build(deps): update dependency cryptography to v43.0.1 [security] (hotfix/3.2)
Metadata
Current evaluation
Renovate security bump of cryptography 43.0.0 -> 43.0.1 merged into hotfix/3.2 as commit a98a8b4f, fixing vulnerable bundled OpenSSL (GHSA-h4gh-qq45-vh27). Sibling bumps landed via #1870 (438cafe0) and #1871.
Resolution: closed resolved
Reason: The PR was merged into hotfix/3.2, recorded as commit a98a8b4f 'build(deps): update dependency cryptography to v43.0.1 [security] (hotfix/3.2) (#1872)', bumping the pin from 43.0.0 to 43.0.1 to remediate GHSA-h4gh-qq45-vh27. It was approved by 2 reviewers with the single reviewer note that a Snap store test failure was unrelated.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cryptography](https://redirect.github.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==43.0.0` -> `==43.0.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [GHSA-h4gh-qq45-vh27](https://redirect.github.com/pyca/cryptography/security/advisories/GHSA-h4gh-qq45-vh27)
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-43.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20240903.txt.
If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v43.0.1`](https://redirect.github.com/pyca/cryptography/compare/43.0.0...43.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/43.0.0...43.0.1)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC41OS4yIiwidXBkYXRlZEluVmVyIjoiMzguNTkuMiIsInRhcmdldEJyYW5jaCI6ImhvdGZpeC8zLjIiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Renovate security bump of cryptography 43.0.0 -> 43.0.1 merged into hotfix/3.2 as commit a98a8b4f, fixing vulnerable bundled OpenSSL (GHSA-h4gh-qq45-vh27). Sibling bumps landed via #1870 (438cafe0) and #1871. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1872 (commit a98a8b4f) updated hotfix/3.2's cryptography pin from 43.0.0 to 43.0.1, addressing GHSA-h4gh-qq45-vh27's vulnerable bundled OpenSSL. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged security hotfix updating cryptography from v43.0.0 to v43.0.1 on hotfix/3.2. Addresses OpenSSL vulnerability GHSA-h4gh-qq45-vh27 in pre-built wheels. Approved by two reviewers and passed CI checks prior to merge. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged security hotfix updating cryptography to v43.0.1 on hotfix/3.2. Patches GHSA-h4gh-qq45-vh27 OpenSSL vulnerability in prebuilt wheels. Automated via Renovate bot. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/charmcraft#1870
(confidence 95%)
Same cryptography 43.0.1 security bump merged to main as commit 438cafe0.
-
Related To:
canonical/charmcraft#1871
(confidence 93%)
Same cryptography security bump backported to hotfix/2.7 as commit 2fa3602f.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1871 build(deps): update dependency cryptography to v43 [security] (hotfix/2.7) | charmcraft | merged | Renovate security bump of cryptography 41.0.7 -> 43.0.1 merged into hotfix/2.7 as commit 2fa3602f, fixing GHSA-h4gh-qq45-vh27 (vulnerable OpenSSL bundled in cryptography wheels). | |
| #1870 build(deps): update dependency cryptography to v43.0.1 [security] (main) | charmcraft | merged | Merged #1870, bumping cryptography from 43.0.0 to 43.0.1 to address GHSA-h4gh-qq45-vh27; mainline merge commit: 438cafe0. | |
| #5010 build(deps): update dependency cryptography to v43.0.1 [security] (main) | snapcraft | merged | Merged PR #5010 in commit 31bec5200, updating cryptography 43.0.0 to 43.0.1 to address OpenSSL vulnerability GHSA-h4gh-qq45-vh27. | |
| #5012 build(deps): update dependency cryptography to v43 [security] (hotfix/8.3) - abandoned | snapcraft | closed | Cryptography 43.0.1 hotfix/8.3 bump was abandoned and closed unmerged; the equivalent main-branch security update merged via #5010 (31bec5200). | |
| #2165 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.3) - autoclosed | charmcraft | closed | Renovate PR #2165 was autoclosed unmerged without CI or comments; cryptography 44.0.1 was later merged on main through #2189 (bba6a32e). | |
| #5011 build(deps): update dependency cryptography to v43 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Autoclosed unmerged on hotfix/7.5; the same cryptography 43.0.1 security update was merged to main in canonical/snapcraft#5010 via commit 31bec5200. | |
| #2166 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Renovate's cryptography 44.0.1 security bump for hotfix/3.4 was auto-closed unmerged after 598 days; no resolving commit or CI run was recorded. | |
| #5252 build(deps): update dependency cryptography to v44 [security] (main) | snapcraft | closed | Closed unmerged as a duplicate of #5251, which proposed the same cryptography 43.0.3 to 44.0.1 security update. | |
| #1098 build(deps): bump cryptography | craft-application | merged | Merged in #1098 via commit 239b3af7, updating cryptography 48.0.0 to 49.0.0 to resolve OSV GHSA-537c-gmf6-5ccf. | |
| #2570 build(deps): update dependency cryptography to v46 [security] (hotfix/4.1) - autoclosed | charmcraft | closed | Autoclosed unmerged after 219 days; cryptography 46 later landed on main via #2583 (e66a25b5) and was advanced to 46.0.6 by #2617. |