← Back to issue list

build(deps): bump cryptography from 46.0.3 to 46.0.5

View original Github issue

Metadata

Project
snapcraft
Number
#6030
Type
pull request
State
merged
Author
mr-cal
Labels
—
Created
Updated
Closed

Current evaluation

Merged into hotfix/8.14 as 636b6cfaf, bumping cryptography 46.0.3 to 46.0.5 to address an OSV hotfix.

Resolution: closed resolved

Reason: PR canonical/snapcraft#6030 merged as commit 636b6cfaf. It updated hotfix/8.14 for an OSV, received two approvals, and passed all reported CI checks.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Bumps cryptography for hotfix/8.14 for an OSV. --- - [x] I've followed the [contribution guidelines](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md). - [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] I've updated the relevant release notes.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged into hotfix/8.14 as 636b6cfaf, bumping cryptography 46.0.3 to 46.0.5 to address an OSV hotfix.
stealth/space-bunny-alpha — closed resolved Merged PR #6030 (commit 636b6cfaf) bumped cryptography 46.0.3 -> 46.0.5 on hotfix/8.14 to remediate an OSV vulnerability; all CI checks passed.
stealth/space-bunny-alpha — closed resolved Merged PR #6030 updated hotfix/8.14 from cryptography 46.0.3 to 46.0.5 for an OSV hotfix, landing as commit 636b6cfaf.
stealth/space-bunny-alpha — closed resolved Merged PR #6030, updating cryptography from 46.0.3 to 46.0.5 on hotfix/8.14 to address an OSV.
qwen/qwen3.6-35b-a3b — — Merged after review and passing CI checks. Updates the cryptography dependency from 46.0.3 to 46.0.5 to address an OSV security advisory on the hotfix/8.14 branch.
qwen3.6-35b-a3b-mtp-q6 — — Merged dependency update bumping cryptography from 46.0.3 to 46.0.5 to address an OSV security advisory on the hotfix/8.14 branch. The maintainer-submitted change was accepted and merged without additional comments or documentation updates.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/snapcraft#6029 (confidence 95%)

    A separate merge made the same cryptography bump in commit edb2a7453.

Related issues

Issue Project State Summary Similarity
#6135 build(deps): bump cryptography from 46.0.5 to 46.0.6 snapcraft merged Merged #6135 as commit 1acb182bf, bumping cryptography 46.0.5 to 46.0.6 to fix CVE-2026-34073.
89%
#6029 build(deps): bump cryptography from 46.0.3 to 46.0.5 snapcraft merged Merged as edb2a7453, updating cryptography from 46.0.3 to 46.0.5 to address CVE-2026-26007 and related security fixes.
88%
#86 build(deps): bump cryptography from 46.0.1 to 46.0.5 debcraft merged Dependabot bumped cryptography 46.0.1→46.0.5 in uv.lock; merged as commit 8d82006 (CVE-2026-26007 fix). Later superseded by #111 (46.0.6) and #122 (46.0.7).
86%
#1098 build(deps): bump cryptography craft-application merged Merged in #1098 via commit 239b3af7, updating cryptography 48.0.0 to 49.0.0 to resolve OSV GHSA-537c-gmf6-5ccf.
85%
#2617 build(deps): bump cryptography from 46.0.5 to 46.0.6 charmcraft merged Merged #2617 in commit ba2c0c9a, upgrading cryptography 46.0.5 to 46.0.6 to fix CVE-2026-34073’s wildcard DNS SAN name-constraint verification flaw.
84%
#356 build(deps): bump cryptography craft-store merged Merged PR #356 as commit fcbad5c, bumping cryptography to remediate OSV GHSA-p423-j2cm-9vmq.
83%
#318 build: bump cryptography to 46.0.7 imagecraft merged Merged PR #318 (commit 8a390e6) by smethnani bumped cryptography to 46.0.7 in uv.lock to clear an OSV vulnerability; later superseded by #357 (49.0.0) and #421 (50.0.2).
83%
#2570 build(deps): update dependency cryptography to v46 [security] (hotfix/4.1) - autoclosed charmcraft closed Autoclosed unmerged after 219 days; cryptography 46 later landed on main via #2583 (e66a25b5) and was advanced to 46.0.6 by #2617.
83%
#111 build(deps): bump cryptography from 46.0.5 to 46.0.6 debcraft merged Dependabot bump of cryptography 46.0.5 -> 46.0.6 (security fix for CVE-2026-34073) merged into debcraft, updating uv.lock. Follow-up bump to 46.0.7 later landed via #122.
83%
#1872 build(deps): update dependency cryptography to v43.0.1 [security] (hotfix/3.2) charmcraft merged Renovate security bump of cryptography 43.0.0 -> 43.0.1 merged into hotfix/3.2 as commit a98a8b4f, fixing vulnerable bundled OpenSSL (GHSA-h4gh-qq45-vh27). Sibling bumps landed via #1870 (438cafe0) and #1871.
83%