build(deps): update dependency cryptography to v43 [security] (hotfix/8.3) - abandoned
Metadata
Current evaluation
Cryptography 43.0.1 hotfix/8.3 bump was abandoned and closed unmerged; the equivalent main-branch security update merged via #5010 (31bec5200).
Resolution: closed stale
Reason: Renovate reported that autoclosing was skipped because the branch had already been modified, and the PR received no CI run or resolving commit before abandonment. The main branch received the same cryptography 43.0.1 security update in #5010.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cryptography](https://redirect.github.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==42.0.8` -> `==43.0.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [GHSA-h4gh-qq45-vh27](https://redirect.github.com/pyca/cryptography/security/advisories/GHSA-h4gh-qq45-vh27)
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-43.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20240903.txt.
If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v43.0.1`](https://redirect.github.com/pyca/cryptography/compare/43.0.0...43.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/43.0.0...43.0.1)
### [`v43.0.0`](https://redirect.github.com/pyca/cryptography/compare/42.0.8...43.0.0)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/42.0.8...43.0.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC41OS4yIiwidXBkYXRlZEluVmVyIjoiMzguNTkuMiIsInRhcmdldEJyYW5jaCI6ImhvdGZpeC84LjMiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Cryptography 43.0.1 hotfix/8.3 bump was abandoned and closed unmerged; the equivalent main-branch security update merged via #5010 (31bec5200). | |
| stealth/space-bunny-alpha | — | closed stale | Renovate's cryptography 43.0.1 hotfix/8.3 update was closed unmerged as abandoned after its branch was modified; the equivalent main-branch update merged in #5010. | |
| stealth/space-bunny-alpha | — | closed stale | cryptography 43.0.1 bump for hotfix/8.3 was abandoned and closed unmerged; Renovate said autoclosing was skipped because the branch was already modified. | |
| qwen/qwen3.6-35b-a3b | — | — | Abandoned and closed without merging. The cryptography v43.0.1 security update was flagged for autoclosing but skipped due to branch modifications, leaving the PR unmerged. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Security update to cryptography v43 was abandoned. Renovate skipped autoclosing due to base branch modifications. The pull request was manually closed without merging. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
canonical/snapcraft#5010
(confidence 95%)
Merged the equivalent cryptography 43.0.1 security update for main in commit 31bec5200.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1872 build(deps): update dependency cryptography to v43.0.1 [security] (hotfix/3.2) | charmcraft | merged | Renovate security bump of cryptography 43.0.0 -> 43.0.1 merged into hotfix/3.2 as commit a98a8b4f, fixing vulnerable bundled OpenSSL (GHSA-h4gh-qq45-vh27). Sibling bumps landed via #1870 (438cafe0) and #1871. | |
| #2165 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.3) - autoclosed | charmcraft | closed | Renovate PR #2165 was autoclosed unmerged without CI or comments; cryptography 44.0.1 was later merged on main through #2189 (bba6a32e). | |
| #1870 build(deps): update dependency cryptography to v43.0.1 [security] (main) | charmcraft | merged | Merged #1870, bumping cryptography from 43.0.0 to 43.0.1 to address GHSA-h4gh-qq45-vh27; mainline merge commit: 438cafe0. | |
| #5011 build(deps): update dependency cryptography to v43 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Autoclosed unmerged on hotfix/7.5; the same cryptography 43.0.1 security update was merged to main in canonical/snapcraft#5010 via commit 31bec5200. | |
| #2568 build(deps): update dependency cryptography to v46 [security] (hotfix/3.5) | charmcraft | closed | Cryptography v46 update for hotfix/3.5 was closed unmerged after 219 days without activity or approval; five CI checks failed. The equivalent main-branch update later merged in #2583. | |
| #5252 build(deps): update dependency cryptography to v44 [security] (main) | snapcraft | closed | Closed unmerged as a duplicate of #5251, which proposed the same cryptography 43.0.3 to 44.0.1 security update. | |
| #5010 build(deps): update dependency cryptography to v43.0.1 [security] (main) | snapcraft | merged | Merged PR #5010 in commit 31bec5200, updating cryptography 43.0.0 to 43.0.1 to address OpenSSL vulnerability GHSA-h4gh-qq45-vh27. | |
| #1871 build(deps): update dependency cryptography to v43 [security] (hotfix/2.7) | charmcraft | merged | Renovate security bump of cryptography 41.0.7 -> 43.0.1 merged into hotfix/2.7 as commit 2fa3602f, fixing GHSA-h4gh-qq45-vh27 (vulnerable OpenSSL bundled in cryptography wheels). | |
| #2166 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Renovate's cryptography 44.0.1 security bump for hotfix/3.4 was auto-closed unmerged after 598 days; no resolving commit or CI run was recorded. | |
| #2163 build(deps): update dependency cryptography to v44.0.1 [security] (main) - autoclosed | charmcraft | closed | Renovate PR #2163 was autoclosed unmerged; the cryptography 44.0.1 update was instead merged through #2189 at commit bba6a32e. |