build(deps): update dependency cryptography to v46 [security] (main) - autoclosed
Metadata
Current evaluation
Autoclosed without merging. The Renovate dependency update for cryptography to v46, intended to fix CVE-2026-26007, was abandoned. CI type checks flagged warnings, but the branch was never merged.
Suggested action: —
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [cryptography](https://redirect.github.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `~=44.0` → `~=46.0` |  |  |
### GitHub Vulnerability Alerts
#### [CVE-2026-26007](https://redirect.github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2)
## Vulnerability Summary
The `public_key_from_numbers` (or `EllipticCurvePublicNumbers.public_key()`), `EllipticCurvePublicNumbers.public_key()`, `load_der_public_key()` and `load_pem_public_key()` functions do not verify that the point belongs to the expected prime-order subgroup of the curve.
This missing validation allows an attacker to provide a public key point `P` from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as `S = [victim_private_key]P` via ECDH, this leaks information about `victim_private_key mod (small_subgroup_order)`. For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup.
Only SECT curves are impacted by this.
## Credit
This vulnerability was discovered by:
- XlabAI Team of Tencent Xuanwu Lab
- Atuin Automated Vulnerability Discovery Engine
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v46.0.5`](https://redirect.github.com/pyca/cryptography/compare/46.0.4...46.0.5)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.4...46.0.5)
### [`v46.0.4`](https://redirect.github.com/pyca/cryptography/compare/46.0.3...46.0.4)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.3...46.0.4)
### [`v46.0.3`](https://redirect.github.com/pyca/cryptography/compare/46.0.2...46.0.3)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.2...46.0.3)
### [`v46.0.2`](https://redirect.github.com/pyca/cryptography/compare/46.0.1...46.0.2)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.1...46.0.2)
### [`v46.0.1`](https://redirect.github.com/pyca/cryptography/compare/46.0.0...46.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.0...46.0.1)
### [`v46.0.0`](https://redirect.github.com/pyca/cryptography/compare/45.0.7...46.0.0)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.7...46.0.0)
### [`v45.0.7`](https://redirect.github.com/pyca/cryptography/compare/45.0.6...45.0.7)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.6...45.0.7)
### [`v45.0.6`](https://redirect.github.com/pyca/cryptography/compare/45.0.5...45.0.6)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.5...45.0.6)
### [`v45.0.5`](https://redirect.github.com/pyca/cryptography/compare/45.0.4...45.0.5)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.4...45.0.5)
### [`v45.0.4`](https://redirect.github.com/pyca/cryptography/compare/45.0.3...45.0.4)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.3...45.0.4)
### [`v45.0.3`](https://redirect.github.com/pyca/cryptography/compare/45.0.2...45.0.3)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.2...45.0.3)
### [`v45.0.2`](https://redirect.github.com/pyca/cryptography/compare/45.0.1...45.0.2)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.1...45.0.2)
### [`v45.0.1`](https://redirect.github.com/pyca/cryptography/compare/45.0.0...45.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.0...45.0.1)
### [`v45.0.0`](https://redirect.github.com/pyca/cryptography/compare/44.0.3...45.0.0)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.3...45.0.0)
### [`v44.0.3`](https://redirect.github.com/pyca/cryptography/compare/44.0.2...44.0.3)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.2...44.0.3)
### [`v44.0.2`](https://redirect.github.com/pyca/cryptography/compare/44.0.1...44.0.2)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.1...44.0.2)
### [`v44.0.1`](https://redirect.github.com/pyca/cryptography/compare/44.0.0...44.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.0...44.0.1)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45Ny4wIiwidXBkYXRlZEluVmVyIjoiNDMuMTUuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUFI6IERlcGVuZGVuY2llcyJdfQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Autoclosed without merging. The Renovate dependency update for cryptography to v46, intended to fix CVE-2026-26007, was abandoned. CI type checks flagged warnings, but the branch was never merged. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate dependency update to cryptography v46 was autoclosed. Repeated ty type-checking failures reported unresolved attribute errors, preventing merge. The security update was abandoned. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Automated dependency update to cryptography v46 addressing CVE-2026-26007 was autoclosed without merging. Repeated non-blocking type checking notifications appeared, but the change was abandoned. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2569 build(deps): update dependency cryptography to v46 [security] (hotfix/4.0) - autoclosed | charmcraft | closed | Dependency update for cryptography to v46 addressing CVE-2026-26007 was autoclosed without merging. Renovate discarded the branch, likely due to being superseded or failing CI checks. | |
| #2163 build(deps): update dependency cryptography to v44.0.1 [security] (main) - autoclosed | charmcraft | closed | Autoclosed by Renovate without review or merge. The security update for cryptography to v44.0.1 was abandoned. | |
| #2164 build(deps): update dependency cryptography to v44 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Security dependency update for cryptography to v44.0.1 via Renovate was autoclosed without review or merge. The pull request was abandoned due to inactivity. | |
| #2570 build(deps): update dependency cryptography to v46 [security] (hotfix/4.1) - autoclosed | charmcraft | closed | Renovate autoclosed this dependency update for cryptography v46 without merging. The PR addressed CVE-2026-26007 but was automatically closed, likely superseded or stale. No manual review occurred. | |
| #5253 build(deps): update dependency cryptography to v44 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | The dependency update pull request for cryptography v44 was autoclosed by Renovate without review or merge. No changes were applied. | |
| #5254 build(deps): update dependency cryptography to v44 [security] (hotfix/8.6) - autoclosed | snapcraft | closed | Renovate pull request updating cryptography to v44.0.1 to address CVE-2024-12797 was autoclosed without review or merge. The security update was abandoned. | |
| #5286 build(deps): update dependency cryptography to v44 [security] (main) - autoclosed | snapcraft | closed | Superseded and autoclosed by Renovate after being replaced by PR #5290. The cryptography dependency update to v44.0.1 was handled in the newer pull request. | |
| #2568 build(deps): update dependency cryptography to v46 [security] (hotfix/3.5) | charmcraft | closed | Closed and abandoned due to failing CI checks and lack of reviewer approval. The security update to cryptography v46 was not merged. | |
| #5252 build(deps): update dependency cryptography to v44 [security] (main) | snapcraft | closed | Closed without merging as a duplicate of #5251. The cryptography v44 security update was superseded by another PR. Renovate will ignore this update. | |
| #5011 build(deps): update dependency cryptography to v43 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Superseded by a newer dependency update and autoclosed by Renovate bot. The security patch updating cryptography to v43 was not manually merged. |