build(deps): bump cryptography from 46.0.5 to 46.0.6
Metadata
Current evaluation
Dependabot bump of cryptography 46.0.5 -> 46.0.6 (security fix for CVE-2026-34073) merged into debcraft, updating uv.lock. Follow-up bump to 46.0.7 later landed via #122.
Resolution: closed resolved
Reason: The PR was merged (commit 0434ebe, 'build(deps): bump cryptography from 46.0.5 to 46.0.6 (#111)'), landing the 46.0.6 pin in uv.lock and picking up the upstream security fix for CVE-2026-34073. All CI checks passed except the OSV-scanner job; a later bump to 46.0.7 superseded this pin in #122.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.5 to 46.0.6.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p>
<blockquote>
<p>46.0.6 - 2026-03-25</p>
<pre><code>
* **SECURITY ISSUE**: Fixed a bug where name constraints were not applied
to peer names during verification when the leaf certificate contains a
wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug,
including those used by the Web PKI. Credit to **Oleh Konko (1seal)** for
reporting the issue. **CVE-2026-34073**
<p>.. _v46-0-5:<br />
</code></pre></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pyca/cryptography/commit/91d728897bdad30cd5c79a2b23e207f1f050d587"><code>91d7288</code></a> Cherry-pick <a href="https://redirect.github.com/pyca/cryptography/issues/14542">#14542</a> (<a href="https://redirect.github.com/pyca/cryptography/issues/14543">#14543</a>)</li>
<li>See full diff in <a href="https://github.com/pyca/cryptography/compare/46.0.5...46.0.6">compare view</a></li>
</ul>
</details>
<br />
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Dependabot bump of cryptography 46.0.5 -> 46.0.6 (security fix for CVE-2026-34073) merged into debcraft, updating uv.lock. Follow-up bump to 46.0.7 later landed via #122. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 1acb182bf, upgrading cryptography 46.0.5 → 46.0.6 to address CVE-2026-34073. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged Dependabot PR updating cryptography from 46.0.5 to 46.0.6 to patch CVE-2026-34073, fixing a name constraints bug with wildcard DNS SANs. Approved, rebased, and merged after CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged Dependabot update bumping cryptography from 46.0.5 to 46.0.6 to patch CVE-2026-34073, a security flaw affecting wildcard DNS SAN name constraints. The branch was rebased and merged. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/debcraft#122
(confidence 90%)
Follow-up Dependabot bump from 46.0.6 to 46.0.7 (commit 0498780) later replaced this pin in uv.lock.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #86 build(deps): bump cryptography from 46.0.1 to 46.0.5 | debcraft | merged | Dependabot bumped cryptography 46.0.1→46.0.5 in uv.lock; merged as commit 8d82006 (CVE-2026-26007 fix). Later superseded by #111 (46.0.6) and #122 (46.0.7). | |
| #122 build(deps): bump cryptography from 46.0.6 to 46.0.7 | debcraft | merged | Dependabot PR merged as commit 0498780, bumping cryptography 46.0.6 -> 46.0.7 in debcraft's lockfile to fix CVE-2026-39892 and pick up OpenSSL 3.5.6 wheels. All CI checks passed. | |
| #6135 build(deps): bump cryptography from 46.0.5 to 46.0.6 | snapcraft | merged | Merged #6135 as commit 1acb182bf, bumping cryptography 46.0.5 to 46.0.6 to fix CVE-2026-34073. | |
| #6029 build(deps): bump cryptography from 46.0.3 to 46.0.5 | snapcraft | merged | Merged as edb2a7453, updating cryptography from 46.0.3 to 46.0.5 to address CVE-2026-26007 and related security fixes. | |
| #6163 build(deps): bump cryptography from 46.0.6 to 46.0.7 | snapcraft | merged | Dependabot bump of cryptography 46.0.6→46.0.7 (CVE-2026-39892 buffer-overflow fix, OpenSSL 3.5.6 wheels) merged into snapcraft via PR #6163, commit a8123a0a8. | |
| #2645 build(deps): bump cryptography from 46.0.6 to 46.0.7 | charmcraft | closed | Dependabot’s cryptography 46.0.7 bump was abandoned unmerged after two rebase requests; the bot stopped tracking that release. | |
| #1200 build(deps): bump cryptography from 41.0.2 to 41.0.3 | charmcraft | closed | Dependabot's cryptography 41.0.2→41.0.3 bump was closed unmerged as redundant; the same update landed via security PR canonical/charmcraft#1201 (commit 31f7281c). | |
| #318 build: bump cryptography to 46.0.7 | imagecraft | merged | Merged PR #318 (commit 8a390e6) by smethnani bumped cryptography to 46.0.7 in uv.lock to clear an OSV vulnerability; later superseded by #357 (49.0.0) and #421 (50.0.2). | |
| #4457 build(deps): bump cryptography from 41.0.4 to 41.0.6 | snapcraft | closed | Closed unmerged as obsolete after cryptography was updated to 41.0.7; Dependabot said the 41.0.4→41.0.6 bump was no longer needed. | |
| #2640 build(deps): bump cryptography from 45.0.4 to 46.0.6 in /tests/spread/ubuntu-26.04/test-cmd | charmcraft | closed | Closed unmerged after Dependabot could not clear failing checks; the cryptography refresh was superseded by merged dependency update #2727 (commit 174fd8ff). |