build(deps): bump cryptography from 3.4 to 39.0.1
Metadata
Current evaluation
Closed unmerged because cryptography 39.0.1 did not work on every architecture; maintainers cited canonical/charmcraft#1024, and Snapcraft later updated it in #4136 (3fd3e4c52).
Resolution: closed superseded
Reason: Maintainer lengau closed the PR because the bump alone would not work on all architectures and cited canonical/charmcraft#1024 as the handling model. Snapcraft later merged #4136 as 3fd3e4c52 to update the cryptography dependency.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps [cryptography](https://github.com/pyca/cryptography) from 3.4 to 39.0.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p>
<blockquote>
<p>39.0.1 - 2023-02-07</p>
<pre><code>
* **SECURITY ISSUE** - Fixed a bug where ``Cipher.update_into`` accepted Python
buffer protocol objects, but allowed immutable buffers. **CVE-2023-23931**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.0.8.
<p>.. _v39-0-0:</p>
<p>39.0.0 - 2023-01-01
</code></pre></p>
<ul>
<li><strong>BACKWARDS INCOMPATIBLE:</strong> Support for OpenSSL 1.1.0 has been removed.
Users on older version of OpenSSL will need to upgrade.</li>
<li><strong>BACKWARDS INCOMPATIBLE:</strong> Dropped support for LibreSSL < 3.5. The new
minimum LibreSSL version is 3.5.0. Going forward our policy is to support
versions of LibreSSL that are available in versions of OpenBSD that are
still receiving security support.</li>
<li><strong>BACKWARDS INCOMPATIBLE:</strong> Removed the <code>encode_point</code> and
<code>from_encoded_point</code> methods on
:class:<code>~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicNumbers</code>,
which had been deprecated for several years.
:meth:<code>~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.public_bytes</code>
and
:meth:<code>~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.from_encoded_point</code>
should be used instead.</li>
<li><strong>BACKWARDS INCOMPATIBLE:</strong> Support for using MD5 or SHA1 in
:class:<code>~cryptography.x509.CertificateBuilder</code>, other X.509 builders, and
PKCS7 has been removed.</li>
<li><strong>BACKWARDS INCOMPATIBLE:</strong> Dropped support for macOS 10.10 and 10.11, macOS
users must upgrade to 10.12 or newer.</li>
<li><strong>ANNOUNCEMENT:</strong> The next version of <code>cryptography</code> (40.0) will change
the way we link OpenSSL. This will only impact users who build
<code>cryptography</code> from source (i.e., not from a <code>wheel</code>), and specify their
own version of OpenSSL. For those users, the <code>CFLAGS</code>, <code>LDFLAGS</code>,
<code>INCLUDE</code>, <code>LIB</code>, and <code>CRYPTOGRAPHY_SUPPRESS_LINK_FLAGS</code> environment
variables will no longer be respected. Instead, users will need to
configure their builds <code>as documented here</code>_.</li>
<li>Added support for
:ref:<code>disabling the legacy provider in OpenSSL 3.0.x<legacy-provider></code>.</li>
<li>Added support for disabling RSA key validation checks when loading RSA
keys via
:func:<code>~cryptography.hazmat.primitives.serialization.load_pem_private_key</code>,
:func:<code>~cryptography.hazmat.primitives.serialization.load_der_private_key</code>,
and
:meth:<code>~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateNumbers.private_key</code>.
This speeds up key loading but is :term:<code>unsafe</code> if you are loading potentially
attacker supplied keys.</li>
<li>Significantly improved performance for
:class:<code>~cryptography.hazmat.primitives.ciphers.aead.ChaCha20Poly1305</code></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pyca/cryptography/commit/d6951dca25de45abd52da51b608055371fbcde4e"><code>d6951dc</code></a> changelog + security fix backport (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/8231">#8231</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/138da90c8450446b19619e3faa77b9da54c34be3"><code>138da90</code></a> workaround scapy bug in downstream tests (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/8218">#8218</a>) (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/8228">#8228</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/69527bc79095c9646d7e839121f0783477892ecc"><code>69527bc</code></a> bookworm is py311 now (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/8200">#8200</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/111deefb659b8d73c56d3ce89458f2df973d60e4"><code>111deef</code></a> backport main branch CI to 39.0.x (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/8153">#8153</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/338a65a7df74e189f6b5d1d3a6315ffa911b21c2"><code>338a65a</code></a> 39.0.0 version bump (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/7954">#7954</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/84a3cd7abb16f594d8c315e8aedb4be02583bf6a"><code>84a3cd7</code></a> automatically download and upload circleci wheels (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/7949">#7949</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/525c0b3d5d89eab7f953be5de5d2b75da1c816f8"><code>525c0b3</code></a> Type annotate release.py (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/7951">#7951</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/46d2a94d1b574abf5b9e88f84fa7400a138c4edb"><code>46d2a94</code></a> Use the latest 3.10 release when wheel building (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/7953">#7953</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/f150dc15582c05b1b94cf08ed3b1fbc9c4f52267"><code>f150dc1</code></a> fix CI to work with ubuntu 22.04 (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/7950">#7950</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/8867724b2b6db528d2900414ef86c122a1f5602a"><code>8867724</code></a> fix README for python3 (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/7947">#7947</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/pyca/cryptography/compare/3.4...39.0.1">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/snapcore/snapcraft/network/alerts).
