From 150093f780b79f840c87841367623ed30a0a5f0a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 11:21:59 +0000 Subject: [PATCH 1/3] Bump cryptography from 49.0.0 to 50.0.0 (#13320) Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0.
Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:

:func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
and its PEM and S/MIME variants no longer expose distinguishable errors
or
timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which
could
act as a Bleichenbacher oracle for callers that decrypt untrusted
messages.
A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys
or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
:class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for
constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>`
APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
<https://c2sp.org/chunked-encryption>`_ for streaming
authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
carry trailing bytes after the list or after an individual SCT, instead
of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field
type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a
non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
``GeneralizedTime`` that carries fractional seconds or another non-DER
form,
matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
:func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a
request
or response whose ``version`` field is not ``v1``, the only version
defined
by RFC 6960, matching the version validation already performed when
loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now
supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported
when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now
supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cryptography&package-manager=pip&previous-version=49.0.0&new-version=50.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- requirements/test-common.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test.txt | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 063d2cbe655..4670156dd6d 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -69,7 +69,7 @@ coverage==7.15.2 # via # -r requirements/test-common.in # pytest-cov -cryptography==49.0.0 +cryptography==50.0.0 # via trustme cython==3.2.9 # via -r requirements/cython.in diff --git a/requirements/dev.txt b/requirements/dev.txt index 87ad532db85..e2c7778d042 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -69,7 +69,7 @@ coverage==7.15.2 # via # -r requirements/test-common.in # pytest-cov -cryptography==49.0.0 +cryptography==50.0.0 # via trustme distlib==0.4.3 # via virtualenv diff --git a/requirements/lint.txt b/requirements/lint.txt index 0e27dcc65bd..668157d4b8e 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -34,7 +34,7 @@ cffi==2.1.0 # pycares cfgv==3.5.0 # via pre-commit -cryptography==49.0.0 +cryptography==50.0.0 # via trustme distlib==0.4.3 # via virtualenv diff --git a/requirements/test-common.txt b/requirements/test-common.txt index 99ce2ff4d9c..ed836a54582 100644 --- a/requirements/test-common.txt +++ b/requirements/test-common.txt @@ -26,7 +26,7 @@ coverage==7.15.2 # via # -r requirements/test-common.in # pytest-cov -cryptography==49.0.0 +cryptography==50.0.0 # via trustme exceptiongroup==1.3.1 # via pytest diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index 5d04cf0b389..2ebe32e632b 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -42,7 +42,7 @@ coverage==7.15.2 # via # -r requirements/test-common.in # pytest-cov -cryptography==49.0.0 +cryptography==50.0.0 # via trustme exceptiongroup==1.3.1 # via diff --git a/requirements/test.txt b/requirements/test.txt index ee0e2fd3f57..3c0665de2b2 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -42,7 +42,7 @@ coverage==7.15.2 # via # -r requirements/test-common.in # pytest-cov -cryptography==49.0.0 +cryptography==50.0.0 # via trustme exceptiongroup==1.3.1 # via From 58ac2f4e68a3639c160529a9bf82b8f9e8758b41 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 11:33:41 +0000 Subject: [PATCH 2/3] Bump aiofastnet from 0.22.0 to 1.0.1 (#13323) Bumps [aiofastnet](https://github.com/tarasko/aiofastnet) from 0.22.0 to 1.0.1.
Release notes

Sourced from aiofastnet's releases.

1.0.1

  • Small performance tweaks

1.0.0

First non-beta release. Loop's transport/protocol layer API is complete. Only subprocess's transports do not exist, but they are not performance critical anyway.

  • Added connect_read_pipe, connect_write_pipe
Changelog

Sourced from aiofastnet's changelog.

1.0.1

  • Small performance tweaks

1.0.0

First non-beta release. Loop's transport/protocol layer API is pretty much complete. Only subprocess transports do not exist, but they are not performance critical.

