no build(deps): update dependency cryptography to v44 [security] (main)
Metadata
Current evaluation
Closed unmerged because #5217 blocked cryptography 44. PR #5290 fixed the blocker, and cryptography v44 was later applied in commits a07198db6 and 576f37676.
Resolution: closed superseded
Reason: Maintainer closed #5285 as blocked by #5217. Merged PR #5290 resolved that compatibility issue, after which commits a07198db6 and 576f37676 updated cryptography to v44.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cryptography](https://redirect.github.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==43.0.3` -> `==44.0.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-12797](https://redirect.github.com/pyca/cryptography/security/advisories/GHSA-79v4-65xg-pq4g)
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 42.0.0-44.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20250211.txt.
If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v44.0.1`](https://redirect.github.com/pyca/cryptography/compare/44.0.0...44.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.0...44.0.1)
### [`v44.0.0`](https://redirect.github.com/pyca/cryptography/compare/43.0.3...44.0.0)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/43.0.3...44.0.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNzYuMiIsInVwZGF0ZWRJblZlciI6IjM5LjE3Ni4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged because #5217 blocked cryptography 44. PR #5290 fixed the blocker, and cryptography v44 was later applied in commits a07198db6 and 576f37676. | |
| stealth/space-bunny-alpha | — | closed stale | Closed unmerged after @lengau marked it blocked by #5217; the cryptography 44.0.1 security bump was not landed through this PR. | |
| qwen/qwen3.6-35b-a3b | — | — | Cryptography v44 security update was closed without merging because it was blocked by issue #5217. Renovate will ignore future updates for this version since the PR was manually closed. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed without merging due to being blocked by issue #5217. Renovate will ignore future cryptography v44.x updates. The security dependency update was abandoned. |
Update history
No update history recorded yet.
Related work
-
Blocked By:
canonical/snapcraft#5217
(confidence 100%)
The maintainer explicitly marked PR #5285 as blocked by this plugin-shadowing issue.
-
Superseded By:
canonical/snapcraft#5290
(confidence 98%)
Merged fix for core20 local-plugin loading removed the incompatibility blocking cryptography 44.
-
Likely Fixed By:
snapcraft@a07198db6
(confidence 90%)
Later commit records the cryptography v44 dependency update on a Snapcraft branch.
-
Likely Fixed By:
snapcraft@576f37676
(confidence 90%)
A second branch commit records the cryptography v44 dependency update.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #5252 build(deps): update dependency cryptography to v44 [security] (main) | snapcraft | closed | Closed unmerged as a duplicate of #5251, which proposed the same cryptography 43.0.3 to 44.0.1 security update. | |
| #2163 build(deps): update dependency cryptography to v44.0.1 [security] (main) - autoclosed | charmcraft | closed | Renovate PR #2163 was autoclosed unmerged; the cryptography 44.0.1 update was instead merged through #2189 at commit bba6a32e. | |
| #5286 build(deps): update dependency cryptography to v44 [security] (main) - autoclosed | snapcraft | closed | Cryptography 44.0.1 update was not merged; PR #5286 was autoclosed after @mr-cal redirected the update to #5290. | |
| #2165 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.3) - autoclosed | charmcraft | closed | Renovate PR #2165 was autoclosed unmerged without CI or comments; cryptography 44.0.1 was later merged on main through #2189 (bba6a32e). | |
| #162 build(deps): update dependency cryptography to v49 (main) | starflow | closed | Cryptography 49.0.0 update was closed unmerged after 80 days; no resolving commit or replacement PR was found. | |
| #2567 build(deps): update dependency cryptography to v46 [security] (main) - autoclosed | charmcraft | closed | Autoclosed unmerged; the cryptography 46.0.5 update was included in bulk dependency PR #2583 and merged as commit e66a25b5. | |
| #2570 build(deps): update dependency cryptography to v46 [security] (hotfix/4.1) - autoclosed | charmcraft | closed | Autoclosed unmerged after 219 days; cryptography 46 later landed on main via #2583 (e66a25b5) and was advanced to 46.0.6 by #2617. | |
| #5012 build(deps): update dependency cryptography to v43 [security] (hotfix/8.3) - abandoned | snapcraft | closed | Cryptography 43.0.1 hotfix/8.3 bump was abandoned and closed unmerged; the equivalent main-branch security update merged via #5010 (31bec5200). | |
| #1870 build(deps): update dependency cryptography to v43.0.1 [security] (main) | charmcraft | merged | Merged #1870, bumping cryptography from 43.0.0 to 43.0.1 to address GHSA-h4gh-qq45-vh27; mainline merge commit: 438cafe0. | |
| #2568 build(deps): update dependency cryptography to v46 [security] (hotfix/3.5) | charmcraft | closed | Cryptography v46 update for hotfix/3.5 was closed unmerged after 219 days without activity or approval; five CI checks failed. The equivalent main-branch update later merged in #2583. |