← Back to issue list

build: bump cryptography to 46.0.7

View original Github issue

Metadata

Project
imagecraft
Number
#318
Type
pull request
State
merged
Author
smethnani
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #318 (commit 8a390e6) by smethnani bumped cryptography to 46.0.7 in uv.lock to clear an OSV vulnerability; later superseded by #357 (49.0.0) and #421 (50.0.2).

Resolution: closed resolved

Reason: The PR was approved by 2 reviewers and merged as commit 8a390e6, updating cryptography to 46.0.7 to resolve the reported OSV finding; OSV-scanner and Trivy security checks passed. Subsequent PRs #357 (a868324) and #421 (71a1ee0) bumped cryptography further.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Bumps cryptography to 46.0.7 to resolve osv --- - [x] I've followed the [contribution guidelines](https://github.com/canonical/imagecraft/blob/main/CONTRIBUTING.md). - [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [x] I've successfully run `make lint && make test`. - [x] I've added or updated any relevant documentation.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #318 (commit 8a390e6) by smethnani bumped cryptography to 46.0.7 in uv.lock to clear an OSV vulnerability; later superseded by #357 (49.0.0) and #421 (50.0.2).
stealth/space-bunny-alpha — closed resolved Merged canonical/imagecraft#318 (commit 8a390e6), bumping cryptography to 46.0.7 to resolve an OSV vulnerability.
qwen/qwen3.6-35b-a3b — — Merged a dependency update bumping cryptography to 46.0.7 to resolve an OSV security advisory. Approved by two reviewers, the change was merged despite failing spread tests on older Ubuntu releases.
qwen3.6-35b-a3b-mtp-q6 — — Merged dependency update bumping cryptography to 46.0.7 to resolve an OSV advisory. Maintainer smethnani's change passed linting and testing before integration.

Update history

No update history recorded yet.

Related work

  • Superseded By: canonical/imagecraft#357 (confidence 90%)

    Later merged bump of cryptography 46.0.7 -> 49.0.0 (commit a868324) for further OSVs

  • Superseded By: canonical/imagecraft#421 (confidence 85%)

    Later merged bump of cryptography 49.0.0 -> 50.0.0 (commit 71a1ee0); lockfile now at 50.0.2

Related issues

Issue Project State Summary Similarity
#86 build(deps): bump cryptography from 46.0.1 to 46.0.5 debcraft merged Dependabot bumped cryptography 46.0.1→46.0.5 in uv.lock; merged as commit 8d82006 (CVE-2026-26007 fix). Later superseded by #111 (46.0.6) and #122 (46.0.7).
90%
#6135 build(deps): bump cryptography from 46.0.5 to 46.0.6 snapcraft merged Merged #6135 as commit 1acb182bf, bumping cryptography 46.0.5 to 46.0.6 to fix CVE-2026-34073.
86%
#111 build(deps): bump cryptography from 46.0.5 to 46.0.6 debcraft merged Dependabot bump of cryptography 46.0.5 -> 46.0.6 (security fix for CVE-2026-34073) merged into debcraft, updating uv.lock. Follow-up bump to 46.0.7 later landed via #122.
85%
#6029 build(deps): bump cryptography from 46.0.3 to 46.0.5 snapcraft merged Merged as edb2a7453, updating cryptography from 46.0.3 to 46.0.5 to address CVE-2026-26007 and related security fixes.
84%
#6030 build(deps): bump cryptography from 46.0.3 to 46.0.5 snapcraft merged Merged into hotfix/8.14 as 636b6cfaf, bumping cryptography 46.0.3 to 46.0.5 to address an OSV hotfix.
83%
#1098 build(deps): bump cryptography craft-application merged Merged in #1098 via commit 239b3af7, updating cryptography 48.0.0 to 49.0.0 to resolve OSV GHSA-537c-gmf6-5ccf.
83%
#1151 build(auto): bump cryptography craft-application merged Merged PR #1151 as commit 4ff7e624, updating the cryptography dependency to resolve an OSV security vulnerability.
82%
#356 build(deps): bump cryptography craft-store merged Merged PR #356 as commit fcbad5c, bumping cryptography to remediate OSV GHSA-p423-j2cm-9vmq.
82%
#2617 build(deps): bump cryptography from 46.0.5 to 46.0.6 charmcraft merged Merged #2617 in commit ba2c0c9a, upgrading cryptography 46.0.5 to 46.0.6 to fix CVE-2026-34073’s wildcard DNS SAN name-constraint verification flaw.
82%
#4563 build(deps): bump cryptography from 41.0.7 to 42.0.0 snapcraft closed Dependabot's cryptography 41.0.7→42.0.0 bump PR was closed unmerged; maintainer @lengau closed it as "superseded by #4564", which merged cryptography 42.0.2 to fix CVE-2023-50782/CVE-2024-0727.
81%