build(deps): update dependency cryptography to v46 [security] (main) - autoclosed
Metadata
Current evaluation
Autoclosed unmerged; the cryptography 46.0.5 update was included in bulk dependency PR #2583 and merged as commit e66a25b5.
Resolution: closed superseded
Reason: PR #2567 was replaced by dependency PR #2583, which merged the cryptography update in commit e66a25b5.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [cryptography](https://redirect.github.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `~=44.0` → `~=46.0` |  |  |
### GitHub Vulnerability Alerts
#### [CVE-2026-26007](https://redirect.github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2)
## Vulnerability Summary
The `public_key_from_numbers` (or `EllipticCurvePublicNumbers.public_key()`), `EllipticCurvePublicNumbers.public_key()`, `load_der_public_key()` and `load_pem_public_key()` functions do not verify that the point belongs to the expected prime-order subgroup of the curve.
This missing validation allows an attacker to provide a public key point `P` from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as `S = [victim_private_key]P` via ECDH, this leaks information about `victim_private_key mod (small_subgroup_order)`. For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup.
Only SECT curves are impacted by this.
## Credit
This vulnerability was discovered by:
- XlabAI Team of Tencent Xuanwu Lab
- Atuin Automated Vulnerability Discovery Engine
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v46.0.5`](https://redirect.github.com/pyca/cryptography/compare/46.0.4...46.0.5)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.4...46.0.5)
### [`v46.0.4`](https://redirect.github.com/pyca/cryptography/compare/46.0.3...46.0.4)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.3...46.0.4)
### [`v46.0.3`](https://redirect.github.com/pyca/cryptography/compare/46.0.2...46.0.3)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.2...46.0.3)
### [`v46.0.2`](https://redirect.github.com/pyca/cryptography/compare/46.0.1...46.0.2)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.1...46.0.2)
### [`v46.0.1`](https://redirect.github.com/pyca/cryptography/compare/46.0.0...46.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.0...46.0.1)
### [`v46.0.0`](https://redirect.github.com/pyca/cryptography/compare/45.0.7...46.0.0)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.7...46.0.0)
### [`v45.0.7`](https://redirect.github.com/pyca/cryptography/compare/45.0.6...45.0.7)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.6...45.0.7)
### [`v45.0.6`](https://redirect.github.com/pyca/cryptography/compare/45.0.5...45.0.6)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.5...45.0.6)
### [`v45.0.5`](https://redirect.github.com/pyca/cryptography/compare/45.0.4...45.0.5)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.4...45.0.5)
### [`v45.0.4`](https://redirect.github.com/pyca/cryptography/compare/45.0.3...45.0.4)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.3...45.0.4)
### [`v45.0.3`](https://redirect.github.com/pyca/cryptography/compare/45.0.2...45.0.3)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.2...45.0.3)
### [`v45.0.2`](https://redirect.github.com/pyca/cryptography/compare/45.0.1...45.0.2)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.1...45.0.2)
### [`v45.0.1`](https://redirect.github.com/pyca/cryptography/compare/45.0.0...45.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.0...45.0.1)
### [`v45.0.0`](https://redirect.github.com/pyca/cryptography/compare/44.0.3...45.0.0)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.3...45.0.0)
### [`v44.0.3`](https://redirect.github.com/pyca/cryptography/compare/44.0.2...44.0.3)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.2...44.0.3)
### [`v44.0.2`](https://redirect.github.com/pyca/cryptography/compare/44.0.1...44.0.2)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.1...44.0.2)
### [`v44.0.1`](https://redirect.github.com/pyca/cryptography/compare/44.0.0...44.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.0...44.0.1)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45Ny4wIiwidXBkYXRlZEluVmVyIjoiNDMuMTUuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUFI6IERlcGVuZGVuY2llcyJdfQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Autoclosed unmerged; the cryptography 46.0.5 update was included in bulk dependency PR #2583 and merged as commit e66a25b5. | |
| stealth/space-bunny-alpha | — | closed superseded | Renovate PR #2567 was autoclosed unmerged; its cryptography 46.0.5 update landed via bulk dependency PR #2583 (commit e66a25b5). | |
| stealth/space-bunny-alpha | — | closed superseded | Autoclosed unmerged; cryptography 46.0.5 was instead included in the bulk dependency update merged via #2583 (commit e66a25b5). | |
| stealth/space-bunny-alpha | — | closed superseded | The cryptography 46 security update was autoclosed unmerged after landing through #2583 in commit e66a25b5. | |
| stealth/space-bunny-alpha | — | closed superseded | Autoclosed unmerged; the main-branch cryptography 46.0.5 update instead landed in dependency PR #2583 (commit e66a25b5). | |
| qwen/qwen3.6-35b-a3b | — | — | Autoclosed without merging. The Renovate dependency update for cryptography to v46, intended to fix CVE-2026-26007, was abandoned. CI type checks flagged warnings, but the branch was never merged. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate dependency update to cryptography v46 was autoclosed. Repeated ty type-checking failures reported unresolved attribute errors, preventing merge. The security update was abandoned. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/charmcraft#2583
(confidence 99%)
Merged bulk dependency update containing the cryptography 46.0.5 change.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2570 build(deps): update dependency cryptography to v46 [security] (hotfix/4.1) - autoclosed | charmcraft | closed | Autoclosed unmerged after 219 days; cryptography 46 later landed on main via #2583 (e66a25b5) and was advanced to 46.0.6 by #2617. | |
| #2163 build(deps): update dependency cryptography to v44.0.1 [security] (main) - autoclosed | charmcraft | closed | Renovate PR #2163 was autoclosed unmerged; the cryptography 44.0.1 update was instead merged through #2189 at commit bba6a32e. | |
| #2165 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.3) - autoclosed | charmcraft | closed | Renovate PR #2165 was autoclosed unmerged without CI or comments; cryptography 44.0.1 was later merged on main through #2189 (bba6a32e). | |
| #5286 build(deps): update dependency cryptography to v44 [security] (main) - autoclosed | snapcraft | closed | Cryptography 44.0.1 update was not merged; PR #5286 was autoclosed after @mr-cal redirected the update to #5290. | |
| #2569 build(deps): update dependency cryptography to v46 [security] (hotfix/4.0) - autoclosed | charmcraft | closed | Renovate autoclosed the unmerged hotfix/4.0 cryptography v44-to-v46 security update; no review or resolving commit was recorded. | |
| #2568 build(deps): update dependency cryptography to v46 [security] (hotfix/3.5) | charmcraft | closed | Cryptography v46 update for hotfix/3.5 was closed unmerged after 219 days without activity or approval; five CI checks failed. The equivalent main-branch update later merged in #2583. | |
| #5252 build(deps): update dependency cryptography to v44 [security] (main) | snapcraft | closed | Closed unmerged as a duplicate of #5251, which proposed the same cryptography 43.0.3 to 44.0.1 security update. | |
| #2166 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Renovate's cryptography 44.0.1 security bump for hotfix/3.4 was auto-closed unmerged after 598 days; no resolving commit or CI run was recorded. | |
| #5011 build(deps): update dependency cryptography to v43 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Autoclosed unmerged on hotfix/7.5; the same cryptography 43.0.1 security update was merged to main in canonical/snapcraft#5010 via commit 31bec5200. | |
| #5253 build(deps): update dependency cryptography to v44 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Renovate's cryptography 44.0.1 hotfix/7.5 update was autoclosed unmerged after prolonged inactivity; no review, CI result, or resolving commit was recorded. |