← Back to issue list

build(deps): update dependency cryptography to v46 [security] (hotfix/4.1) - autoclosed

View original Github issue

Metadata

Project
charmcraft
Number
#2570
Type
pull request
State
closed
Author
renovate[bot]
Labels
PR: Dependencies
Created
Updated
Closed

Current evaluation

Autoclosed unmerged after 219 days; cryptography 46 later landed on main via #2583 (e66a25b5) and was advanced to 46.0.6 by #2617.

Resolution: closed stale

Reason: Renovate autoclosed #2570 without merging it after 219 days, with no maintainer resolution. Main independently received cryptography 46.0.5 in merged #2583, then 46.0.6 in #2617.

Evaluated by: mr-cal-bot

No scores available.

Issue body

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [cryptography](https://redirect.github.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `~=44.0` → `~=46.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/cryptography/46.0.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/cryptography/44.0.0/46.0.5?slim=true) | ### GitHub Vulnerability Alerts #### [CVE-2026-26007](https://redirect.github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2) ## Vulnerability Summary The `public_key_from_numbers` (or `EllipticCurvePublicNumbers.public_key()`), `EllipticCurvePublicNumbers.public_key()`, `load_der_public_key()` and `load_pem_public_key()` functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point `P` from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as `S = [victim_private_key]P` via ECDH, this leaks information about `victim_private_key mod (small_subgroup_order)`. For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. ## Credit This vulnerability was discovered by: - XlabAI Team of Tencent Xuanwu Lab - Atuin Automated Vulnerability Discovery Engine --- ### Release Notes <details> <summary>pyca/cryptography (cryptography)</summary> ### [`v46.0.5`](https://redirect.github.com/pyca/cryptography/compare/46.0.4...46.0.5) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.4...46.0.5) ### [`v46.0.4`](https://redirect.github.com/pyca/cryptography/compare/46.0.3...46.0.4) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.3...46.0.4) ### [`v46.0.3`](https://redirect.github.com/pyca/cryptography/compare/46.0.2...46.0.3) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.2...46.0.3) ### [`v46.0.2`](https://redirect.github.com/pyca/cryptography/compare/46.0.1...46.0.2) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.1...46.0.2) ### [`v46.0.1`](https://redirect.github.com/pyca/cryptography/compare/46.0.0...46.0.1) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/46.0.0...46.0.1) ### [`v46.0.0`](https://redirect.github.com/pyca/cryptography/compare/45.0.7...46.0.0) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.7...46.0.0) ### [`v45.0.7`](https://redirect.github.com/pyca/cryptography/compare/45.0.6...45.0.7) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.6...45.0.7) ### [`v45.0.6`](https://redirect.github.com/pyca/cryptography/compare/45.0.5...45.0.6) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.5...45.0.6) ### [`v45.0.5`](https://redirect.github.com/pyca/cryptography/compare/45.0.4...45.0.5) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.4...45.0.5) ### [`v45.0.4`](https://redirect.github.com/pyca/cryptography/compare/45.0.3...45.0.4) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.3...45.0.4) ### [`v45.0.3`](https://redirect.github.com/pyca/cryptography/compare/45.0.2...45.0.3) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.2...45.0.3) ### [`v45.0.2`](https://redirect.github.com/pyca/cryptography/compare/45.0.1...45.0.2) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.1...45.0.2) ### [`v45.0.1`](https://redirect.github.com/pyca/cryptography/compare/45.0.0...45.0.1) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/45.0.0...45.0.1) ### [`v45.0.0`](https://redirect.github.com/pyca/cryptography/compare/44.0.3...45.0.0) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.3...45.0.0) ### [`v44.0.3`](https://redirect.github.com/pyca/cryptography/compare/44.0.2...44.0.3) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.2...44.0.3) ### [`v44.0.2`](https://redirect.github.com/pyca/cryptography/compare/44.0.1...44.0.2) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.1...44.0.2) ### [`v44.0.1`](https://redirect.github.com/pyca/cryptography/compare/44.0.0...44.0.1) [Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.0...44.0.1) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/charmcraft). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45Ny4wIiwidXBkYXRlZEluVmVyIjoiNDMuMTUuMyIsInRhcmdldEJyYW5jaCI6ImhvdGZpeC80LjEiLCJsYWJlbHMiOlsiUFI6IERlcGVuZGVuY2llcyJdfQ==-->

