← Back to issue list

build(deps): bump cryptography from 45.0.4 to 46.0.5 in /tests/spread/ubuntu-26.04/test-cmd

View original Github issue

Metadata

Project
charmcraft
Number
#2609
Type
pull request
State
closed
Author
dependabot[bot]
Labels
—
Created
Updated
Closed

Current evaluation

Closed unmerged after failing checks; the cryptography 46.x refresh was retried in #2640 and superseded by merged dependency update #2727 (174fd8ff).

Resolution: closed superseded

Reason: PR #2609 was closed without merging. PR #2640 repeated the Ubuntu 26.04 cryptography upgrade at 46.0.6, and merged dependency update #2727, commit 174fd8ff, ultimately replaced that refresh.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Bumps [cryptography](https://github.com/pyca/cryptography) from 45.0.4 to 46.0.5. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p> <blockquote> <p>46.0.5 - 2026-02-10</p> <pre><code> * An attacker could create a malicious public key that reveals portions of your private key when using certain uncommon elliptic curves (binary curves). This version now includes additional security checks to prevent this attack. This issue only affects binary elliptic curves, which are rarely used in real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine** for reporting the issue. **CVE-2026-26007** * Support for ``SECT*`` binary elliptic curves is deprecated and will be removed in the next release. <p>.. v46-0-4:</p> <p>46.0.4 - 2026-01-27<br /> </code></pre></p> <ul> <li><code>Dropped support for win_arm64 wheels</code>_.</li> <li>Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.</li> </ul> <p>.. _v46-0-3:</p> <p>46.0.3 - 2025-10-15</p> <pre><code> * Fixed compilation when using LibreSSL 4.2.0. <p>.. _v46-0-2:</p> <p>46.0.2 - 2025-09-30<br /> </code></pre></p> <ul> <li>Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.4.</li> </ul> <p>.. _v46-0-1:</p> <p>46.0.1 - 2025-09-16</p> <pre><code> * Fixed an issue where users installing via ``pip`` on Python 3.14 development versions would not properly install a dependency. * Fixed an issue building the free-threaded macOS 3.14 wheels. <p>.. _v46-0-0:</p> <p>46.0.0 - 2025-09-16<br /> </code></pre></p> <ul> <li><strong>BACKWARDS INCOMPATIBLE:</strong> Support for Python 3.7 has been removed.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pyca/cryptography/commit/06e120e682cb200e3f7050c02f0bcdac90c4c6ad"><code>06e120e</code></a> bump version for 46.0.5 release (<a href="https://redirect.github.com/pyca/cryptography/issues/14289">#14289</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c"><code>0eebb9d</code></a> EC check key on cofactor &gt; 1 (<a href="https://redirect.github.com/pyca/cryptography/issues/14287">#14287</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/bedf6e186b814f69a3f54f51252c23a71d44ed2e"><code>bedf6e1</code></a> fix openssl version on 46 branch (<a href="https://redirect.github.com/pyca/cryptography/issues/14220">#14220</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/e6f44fc8e6391f05d719fb9d369692325b87a471"><code>e6f44fc</code></a> bump for 46.0.4 and drop win arm64 due to CI issues (<a href="https://redirect.github.com/pyca/cryptography/issues/14217">#14217</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/c0af4dd7b75921bbe9f1d41a03dbd4b64a9e3403"><code>c0af4dd</code></a> release 46.0.3 (<a href="https://redirect.github.com/pyca/cryptography/issues/13681">#13681</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/99efe5ad150a56efadafacaffd0e3ee319373904"><code>99efe5a</code></a> bump version for 46.0.2 (<a href="https://redirect.github.com/pyca/cryptography/issues/13531">#13531</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/e735cfc27502320101c130335c556394a125ba52"><code>e735cfc</code></a> release 46.0.1 (<a href="https://redirect.github.com/pyca/cryptography/issues/13450">#13450</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/4e457ffba43a6d87efc63c33041e2081438dd8a4"><code>4e457ff</code></a> Explicitly specify python in mac uv build invocation (<a href="https://redirect.github.com/pyca/cryptography/issues/13447">#13447</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/2726efdb6d67f1c90cf9c6062d9fe051965586f8"><code>2726efd</code></a> Depend on CFFI 2.0.0 or newer on Python &gt; 3.8 (<a href="https://redirect.github.com/pyca/cryptography/issues/13448">#13448</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/62230623d183706632c0eb7822c96ac95e3710a8"><code>6223062</code></a> release 46.0.0 (<a href="https://redirect.github.com/pyca/cryptography/issues/13446">#13446</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pyca/cryptography/compare/45.0.4...46.0.5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cryptography&package-manager=uv&previous-version=45.0.4&new-version=46.0.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/canonical/charmcraft/network/alerts). </details>

