build(deps): update dependency cryptography to v46 [security] (hotfix/3.5)
Metadata
Current evaluation
Cryptography v46 update for hotfix/3.5 was closed unmerged after 219 days without activity or approval; five CI checks failed. The equivalent main-branch update later merged in #2583.
Resolution: closed stale
Reason: Repository history records #2568 as closed unmerged after prolonged inactivity, with no review and five failing checks. The cryptography 46.0.5 update was merged separately on main by #2583 in commit e66a25b5.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [cryptography](https://redirect.github.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `~=44.0` → `~=46.0` |  |  |
### GitHub Vulnerability Alerts
#### [CVE-2026-26007](https://redirect.github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2)
## Vulnerability Summary
The `public_key_from_numbers` (or `EllipticCurvePublicNumbers.public_key()`), `EllipticCurvePublicNumbers.public_key()`, `load_der_public_key()` and `load_pem_public_key()` functions do not verify that the point belongs to the expected prime-order subgroup of the curve.
This missing validation allows an attacker to provide a public key point `P` from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as `S = [victim_private_key]P` via ECDH, this leaks information about `victim_private_key mod (small_subgroup_order)`. For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup.
Only SECT curves are impacted by this.
## Credit
This vulnerability was discovered by:
- XlabAI Team of Tencent Xuanwu Lab
- Atuin Automated Vulnerability Discovery Engine
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v46.0.5`](https://redirect.github.com/pyca/cryptography/compare/46.0.4...46.0.5)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.4...46.0.5)
### [`v46.0.4`](https://redirect.github.com/pyca/cryptography/compare/46.0.3...46.0.4)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.3...46.0.4)
### [`v46.0.3`](https://redirect.github.com/pyca/cryptography/compare/46.0.2...46.0.3)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.2...46.0.3)
### [`v46.0.2`](https://redirect.github.com/pyca/cryptography/compare/46.0.1...46.0.2)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.1...46.0.2)
### [`v46.0.1`](https://redirect.github.com/pyca/cryptography/compare/46.0.0...46.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.0...46.0.1)
### [`v46.0.0`](https://redirect.github.com/pyca/cryptography/compare/45.0.7...46.0.0)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.7...46.0.0)
### [`v45.0.7`](https://redirect.github.com/pyca/cryptography/compare/45.0.6...45.0.7)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.6...45.0.7)
### [`v45.0.6`](https://redirect.github.com/pyca/cryptography/compare/45.0.5...45.0.6)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.5...45.0.6)
### [`v45.0.5`](https://redirect.github.com/pyca/cryptography/compare/45.0.4...45.0.5)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.4...45.0.5)
### [`v45.0.4`](https://redirect.github.com/pyca/cryptography/compare/45.0.3...45.0.4)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.3...45.0.4)
### [`v45.0.3`](https://redirect.github.com/pyca/cryptography/compare/45.0.2...45.0.3)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.2...45.0.3)
### [`v45.0.2`](https://redirect.github.com/pyca/cryptography/compare/45.0.1...45.0.2)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.1...45.0.2)
### [`v45.0.1`](https://redirect.github.com/pyca/cryptography/compare/45.0.0...45.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.0...45.0.1)
### [`v45.0.0`](https://redirect.github.com/pyca/cryptography/compare/44.0.3...45.0.0)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.3...45.0.0)
### [`v44.0.3`](https://redirect.github.com/pyca/cryptography/compare/44.0.2...44.0.3)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.2...44.0.3)
### [`v44.0.2`](https://redirect.github.com/pyca/cryptography/compare/44.0.1...44.0.2)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.1...44.0.2)
### [`v44.0.1`](https://redirect.github.com/pyca/cryptography/compare/44.0.0...44.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.0...44.0.1)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45Ny4wIiwidXBkYXRlZEluVmVyIjoiNDMuMTUuMyIsInRhcmdldEJyYW5jaCI6ImhvdGZpeC8zLjUiLCJsYWJlbHMiOlsiUFI6IERlcGVuZGVuY2llcyJdfQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Cryptography v46 update for hotfix/3.5 was closed unmerged after 219 days without activity or approval; five CI checks failed. The equivalent main-branch update later merged in #2583. | |
| stealth/space-bunny-alpha | — | closed stale | cryptography v46 security update for hotfix/3.5 (PR #2568) was closed unmerged after 219 days without activity, with no approval and five failing CI checks. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate’s cryptography v46 security update for hotfix/3.5 was closed unmerged after failing macOS checks and receiving no reviewer approval. | |
| stealth/space-bunny-alpha | — | closed stale | PR #2568's cryptography v46 security update for hotfix/3.5 was closed unmerged with macOS build/test and smoke-test failures; no reviews or comments were recorded. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed and abandoned due to failing CI checks and lack of reviewer approval. The security update to cryptography v46 was not merged. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed without merge, likely superseded or abandoned. The update targeted cryptography v46 to address CVE-2026-26007. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/charmcraft#2583
(confidence 90%)
Merged the equivalent cryptography 46.0.5 update on main in e66a25b5, rather than resolving the hotfix/3.5 PR.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2570 build(deps): update dependency cryptography to v46 [security] (hotfix/4.1) - autoclosed | charmcraft | closed | Autoclosed unmerged after 219 days; cryptography 46 later landed on main via #2583 (e66a25b5) and was advanced to 46.0.6 by #2617. | |
| #5012 build(deps): update dependency cryptography to v43 [security] (hotfix/8.3) - abandoned | snapcraft | closed | Cryptography 43.0.1 hotfix/8.3 bump was abandoned and closed unmerged; the equivalent main-branch security update merged via #5010 (31bec5200). | |
| #2569 build(deps): update dependency cryptography to v46 [security] (hotfix/4.0) - autoclosed | charmcraft | closed | Renovate autoclosed the unmerged hotfix/4.0 cryptography v44-to-v46 security update; no review or resolving commit was recorded. | |
| #2567 build(deps): update dependency cryptography to v46 [security] (main) - autoclosed | charmcraft | closed | Autoclosed unmerged; the cryptography 46.0.5 update was included in bulk dependency PR #2583 and merged as commit e66a25b5. | |
| #2165 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.3) - autoclosed | charmcraft | closed | Renovate PR #2165 was autoclosed unmerged without CI or comments; cryptography 44.0.1 was later merged on main through #2189 (bba6a32e). | |
| #2166 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Renovate's cryptography 44.0.1 security bump for hotfix/3.4 was auto-closed unmerged after 598 days; no resolving commit or CI run was recorded. | |
| #5254 build(deps): update dependency cryptography to v44 [security] (hotfix/8.6) - autoclosed | snapcraft | closed | Renovate’s cryptography 44.0.1 security update for hotfix/8.6 was autoclosed unmerged after 588 days, with no review, CI result, or replacement recorded. | |
| #5253 build(deps): update dependency cryptography to v44 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Renovate's cryptography 44.0.1 hotfix/7.5 update was autoclosed unmerged after prolonged inactivity; no review, CI result, or resolving commit was recorded. | |
| #2164 build(deps): update dependency cryptography to v44 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate's cryptography 44.0.1 hotfix update was autoclosed unmerged after inactivity; no review, CI, or resolving commit was recorded. | |
| #162 build(deps): update dependency cryptography to v49 (main) | starflow | closed | Cryptography 49.0.0 update was closed unmerged after 80 days; no resolving commit or replacement PR was found. |