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed stale Autoclosed unmerged after 219 days; cryptography 46 later landed on main via #2583 (e66a25b5) and was advanced to 46.0.6 by #2617.
stealth/space-bunny-alpha — closed superseded Renovate's cryptography 46 hotfix PR was autoclosed unmerged; #2583 later updated main to 46.0.5, followed by #2617 upgrading it to 46.0.6.
stealth/space-bunny-alpha — closed stale Renovate's #2570 was autoclosed unmerged after 219 days; cryptography 46 later landed on main through #2583 (e66a25b5), followed by 46.0.6 in #2617.
stealth/space-bunny-alpha — closed stale Renovate’s cryptography v46 hotfix/4.1 PR was autoclosed unmerged after 219 days; main later reached 46.0.5 in #2583 and 46.0.6 in #2617.
qwen/qwen3.6-35b-a3b — — Renovate autoclosed this dependency update for cryptography v46 without merging. The PR addressed CVE-2026-26007 but was automatically closed, likely superseded or stale. No manual review occurred.
qwen3.6-35b-a3b-mtp-q6 — — Renovate opened a PR to update cryptography to v46 addressing CVE-2026-26007. The pull request was autoclosed by the bot without merging, likely due to target branch deletion or automatic cleanup.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/charmcraft#2617 (confidence 98%)

    Merged follow-up upgraded cryptography from 46.0.5 to 46.0.6 in commit ba2c0c9a.

  • Likely Fixed By: canonical/charmcraft#2583 (confidence 95%)

    Merged bulk dependency update brought main to cryptography 46.0.5 in commit e66a25b5.

Related issues

Issue Project State Summary Similarity
#2567 build(deps): update dependency cryptography to v46 [security] (main) - autoclosed charmcraft closed Autoclosed unmerged; the cryptography 46.0.5 update was included in bulk dependency PR #2583 and merged as commit e66a25b5.
94%
#2568 build(deps): update dependency cryptography to v46 [security] (hotfix/3.5) charmcraft closed Cryptography v46 update for hotfix/3.5 was closed unmerged after 219 days without activity or approval; five CI checks failed. The equivalent main-branch update later merged in #2583.
93%
#2569 build(deps): update dependency cryptography to v46 [security] (hotfix/4.0) - autoclosed charmcraft closed Renovate autoclosed the unmerged hotfix/4.0 cryptography v44-to-v46 security update; no review or resolving commit was recorded.
92%
#2165 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.3) - autoclosed charmcraft closed Renovate PR #2165 was autoclosed unmerged without CI or comments; cryptography 44.0.1 was later merged on main through #2189 (bba6a32e).
91%
#2163 build(deps): update dependency cryptography to v44.0.1 [security] (main) - autoclosed charmcraft closed Renovate PR #2163 was autoclosed unmerged; the cryptography 44.0.1 update was instead merged through #2189 at commit bba6a32e.
90%
#2166 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.4) - autoclosed charmcraft closed Renovate's cryptography 44.0.1 security bump for hotfix/3.4 was auto-closed unmerged after 598 days; no resolving commit or CI run was recorded.
89%
#5254 build(deps): update dependency cryptography to v44 [security] (hotfix/8.6) - autoclosed snapcraft closed Renovate’s cryptography 44.0.1 security update for hotfix/8.6 was autoclosed unmerged after 588 days, with no review, CI result, or replacement recorded.
88%
#5253 build(deps): update dependency cryptography to v44 [security] (hotfix/7.5) - autoclosed snapcraft closed Renovate's cryptography 44.0.1 hotfix/7.5 update was autoclosed unmerged after prolonged inactivity; no review, CI result, or resolving commit was recorded.
88%
#2164 build(deps): update dependency cryptography to v44 [security] (hotfix/2.7) - autoclosed charmcraft closed Renovate's cryptography 44.0.1 hotfix update was autoclosed unmerged after inactivity; no review, CI, or resolving commit was recorded.
87%
#5011 build(deps): update dependency cryptography to v43 [security] (hotfix/7.5) - autoclosed snapcraft closed Autoclosed unmerged on hotfix/7.5; the same cryptography 43.0.1 security update was merged to main in canonical/snapcraft#5010 via commit 31bec5200.
87%