  • Added connect_read_pipe, connect_write_pipe
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aiofastnet&package-manager=pip&previous-version=0.22.0&new-version=1.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/base-ft.txt | 2 +- requirements/base.txt | 2 +- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- requirements/runtime-deps.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test-mobile.txt | 2 +- requirements/test.txt | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/requirements/base-ft.txt b/requirements/base-ft.txt index 1ded7c15a45..0c14b4f836f 100644 --- a/requirements/base-ft.txt +++ b/requirements/base-ft.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.22.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.0.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/base.txt b/requirements/base.txt index 812b41366f1..710cd8f7f6d 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.22.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.0.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 4670156dd6d..177bff4c441 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -8,7 +8,7 @@ aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in -aiofastnet==0.22.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.0.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in diff --git a/requirements/dev.txt b/requirements/dev.txt index e2c7778d042..c2bf345637c 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -8,7 +8,7 @@ aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in -aiofastnet==0.22.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.0.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in diff --git a/requirements/lint.txt b/requirements/lint.txt index 668157d4b8e..08ad76a7df8 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 # via -r requirements/lint.in -aiofastnet==0.22.0 +aiofastnet==1.0.1 # via -r requirements/lint.in aiohappyeyeballs==2.7.1 # via aiohttp diff --git a/requirements/runtime-deps.txt b/requirements/runtime-deps.txt index 11e0ba3c487..680de25772b 100644 --- a/requirements/runtime-deps.txt +++ b/requirements/runtime-deps.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.22.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.0.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index 2ebe32e632b..5442fbddd15 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.22.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.0.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via diff --git a/requirements/test-mobile.txt b/requirements/test-mobile.txt index adb9e2e8778..7ed2f1f2710 100644 --- a/requirements/test-mobile.txt +++ b/requirements/test-mobile.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.22.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.0.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via diff --git a/requirements/test.txt b/requirements/test.txt index 3c0665de2b2..4e09b2860a3 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.22.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.0.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via From c0ef574e29109210e96e652771ae4e7b88615fa4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 11:39:03 +0000 Subject: [PATCH 3/3] Bump python-discovery from 1.5.0 to 1.5.1 (#13324) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [python-discovery](https://github.com/tox-dev/python-discovery) from 1.5.0 to 1.5.1.
Release notes

Sourced from python-discovery's releases.

v1.5.1

What's Changed

Full Changelog: https://github.com/tox-dev/python-discovery/compare/1.5.0...1.5.1

Changelog

Sourced from python-discovery's changelog.

Bug fixes - 1.5.1

  • Locate uv's interpreter store the way uv does, using XDG on macOS (~/.local/share/uv/python) and roaming %APPDATA%\uv\python on Windows, neither of which platformdirs reported. The uv variables now come from the env mapping rather than os.environ - by :user:gaborbernat. (:issue:109)
  • Pick uv-managed interpreters by install directory name instead of globbing the store. A bare 3.8 now means CPython, the way uv resolves it, rather than whichever implementation the filesystem happened to list first, and probing runs newest version first - by :user:gaborbernat. (:issue:110)

Packaging updates and notes for downstreams - 1.5.1

  • Drop the platformdirs runtime dependency; locating uv's store was the only thing it did - by :user:gaborbernat. (:issue:109)

v1.5.0 (2026-07-21)

Commits
  • 73a8369 release 1.5.1
  • f2bd713 🐛 fix(uv): pick store installs by directory name (#112)
  • b94b232 🐛 fix(uv): match uv's interpreter store lookup (#111)
  • 97db92f build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (#108)
  • dae1a0b [pre-commit.ci] pre-commit autoupdate (#107)
  • 45d10b6 build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#106)
  • 35f701e build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#105)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python-discovery&package-manager=pip&previous-version=1.5.0&new-version=1.5.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 6 ++---- requirements/dev.txt | 6 ++---- requirements/lint.txt | 6 ++---- 3 files changed, 6 insertions(+), 12 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 177bff4c441..62daf40ff83 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -168,9 +168,7 @@ pip-tools==7.6.0 pkgconfig==1.6.0 # via -r requirements/test-common-base.in platformdirs==4.11.0 - # via - # python-discovery - # virtualenv + # via virtualenv pluggy==1.6.0 # via # pytest @@ -238,7 +236,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.5.0 +python-discovery==1.5.1 # via virtualenv python-on-whales==0.81.0 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index c2bf345637c..9d6235496dd 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -165,9 +165,7 @@ pip-tools==7.6.0 pkgconfig==1.6.0 # via -r requirements/test-common-base.in platformdirs==4.11.0 - # via - # python-discovery - # virtualenv + # via virtualenv pluggy==1.6.0 # via # pytest @@ -233,7 +231,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.5.0 +python-discovery==1.5.1 # via virtualenv python-on-whales==0.81.0 # via diff --git a/requirements/lint.txt b/requirements/lint.txt index 08ad76a7df8..071768ae054 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -85,9 +85,7 @@ packaging==26.2 pathspec==1.1.1 # via mypy platformdirs==4.11.0 - # via - # python-discovery - # virtualenv + # via virtualenv pluggy==1.6.0 # via pytest pre-commit==4.6.1 @@ -127,7 +125,7 @@ pytest-mock==3.15.1 # via -r requirements/lint.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.5.0 +python-discovery==1.5.1 # via virtualenv python-on-whales==0.81.0 # via -r requirements/lint.in