build(deps): update dependency cryptography to v46 [security] (hotfix/4.0) - autoclosed
Metadata
Current evaluation
Renovate autoclosed the unmerged hotfix/4.0 cryptography v44-to-v46 security update; no review or resolving commit was recorded.
Resolution: closed stale
Reason: The abandoned PR received no review before Renovate autoclosed it. The later dependency update merged as commit e66a25b5 (PR #2583) and moved main to cryptography 46.0.5.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [cryptography](https://redirect.github.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `~=44.0` → `~=46.0` |  |  |
### GitHub Vulnerability Alerts
#### [CVE-2026-26007](https://redirect.github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2)
## Vulnerability Summary
The `public_key_from_numbers` (or `EllipticCurvePublicNumbers.public_key()`), `EllipticCurvePublicNumbers.public_key()`, `load_der_public_key()` and `load_pem_public_key()` functions do not verify that the point belongs to the expected prime-order subgroup of the curve.
This missing validation allows an attacker to provide a public key point `P` from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as `S = [victim_private_key]P` via ECDH, this leaks information about `victim_private_key mod (small_subgroup_order)`. For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup.
Only SECT curves are impacted by this.
## Credit
This vulnerability was discovered by:
- XlabAI Team of Tencent Xuanwu Lab
- Atuin Automated Vulnerability Discovery Engine
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v46.0.5`](https://redirect.github.com/pyca/cryptography/compare/46.0.4...46.0.5)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.4...46.0.5)
### [`v46.0.4`](https://redirect.github.com/pyca/cryptography/compare/46.0.3...46.0.4)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.3...46.0.4)
### [`v46.0.3`](https://redirect.github.com/pyca/cryptography/compare/46.0.2...46.0.3)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.2...46.0.3)
### [`v46.0.2`](https://redirect.github.com/pyca/cryptography/compare/46.0.1...46.0.2)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.1...46.0.2)
### [`v46.0.1`](https://redirect.github.com/pyca/cryptography/compare/46.0.0...46.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.0...46.0.1)
### [`v46.0.0`](https://redirect.github.com/pyca/cryptography/compare/45.0.7...46.0.0)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.7...46.0.0)
### [`v45.0.7`](https://redirect.github.com/pyca/cryptography/compare/45.0.6...45.0.7)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.6...45.0.7)
### [`v45.0.6`](https://redirect.github.com/pyca/cryptography/compare/45.0.5...45.0.6)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.5...45.0.6)
### [`v45.0.5`](https://redirect.github.com/pyca/cryptography/compare/45.0.4...45.0.5)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.4...45.0.5)
### [`v45.0.4`](https://redirect.github.com/pyca/cryptography/compare/45.0.3...45.0.4)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.3...45.0.4)
### [`v45.0.3`](https://redirect.github.com/pyca/cryptography/compare/45.0.2...45.0.3)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.2...45.0.3)
### [`v45.0.2`](https://redirect.github.com/pyca/cryptography/compare/45.0.1...45.0.2)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.1...45.0.2)
### [`v45.0.1`](https://redirect.github.com/pyca/cryptography/compare/45.0.0...45.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.0...45.0.1)
### [`v45.0.0`](https://redirect.github.com/pyca/cryptography/compare/44.0.3...45.0.0)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.3...45.0.0)
### [`v44.0.3`](https://redirect.github.com/pyca/cryptography/compare/44.0.2...44.0.3)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.2...44.0.3)
### [`v44.0.2`](https://redirect.github.com/pyca/cryptography/compare/44.0.1...44.0.2)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.1...44.0.2)
### [`v44.0.1`](https://redirect.github.com/pyca/cryptography/compare/44.0.0...44.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.0...44.0.1)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45Ny4wIiwidXBkYXRlZEluVmVyIjoiNDMuMTUuMyIsInRhcmdldEJyYW5jaCI6ImhvdGZpeC80LjAiLCJsYWJlbHMiOlsiUFI6IERlcGVuZGVuY2llcyJdfQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Renovate autoclosed the unmerged hotfix/4.0 cryptography v44-to-v46 security update; no review or resolving commit was recorded. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate autoclosed the unmerged hotfix/4.0 cryptography v44-to-v46 security update; no review, comments, or resolving commit were recorded. | |
| qwen/qwen3.6-35b-a3b | — | — | Dependency update for cryptography to v46 addressing CVE-2026-26007 was autoclosed without merging. Renovate discarded the branch, likely due to being superseded or failing CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate bot PR updating cryptography to v46 to address CVE-2026-26007 was autoclosed. The security dependency update was not merged. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
charmcraft#2583
(confidence 88%)
The later bulk dependency update reached cryptography 46.0.5 on main, replacing the abandoned hotfix PR.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2164 build(deps): update dependency cryptography to v44 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate's cryptography 44.0.1 hotfix update was autoclosed unmerged after inactivity; no review, CI, or resolving commit was recorded. | |
| #5253 build(deps): update dependency cryptography to v44 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Renovate's cryptography 44.0.1 hotfix/7.5 update was autoclosed unmerged after prolonged inactivity; no review, CI result, or resolving commit was recorded. | |
| #2166 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Renovate's cryptography 44.0.1 security bump for hotfix/3.4 was auto-closed unmerged after 598 days; no resolving commit or CI run was recorded. | |
| #5254 build(deps): update dependency cryptography to v44 [security] (hotfix/8.6) - autoclosed | snapcraft | closed | Renovate’s cryptography 44.0.1 security update for hotfix/8.6 was autoclosed unmerged after 588 days, with no review, CI result, or replacement recorded. | |
| #2570 build(deps): update dependency cryptography to v46 [security] (hotfix/4.1) - autoclosed | charmcraft | closed | Autoclosed unmerged after 219 days; cryptography 46 later landed on main via #2583 (e66a25b5) and was advanced to 46.0.6 by #2617. | |
| #2165 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.3) - autoclosed | charmcraft | closed | Renovate PR #2165 was autoclosed unmerged without CI or comments; cryptography 44.0.1 was later merged on main through #2189 (bba6a32e). | |
| #2567 build(deps): update dependency cryptography to v46 [security] (main) - autoclosed | charmcraft | closed | Autoclosed unmerged; the cryptography 46.0.5 update was included in bulk dependency PR #2583 and merged as commit e66a25b5. | |
| #2163 build(deps): update dependency cryptography to v44.0.1 [security] (main) - autoclosed | charmcraft | closed | Renovate PR #2163 was autoclosed unmerged; the cryptography 44.0.1 update was instead merged through #2189 at commit bba6a32e. | |
| #2568 build(deps): update dependency cryptography to v46 [security] (hotfix/3.5) | charmcraft | closed | Cryptography v46 update for hotfix/3.5 was closed unmerged after 219 days without activity or approval; five CI checks failed. The equivalent main-branch update later merged in #2583. | |
| #5011 build(deps): update dependency cryptography to v43 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Autoclosed unmerged on hotfix/7.5; the same cryptography 43.0.1 security update was merged to main in canonical/snapcraft#5010 via commit 31bec5200. |