</details>
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged because cryptography 39.0.1 did not work on every architecture; maintainers cited canonical/charmcraft#1024, and Snapcraft later updated it in #4136 (3fd3e4c52). | |
| stealth/space-bunny-alpha | — | closed superseded | The cryptography 39.0.1 bump was closed unmerged because it would not work on all architectures; maintainers were directed to the broader approach in canonical/charmcraft#1024. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without merging. A maintainer declined the cryptography version bump because it alone breaks compatibility on certain architectures, recommending a broader update strategy instead. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Dependabot PR to bump cryptography to 39.0.1 was closed due to architecture compatibility issues. The change was abandoned and superseded by a broader update strategy referenced in another pull request. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/charmcraft#1024
(confidence 98%)
Explicitly cited by lengau; merged as 96f6a183 with required Rust build dependencies for supported architectures.
-
Superseded By:
canonical/snapcraft#4136
(confidence 95%)
Later merged update for CRAFT-1720, commit 3fd3e4c52.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1200 build(deps): bump cryptography from 41.0.2 to 41.0.3 | charmcraft | closed | Dependabot's cryptography 41.0.2→41.0.3 bump was closed unmerged as redundant; the same update landed via security PR canonical/charmcraft#1201 (commit 31f7281c). | |
| #1024 deps: update cryptography to v39.0 | charmcraft | merged | PR #1024 (commit 96f6a183) merged into charmcraft, upgrading cryptography to39.0 and adding needed Rust build deps to snap/snapcraft.yaml; it fixes issue #991 after the author validated builds on all architectures. | |
| #1018 build(deps): bump cryptography from 3.4.8 to 39.0.1 | charmcraft | closed | Closed unmerged; the cryptography 39.0 upgrade landed through merged PR #1024 (commit 96f6a183), including required Rust build dependencies. | |
| #1019 chore(deps): update dependency cryptography to v39 [security] | charmcraft | closed | Renovate PR #1019 (cryptography 3.4.8 -> 39.0.1) was closed unmerged by lengau on 2023-02-15 as superseded by canonical/charmcraft#1024, which merged the same v39.0 bump (commit 96f6a183) and added Rust build deps to snapcraft.yaml. | |
| #6163 build(deps): bump cryptography from 46.0.6 to 46.0.7 | snapcraft | merged | Dependabot bump of cryptography 46.0.6→46.0.7 (CVE-2026-39892 buffer-overflow fix, OpenSSL 3.5.6 wheels) merged into snapcraft via PR #6163, commit a8123a0a8. | |
| #1395 build(deps): bump cryptography from 41.0.4 to 41.0.6 | charmcraft | closed | Closed unmerged as redundant after commit d8a889db had already updated cryptography to v41.0.6; Dependabot confirmed the dependency was current. | |
| #4457 build(deps): bump cryptography from 41.0.4 to 41.0.6 | snapcraft | closed | Closed unmerged as obsolete after cryptography was updated to 41.0.7; Dependabot said the 41.0.4→41.0.6 bump was no longer needed. | |
| #1163 build(deps): bump cryptography from 41.0.0 to 41.0.2 | charmcraft | closed | Closed unmerged as redundant; cryptography 41.0.2 was applied by merged security PR #1164 in commit 6d9dd818. | |
| #4280 build(deps): bump cryptography from 41.0.0 to 41.0.2 | snapcraft | closed | Dependabot PR to bump cryptography 41.0.0→41.0.2 was closed unmerged; dependabot commented "Superseded by #4301", which upgraded directly to 41.0.3 and was merged as commit f38160c9d. | |
| #5011 build(deps): update dependency cryptography to v43 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Autoclosed unmerged on hotfix/7.5; the same cryptography 43.0.1 security update was merged to main in canonical/snapcraft#5010 via commit 31bec5200. |