build(deps): update dependency cryptography to v44 [security] (main) - autoclosed
Metadata
Current evaluation
Cryptography 44.0.1 update was not merged; PR #5286 was autoclosed after @mr-cal redirected the update to #5290.
Resolution: closed superseded
Reason: The unmerged Renovate PR was autoclosed after maintainer @mr-cal commented “Updated in #5290,” identifying #5290 as the replacement.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cryptography](https://redirect.github.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==43.0.3` -> `==44.0.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-12797](https://redirect.github.com/pyca/cryptography/security/advisories/GHSA-79v4-65xg-pq4g)
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 42.0.0-44.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20250211.txt.
If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v44.0.1`](https://redirect.github.com/pyca/cryptography/compare/44.0.0...44.0.1)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/44.0.0...44.0.1)
### [`v44.0.0`](https://redirect.github.com/pyca/cryptography/compare/43.0.3...44.0.0)
[Compare Source](https://redirect.github.com/pyca/cryptography/compare/43.0.3...44.0.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNzYuMiIsInVwZGF0ZWRJblZlciI6IjM5LjE3Ni4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Cryptography 44.0.1 update was not merged; PR #5286 was autoclosed after @mr-cal redirected the update to #5290. | |
| stealth/space-bunny-alpha | — | closed superseded | Autoclosed after maintainer @mr-cal noted that the cryptography v44 dependency update was handled in canonical/snapcraft#5290. | |
| stealth/space-bunny-alpha | — | closed superseded | Cryptography 44.0.1 was updated separately; this unmerged Renovate PR was autoclosed after a maintainer redirected the update to #5290. | |
| stealth/space-bunny-alpha | — | closed stale | Autoclosed unmerged; @mr-cal redirected the cryptography 44.0.1 update to snapcraft#5290. | |
| stealth/space-bunny-alpha | — | closed superseded | Renovate’s cryptography 44.0.1 update in #5286 was autoclosed as superseded by canonical/snapcraft#5290, where the dependency update was continued. | |
| stealth/space-bunny-alpha | — | closed superseded | Autoclosed unmerged after @mr-cal redirected the cryptography 44.0.1 security update to #5290. | |
| qwen/qwen3.6-35b-a3b | — | — | Superseded and autoclosed by Renovate after being replaced by PR #5290. The cryptography dependency update to v44.0.1 was handled in the newer pull request. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Superseded by PR #5290. The cryptography update to v44.0.1 for CVE-2024-12797 was closed after being merged in a separate pull request. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/snapcraft#5290
(confidence 98%)
The closing maintainer comment explicitly redirects the dependency update to #5290.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2163 build(deps): update dependency cryptography to v44.0.1 [security] (main) - autoclosed | charmcraft | closed | Renovate PR #2163 was autoclosed unmerged; the cryptography 44.0.1 update was instead merged through #2189 at commit bba6a32e. | |
| #2165 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.3) - autoclosed | charmcraft | closed | Renovate PR #2165 was autoclosed unmerged without CI or comments; cryptography 44.0.1 was later merged on main through #2189 (bba6a32e). | |
| #5252 build(deps): update dependency cryptography to v44 [security] (main) | snapcraft | closed | Closed unmerged as a duplicate of #5251, which proposed the same cryptography 43.0.3 to 44.0.1 security update. | |
| #2567 build(deps): update dependency cryptography to v46 [security] (main) - autoclosed | charmcraft | closed | Autoclosed unmerged; the cryptography 46.0.5 update was included in bulk dependency PR #2583 and merged as commit e66a25b5. | |
| #5285 no build(deps): update dependency cryptography to v44 [security] (main) | snapcraft | closed | Closed unmerged because #5217 blocked cryptography 44. PR #5290 fixed the blocker, and cryptography v44 was later applied in commits a07198db6 and 576f37676. | |
| #2164 build(deps): update dependency cryptography to v44 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate's cryptography 44.0.1 hotfix update was autoclosed unmerged after inactivity; no review, CI, or resolving commit was recorded. | |
| #5253 build(deps): update dependency cryptography to v44 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Renovate's cryptography 44.0.1 hotfix/7.5 update was autoclosed unmerged after prolonged inactivity; no review, CI result, or resolving commit was recorded. | |
| #2166 build(deps): update dependency cryptography to v44.0.1 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Renovate's cryptography 44.0.1 security bump for hotfix/3.4 was auto-closed unmerged after 598 days; no resolving commit or CI run was recorded. | |
| #2570 build(deps): update dependency cryptography to v46 [security] (hotfix/4.1) - autoclosed | charmcraft | closed | Autoclosed unmerged after 219 days; cryptography 46 later landed on main via #2583 (e66a25b5) and was advanced to 46.0.6 by #2617. | |
| #5254 build(deps): update dependency cryptography to v44 [security] (hotfix/8.6) - autoclosed | snapcraft | closed | Renovate’s cryptography 44.0.1 security update for hotfix/8.6 was autoclosed unmerged after 588 days, with no review, CI result, or replacement recorded. |