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed superseded Closed unmerged after failing checks; the cryptography 46.x refresh was retried in #2640 and superseded by merged dependency update #2727 (174fd8ff).
stealth/space-bunny-alpha — closed superseded Closed unmerged after failing checks; the cryptography update was retried in #2640 and superseded by merged dependency refresh #2727.
stealth/space-bunny-alpha — closed superseded Closed unmerged after failing checks; #2640 retried the Ubuntu 26.04 test upgrade at cryptography 46.0.6, followed by merged dependency refresh #2727 (174fd8ff).
qwen/qwen3.6-35b-a3b — — Closed without merging. The Dependabot update for cryptography to 46.0.5 failed CI checks and received no review. Dependabot acknowledged the closure and will skip further notifications for this release.
qwen3.6-35b-a3b-mtp-q6 — — Closed without merging. The cryptography dependency bump was likely superseded or manually resolved, as Dependabot acknowledged stopping notifications for this release.

Update history

No update history recorded yet.

Related work

  • Superseded By: canonical/charmcraft#2640 (confidence 100%)

    Retried the same Ubuntu 26.04 test cryptography upgrade at version 46.0.6.

  • Superseded By: canonical/charmcraft#2727 (confidence 96%)

    Merged broader dependency refresh recorded as the replacement in commit 174fd8ff.

Related issues

Issue Project State Summary Similarity
#2640 build(deps): bump cryptography from 45.0.4 to 46.0.6 in /tests/spread/ubuntu-26.04/test-cmd charmcraft closed Closed unmerged after Dependabot could not clear failing checks; the cryptography refresh was superseded by merged dependency update #2727 (commit 174fd8ff).
98%
#2587 build(deps): bump cryptography from 45.0.4 to 46.0.5 in /tests/spread/ubuntu-24.04/test-cmd charmcraft closed Closed unmerged because cryptography 46.0.5 was included in bulk dependency update #2583, merged as commit e66a25b5.
95%
#2639 build(deps): bump cryptography from 45.0.4 to 46.0.6 in /tests/spread/ubuntu-24.04/test-cmd charmcraft closed Closed unmerged with failing CI and no review; cryptography remained at 45.0.4 after the Dependabot 46.0.6 update.
95%
#2613 build(deps): bump cryptography from 45.0.4 to 46.0.5 in /tests/spread/ubuntu-25.10/test-cmd charmcraft closed Cryptography 45.0.4→46.0.5 Dependabot update was closed unmerged; the Ubuntu 25.10 test lockfile remains on 45.0.4.
92%
#6135 build(deps): bump cryptography from 46.0.5 to 46.0.6 snapcraft merged Merged #6135 as commit 1acb182bf, bumping cryptography 46.0.5 to 46.0.6 to fix CVE-2026-34073.
87%
#6029 build(deps): bump cryptography from 46.0.3 to 46.0.5 snapcraft merged Merged as edb2a7453, updating cryptography from 46.0.3 to 46.0.5 to address CVE-2026-26007 and related security fixes.
85%
#2645 build(deps): bump cryptography from 46.0.6 to 46.0.7 charmcraft closed Dependabot’s cryptography 46.0.7 bump was abandoned unmerged after two rebase requests; the bot stopped tracking that release.
85%
#2570 build(deps): update dependency cryptography to v46 [security] (hotfix/4.1) - autoclosed charmcraft closed Autoclosed unmerged after 219 days; cryptography 46 later landed on main via #2583 (e66a25b5) and was advanced to 46.0.6 by #2617.
84%
#1395 build(deps): bump cryptography from 41.0.4 to 41.0.6 charmcraft closed Closed unmerged as redundant after commit d8a889db had already updated cryptography to v41.0.6; Dependabot confirmed the dependency was current.
84%
#86 build(deps): bump cryptography from 46.0.1 to 46.0.5 debcraft merged Dependabot bumped cryptography 46.0.1→46.0.5 in uv.lock; merged as commit 8d82006 (CVE-2026-26007 fix). Later superseded by #111 (46.0.6) and #122 (46.0.7).
84%