build(deps): bump cryptography from 46.0.6 to 46.0.7
Metadata
Current evaluation
Dependabot’s cryptography 46.0.7 bump was abandoned unmerged after two rebase requests; the bot stopped tracking that release.
Resolution: closed stale
Reason: PR #2645 was never merged. After rebases were requested on April 10 and 15, 2026, Dependabot stated it would stop notifying about that release and could be reconnected if the update was still wanted.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.6 to 46.0.7.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p>
<blockquote>
<p>46.0.7 - 2026-04-07</p>
<pre><code>
* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
passed to APIs that accept Python buffers, which could lead to buffer
overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
<p>.. _v46-0-6:<br />
</code></pre></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5"><code>622d672</code></a> 46.0.7 release (<a href="https://redirect.github.com/pyca/cryptography/issues/14602">#14602</a>)</li>
<li>See full diff in <a href="https://github.com/pyca/cryptography/compare/46.0.6...46.0.7">compare view</a></li>
</ul>
</details>
<br />
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Dependabot’s cryptography 46.0.7 bump was abandoned unmerged after two rebase requests; the bot stopped tracking that release. | |
| stealth/space-bunny-alpha | — | closed stale | Cryptography 46.0.7 update was closed unmerged after two maintainer rebase requests; Dependabot stopped retrying, and no 46.0.7 change appears in repository history. | |
| stealth/space-bunny-alpha | — | closed stale | Closed unmerged after two rebase requests; Dependabot stopped notifications, and no commit or superseding cryptography 46.0.7 update was found. | |
| stealth/space-bunny-alpha | — | closed stale | Cryptography 46.0.7 update was not merged after two rebase requests; Dependabot stopped notifications, leaving security and build failures unresolved. | |
| qwen/qwen3.6-35b-a3b | — | — | The Dependabot PR updating cryptography to 46.0.7 was closed without merging. After maintainer rebases, Dependabot confirmed it will skip future notifications for this release, effectively abandoning the pull request. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | The dependency update was closed and abandoned after maintainer rebases. Dependabot confirmed it will no longer notify about this release, indicating the cryptography bump to 46.0.7 was not merged and remains unapplied. |
Update history
No update history recorded yet.
Related work
-
Related To:
charmcraft#2617
(confidence 98%)
Merged commit ba2c0c9a previously bumped cryptography from 46.0.5 to 46.0.6, the version targeted by PR #2645.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4457 build(deps): bump cryptography from 41.0.4 to 41.0.6 | snapcraft | closed | Closed unmerged as obsolete after cryptography was updated to 41.0.7; Dependabot said the 41.0.4→41.0.6 bump was no longer needed. | |
| #2639 build(deps): bump cryptography from 45.0.4 to 46.0.6 in /tests/spread/ubuntu-24.04/test-cmd | charmcraft | closed | Closed unmerged with failing CI and no review; cryptography remained at 45.0.4 after the Dependabot 46.0.6 update. | |
| #2640 build(deps): bump cryptography from 45.0.4 to 46.0.6 in /tests/spread/ubuntu-26.04/test-cmd | charmcraft | closed | Closed unmerged after Dependabot could not clear failing checks; the cryptography refresh was superseded by merged dependency update #2727 (commit 174fd8ff). | |
| #111 build(deps): bump cryptography from 46.0.5 to 46.0.6 | debcraft | merged | Dependabot bump of cryptography 46.0.5 -> 46.0.6 (security fix for CVE-2026-34073) merged into debcraft, updating uv.lock. Follow-up bump to 46.0.7 later landed via #122. | |
| #4599 build(deps): bump cryptography from 42.0.2 to 42.0.4 | snapcraft | closed | Dependabot bump of cryptography 42.0.2 -> 42.0.4 was closed unmerged; the same bump had already landed via Renovate PR #4598 (commit 7cfb60986), and Dependabot confirmed it was up-to-date. | |
| #86 build(deps): bump cryptography from 46.0.1 to 46.0.5 | debcraft | merged | Dependabot bumped cryptography 46.0.1→46.0.5 in uv.lock; merged as commit 8d82006 (CVE-2026-26007 fix). Later superseded by #111 (46.0.6) and #122 (46.0.7). | |
| #1395 build(deps): bump cryptography from 41.0.4 to 41.0.6 | charmcraft | closed | Closed unmerged as redundant after commit d8a889db had already updated cryptography to v41.0.6; Dependabot confirmed the dependency was current. | |
| #4591 build(deps): bump cryptography from 41.0.7 to 42.0.2 | snapcraft | closed | Dependabot's cryptography 41.0.7→42.0.2 bump was closed unmerged as redundant: merged PR #4564 (commit ac421ab96) had already applied the same update, and Dependabot confirmed the dependency was current. | |
| #122 build(deps): bump cryptography from 46.0.6 to 46.0.7 | debcraft | merged | Dependabot PR merged as commit 0498780, bumping cryptography 46.0.6 -> 46.0.7 in debcraft's lockfile to fix CVE-2026-39892 and pick up OpenSSL 3.5.6 wheels. All CI checks passed. | |
| #6135 build(deps): bump cryptography from 46.0.5 to 46.0.6 | snapcraft | merged | Merged #6135 as commit 1acb182bf, bumping cryptography 46.0.5 to 46.0.6 to fix CVE-2026-34073. |