build(deps): bump cryptography from 46.0.5 to 46.0.6
Metadata
Current evaluation
Merged Dependabot PR updating cryptography from 46.0.5 to 46.0.6 to patch CVE-2026-34073, fixing a name constraints bug with wildcard DNS SANs. Approved, rebased, and merged after CI checks.
Suggested action: —
No scores available.
Issue body
Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.5 to 46.0.6.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p>
<blockquote>
<p>46.0.6 - 2026-03-25</p>
<pre><code>
* **SECURITY ISSUE**: Fixed a bug where name constraints were not applied
to peer names during verification when the leaf certificate contains a
wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug,
including those used by the Web PKI. Credit to **Oleh Konko (1seal)** for
reporting the issue. **CVE-2026-34073**
<p>.. _v46-0-5:<br />
</code></pre></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pyca/cryptography/commit/91d728897bdad30cd5c79a2b23e207f1f050d587"><code>91d7288</code></a> Cherry-pick <a href="https://redirect.github.com/pyca/cryptography/issues/14542">#14542</a> (<a href="https://redirect.github.com/pyca/cryptography/issues/14543">#14543</a>)</li>
<li>See full diff in <a href="https://github.com/pyca/cryptography/compare/46.0.5...46.0.6">compare view</a></li>
</ul>
</details>
<br />
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged Dependabot PR updating cryptography from 46.0.5 to 46.0.6 to patch CVE-2026-34073, fixing a name constraints bug with wildcard DNS SANs. Approved, rebased, and merged after CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged Dependabot update bumping cryptography from 46.0.5 to 46.0.6 to patch CVE-2026-34073, a security flaw affecting wildcard DNS SAN name constraints. The branch was rebased and merged. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged Dependabot PR bumping cryptography from 46.0.5 to 46.0.6. The update resolves CVE-2026-34073, addressing a name constraints verification bug with wildcard DNS SANs. Rebased per maintainer request before merge. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2617 build(deps): bump cryptography from 46.0.5 to 46.0.6 | charmcraft | merged | Merged Dependabot PR updating cryptography from 46.0.5 to 46.0.6 to patch CVE-2026-34073, fixing a name constraint verification flaw for wildcard DNS SANs. Approved by two reviewers and successfully merged. | |
| #6135 build(deps): bump cryptography from 46.0.5 to 46.0.6 | snapcraft | merged | Merged Dependabot update bumping cryptography from 46.0.5 to 46.0.6. Fixes CVE-2026-34073, addressing a vulnerability where name constraints were skipped for peer names with wildcard DNS SANs. Approved and passed CI. | |
| #86 build(deps): bump cryptography from 46.0.1 to 46.0.5 | debcraft | merged | Merged Dependabot PR updating cryptography from 46.0.1 to 46.0.5. The update patches CVE-2026-26007, upgrades to OpenSSL 3.5.5, and drops win_arm64 wheels. Approved by reviewers and passed all CI checks before merge. | |
| #6029 build(deps): bump cryptography from 46.0.3 to 46.0.5 | snapcraft | merged | Merged a Dependabot update bumping cryptography from 46.0.3 to 46.0.5. The upgrade patches CVE-2026-26007, deprecates SECT* curves, and updates OpenSSL to 3.5.5. Approved by two reviewers and merged after passing CI checks. | |
| #6163 build(deps): bump cryptography from 46.0.6 to 46.0.7 | snapcraft | merged | Merged Dependabot update bumping cryptography from 46.0.6 to 46.0.7. The release fixes CVE-2026-39892 buffer overflow and updates wheels to OpenSSL 3.5.6. Approved by reviewers and merged after passing core CI checks. | |
| #122 build(deps): bump cryptography from 46.0.6 to 46.0.7 | debcraft | merged | Merged Dependabot update bumping cryptography from 46.0.6 to 46.0.7. Resolves CVE-2026-39892 buffer overflow and updates wheels to OpenSSL 3.5.6. Approved by two reviewers and passed all CI checks. | |
| #6030 build(deps): bump cryptography from 46.0.3 to 46.0.5 | snapcraft | merged | Merged after review and passing CI checks. Updates the cryptography dependency from 46.0.3 to 46.0.5 to address an OSV security advisory on the hotfix/8.14 branch. | |
| #4280 build(deps): bump cryptography from 41.0.0 to 41.0.2 | snapcraft | closed | Dependabot PR updating cryptography from 41.0.0 to 41.0.2 was approved and passed CI but closed and superseded by pull request #4301. | |
| #2162 build(deps-dev): bump cryptography from 44.0.0 to 44.0.1 | charmcraft | merged | Merged a Dependabot update bumping the cryptography dependency from 44.0.0 to 44.0.1. The change was approved, passed CI checks, and successfully merged into the codebase. | |
| #6307 build(deps): bump cryptography | snapcraft | merged | Merged after approval. Bumps the cryptography dependency to address a CVE. Core CI checks passed despite some integration and publish job failures. |