build(deps): bump cryptography
Metadata
Current evaluation
Merged PR #1055 (commit df46c84a) bumped the cryptography dependency to fix an OSV advisory, with 2 approvals and all CI checks passing; a later near-identical bump landed as #1061 (4b0e00ae).
Resolution: closed resolved
Reason: The PR itself was merged into main as commit df46c84a ('build(deps): bump cryptography (#1055)'), changing pyproject.toml (+51/-51) to remediate an OSV. All reported CI checks passed and the commit appears in the main-branch history ahead of the follow-up bump #1061 (4b0e00ae) and later cryptography bumps #1098 and #1151.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
- [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)?
---
Fixes an OSV.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1055 (commit df46c84a) bumped the cryptography dependency to fix an OSV advisory, with 2 approvals and all CI checks passing; a later near-identical bump landed as #1061 (4b0e00ae). | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1061 (4b0e00ae), bumping cryptography to remediate an OSV. It received two approvals and passed all reported CI checks. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged after bumping the cryptography dependency to resolve an OSV security vulnerability. Approved by two reviewers and passed all CI checks, including security scans and multi-platform tests. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a dependency update to bump cryptography, resolving an OSV security vulnerability. The maintainer submitted the change directly, and it was accepted without comments. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/craft-application#1061
(confidence 65%)
A second, near-identical 'build(deps): bump cryptography' PR was merged as commit 4b0e00ae shortly after, superseding the cryptography version set by #1055; follow-up bumps also exist as #1098 and #1151.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1061 build(deps): bump cryptography | craft-application | merged | Merged PR #1061 in commit 4b0e00ae, bumping cryptography to remediate an OSV; two approvals and all reported CI checks passed. | |
| #356 build(deps): bump cryptography | craft-store | merged | Merged PR #356 as commit fcbad5c, bumping cryptography to remediate OSV GHSA-p423-j2cm-9vmq. | |
| #1003 build(auto): bump cryptography | craft-providers | merged | Merged PR #1003 bumps the cryptography dependency to remediate an OSV; both reviews approved and all CI, security, test, lint, and policy checks passed. | |
| #6307 build(deps): bump cryptography | snapcraft | merged | Merged as commit 1cba705c5: bumped the cryptography dependency to patch a CVE. Approved with lint/fast/minimum-dep tests and security scans passing; spread/publish job failures were unrelated to the bump. | |
| #1151 build(auto): bump cryptography | craft-application | merged | Merged PR #1151 as commit 4ff7e624, updating the cryptography dependency to resolve an OSV security vulnerability. | |
| #1098 build(deps): bump cryptography | craft-application | merged | Merged in #1098 via commit 239b3af7, updating cryptography 48.0.0 to 49.0.0 to resolve OSV GHSA-537c-gmf6-5ccf. | |
| #418 build: bump cryptography for OSV | craft-store | merged | PR #418 (maintainer bepri) bumped the cryptography dependency in2 files (+56/-56) to clear an OSV vulnerability. Approved and merged as commit e8fef67, with the OSV-scanner security check passing. | |
| #6135 build(deps): bump cryptography from 46.0.5 to 46.0.6 | snapcraft | merged | Merged #6135 as commit 1acb182bf, bumping cryptography 46.0.5 to 46.0.6 to fix CVE-2026-34073. | |
| #122 build(deps): bump cryptography from 46.0.6 to 46.0.7 | debcraft | merged | Dependabot PR merged as commit 0498780, bumping cryptography 46.0.6 -> 46.0.7 in debcraft's lockfile to fix CVE-2026-39892 and pick up OpenSSL 3.5.6 wheels. All CI checks passed. | |
| #1200 build(deps): bump cryptography from 41.0.2 to 41.0.3 | charmcraft | closed | Dependabot's cryptography 41.0.2→41.0.3 bump was closed unmerged as redundant; the same update landed via security PR canonical/charmcraft#1201 (commit 31f7281c). |