Skip to content

build(deps): bump cryptography from 46.0.5 to 50.0.0 in /tests - #9

Open
dependabot[bot] wants to merge 1 commit into
far-mainfrom
dependabot/pip/tests/cryptography-50.0.0
Open

build(deps): bump cryptography from 46.0.5 to 50.0.0 in /tests#9
dependabot[bot] wants to merge 1 commit into
far-mainfrom
dependabot/pip/tests/cryptography-50.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 7, 2026

Copy link
Copy Markdown

Bumps cryptography from 46.0.5 to 50.0.0.

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump cryptography from 46.0.5 to 50.0.0 in /tests
d1587fa 
Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.5 to 50.0.0.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@46.0.5...50.0.0)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 7, 2026
@dependabot dependabot Bot mentioned this pull request Aug 7, 2026
Closed
claude[bot]
claude Bot reviewed Aug 7, 2026
View reviewed changes

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — straightforward dependency bump.

What was reviewed: the change is a single-line version bump of cryptography (46.0.5 → 50.0.0) in requirements.txt for the tests directory, which is a transitive dependency needed for the community.crypto Ansible module. No code changes accompany this bump, and the new version includes a security fix (Bleichenbacher oracle timing leak in PKCS7 decryption) rather than introducing one.

Extended reasoning...

Overview

The PR touches a single line in tests/requirements.txt, bumping the cryptography pip package from 46.0.5 to 50.0.0. This is a Dependabot-generated dependency update with no application code changes. The dependency is used to support the community.crypto Ansible module in the test tooling, not in production cluster provisioning logic.

Security risks

No new security risks are introduced. The changelog for this major version bump actually includes a security fix (CVE-2026-69247, a Bleichenbacher-oracle timing/error leak in PKCS7 encryptedKey decryption), so this bump is defensive rather than risky. There is a large jump across major versions (46 → 50), which could theoretically introduce breaking API changes, but since this is only a test-tooling dependency and not vendored/used directly in kubespray's own source, the blast radius is limited to whether the test suite still runs correctly against the new version.

Level of scrutiny

This warrants minimal scrutiny — it is a routine, automated dependency bump confined to a test requirements file with no logic changes. It matches the 'simple, mechanical' category that doesn't need human review, similar to the pattern of prior dependency-bump commits already merged in this repo's history (e.g. the immediately preceding commit in the log bumping the same package).

Other factors

The bug-hunting system found no issues, and there are no unresolved review comments in the PR timeline. CI (if configured) would catch any incompatibility with the new major version during the test run itself.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@claude claude[bot] claude[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants