryptography 44.0.1 was later merged on main through #2189 (bba6a32e). | |
| #5011 build(deps): update dependency cryptography to v43 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Autoclosed unmerged on hotfix/7.5; the same cryptography 43.0.1 security update was merged to main in canonical/snapcraft#5010 via commit 31bec5200. | |
| #2162 build(deps-dev): bump cryptography from 44.0.0 to 44.0.1 | charmcraft | merged | Merged the cryptography development dependency from 44.0.0 to 44.0.1 in commit e055bf84. | |
| #1395 build(deps): bump cryptography from 41.0.4 to 41.0.6 | charmcraft | closed | Closed unmerged as redundant after commit d8a889db had already updated cryptography to v41.0.6; Dependabot confirmed the dependency was current. |