Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

chore(deps): bump cryptography from 46.0.7 to 48.0.1#119

Open
dependabot[bot] wants to merge 1 commit into
mainancilis/ancilis:mainfrom
dependabot/pip/cryptography-48.0.1ancilis/ancilis:dependabot/pip/cryptography-48.0.1Copy head branch name to clipboard
Open

chore(deps): bump cryptography from 46.0.7 to 48.0.1#119
dependabot[bot] wants to merge 1 commit into
mainancilis/ancilis:mainfrom
dependabot/pip/cryptography-48.0.1ancilis/ancilis:dependabot/pip/cryptography-48.0.1Copy head branch name to clipboard

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps cryptography from 46.0.7 to 48.0.1.

Changelog

Sourced from cryptography's changelog.

48.0.1 - 2026-06-09


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.

.. _v48-0-0:


48.0.0 - 2026-05-04

  • BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been removed. cryptography now requires Python 3.9 or later.

  • BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner TBSCertList.signature algorithm does not match the outer signatureAlgorithm now raises ValueError. Previously, such CRLs were parsed successfully and only rejected during signature validation.

  • Added support for :doc:/hazmat/primitives/asymmetric/mlkem and :doc:/hazmat/primitives/asymmetric/mldsa when using OpenSSL 3.5.0 or later, in addition to the existing AWS-LC and BoringSSL support. This means post-quantum algorithms are now available to users of our wheels.

    • Note: Going forward, we do not guarantee that all functionality in cryptography will be available when building against OpenSSL. See :doc:/statements/state-of-openssl for more information.

.. _v47-0-0:

47.0.0 - 2026-04-24


* Support for Python 3.8 is deprecated and will be removed in the next
  ``cryptography`` release.
* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves
  (``SECT*`` classes) has been removed. These curves are rarely used and
  have additional security considerations that make them undesirable.
* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.
  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC
  continue to be supported.
* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 4.1.
* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or
  keys with unsupported explicit curve encodings now raises
  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of
  ``ValueError``. This change affects
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,
  and :meth:`~cryptography.x509.Certificate.public_key` when called on
  certificates with unsupported public key algorithms.
</tr></table>

... (truncated)

Commits

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
chore(deps): bump cryptography from 46.0.7 to 48.0.1
6747454 
Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.7 to 48.0.1.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@46.0.7...48.0.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 48.0.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jun 17, 2026
@dependabot
dependabot Bot requested a review from ancilis as a code owner June 17, 2026 10:46
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jun 17, 2026
@github-actions

github-actions Bot commented Jun 17, 2026

Copy link
Copy Markdown

⚠️ Claude reviewer Action failed to produce a verdict. Falling back to human review. (Run: https://github.com/ancilis/ancilis/actions/runs/27683479873)

@ancilis

ancilis commented Jun 17, 2026

Copy link
Copy Markdown
Owner

Claude Reviewer

Recommendation: APPROVE WITH NOTES

Linked ticket: NONE
Scope match: no ticket

Findings

Scope match — info. No linked ANC-XXXX ticket in title, branch, description, or commit. Expected for Dependabot; noted per the scope-match dimension but not blocking. The diff is exactly one line in requirements-lock.txt (cryptography 46.0.7 → 48.0.1) and matches the stated intent — no hidden additions.

Hidden assumptions / risk — warn. This is a two-major-version jump (46 → 48), and the changelog carries several BACKWARDS INCOMPATIBLE changes that a lockfile bump silently absorbs:

  • Minimum Python is now 3.9 (3.8 support removed in 48.0.0). Confirm Ancilis's pyproject.toml floor and CI matrix don't still target 3.8, or this breaks install resolution.
  • load_pem/der_private_key, load_pem/der_public_key, and Certificate.public_key() now raise UnsupportedAlgorithm instead of ValueError for unsupported keys/curves (47.0.0). Any error handling around key/cert loading that catches ValueError will silently stop catching.
  • Binary elliptic curves (SECT*) and OpenSSL 1.1.x support removed. Low probability Ancilis touches these, but worth a grep.
  • X.509 CRL inner/outer signature-algorithm mismatch now raises ValueError at load time.

I could not verify direct usage from the diff alone (codebase index access was denied this run). The evidence-chain integrity mechanism uses SHA-256 via stdlib hashlib, so the hash chain itself is unaffected by this bump — but if cryptography is used anywhere for key/cert loading or signing, the error-type and curve changes above apply.

Hygiene — info. Clean. No agent/IDE local-state files, no absolute dev paths, no machine identifiers. Single-line lockfile change. PR body is the standard Dependabot template (no risk checklist / test plan / IP line); acceptable for an automated dep PR, flagged only for completeness.

Suggested follow-up

  • Confirm the Python version floor in pyproject.toml and CI is >=3.9 before merge (or as a fast follow); this is the single most likely breakage.
  • Grep the SDK and platform for cryptography imports and except ValueError around any load_*_key / Certificate.public_key() / CRL handling; widen to UnsupportedAlgorithm where found.
  • File a backfill ticket (ANC-XXXX) so this bump has a traceable record.

Reviewer notes

Lockfile-only major bumps are the classic case where "passes CI" and "safe" diverge — the breakage surfaces only on code paths the test suite doesn't exercise (cert loading, unusual curves) or on a Python version the CI matrix dropped. Given Ancilis leans on SHA-256 hash chaining (stdlib) rather than cryptography for evidence integrity, the blast radius is probably small, but "probably" is doing work there because I couldn't inspect imports this pass. If CI is green on the supported Python matrix and a quick import grep comes back clean, this is a safe merge.

Claude claude-opus-4-8 · review_id: 860c44cf-bf3e-473c-93d0-ee5dadec4adc · prompt_version: 2026-05-03.1 · context: pr_diff, pr_metadata, commits, ticket:none, project_instructions, aksi_framework, adr:session-2026-03-13-adr-005-producer-protocol.md

@ancilis

ancilis commented Jun 17, 2026

Copy link
Copy Markdown
Owner

Merger cannot land this PR without a linked Paperclip issue. Please add the ANC-XXXX identifier to the PR title, then move the linked issue to in_review when it is ready to land.

ancilis
ancilis requested changes Jul 6, 2026
View reviewed changes

@ancilis ancilis left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Requesting changes for merge readiness.

  • I validated the PR merge ref locally with Python 3.13 and the current Node toolchain: pytest python/tests/ -v passed (3337 passed, 2 skipped, 1 xfailed) and npx vitest run passed (1046 passed, 2 skipped).
  • The cryptography bump itself looks low risk for this repo: pyproject.toml already requires Python >=3.10, and I found no direct in-repo imports of cryptography or its key-loading APIs.
  • I cannot approve while required gates remain red:
    1. Dependency Audit still fails on requirements-lock.txt with 9 known vulnerabilities in unrelated pins (msgpack 1.1.2, pydantic-settings 2.13.1, python-multipart 0.0.27, starlette 1.0.1). This PR leaves the lockfile in a non-mergeable state even though the cryptography line itself is fine.
    2. Validate ANC issue linkage still fails because the PR has no linked ANC-XXXX identifier.

Please reroll this as an issue-linked dependency update that also clears the remaining vulnerable pins, or land it through the broader dependency-remediation branch once audit is green.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ancilis ancilis ancilis requested changes

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ancilis
Morty Proxy This is a proxified and sanitized view of the page, visit original site.