Skip to content

fix: bump cryptography to ~=50.0 - #706

Merged
gjtorikian merged 1 commit into
mainfrom
chore/bump-cryptography-50
Aug 4, 2026
Merged

fix: bump cryptography to ~=50.0#706
gjtorikian merged 1 commit into
mainfrom
chore/bump-cryptography-50

Conversation

@gjtorikian

@gjtorikian gjtorikian commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Bump the cryptography requirement from ~=49.0 to ~=50.0 (>=50.0,<51.0) and re-lock to 50.0.0.
  • Clears CVE-2026-69247 / GHSA-g6cj-pr64-35w5 (PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle), which affects >=44.0.0,<50.0.0 and is fixed in 50.0.0.
  • The SDK only uses long-stable cryptography APIs (Fernet in session.py, Cipher/algorithms/modes + default_backend in vault/_resource.py), which are unchanged in the 50.x line.

Closes #705

Move the cryptography requirement from ~=49.0 to ~=50.0 (>=50.0,<51.0)
and re-lock to 50.0.0. This clears CVE-2026-69247 / GHSA-g6cj-pr64-35w5
(PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle),
which affects >=44.0.0,<50.0.0 and is fixed in 50.0.0.

The SDK only uses long-stable cryptography APIs (Fernet in session.py,
Cipher/algorithms/modes + default_backend in vault/_resource.py), which
are unchanged in the 50.x line.
@gjtorikian
gjtorikian requested review from a team as code owners August 4, 2026 13:51
@gjtorikian
gjtorikian requested a review from mattgd August 4, 2026 13:51
@gjtorikian
gjtorikian merged commit 1bc5917 into main Aug 4, 2026
12 checks passed
@gjtorikian
gjtorikian deleted the chore/bump-cryptography-50 branch August 4, 2026 13:52
@greptile-apps

greptile-apps Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

Updates the supported cryptography release line from 49.x to 50.x to consume the security fix in 50.0.0.

  • Raises the direct dependency constraint to cryptography~=50.0.
  • Regenerates the lockfile with cryptography 50.0.0 artifacts and matching package metadata.

Confidence Score: 5/5

The PR appears safe to merge with no actionable changed-code defects identified.

The manifest and lockfile consistently select cryptography 50.0.0, while the other advisory-matched dependencies are unchanged from the base branch and do not represent regressions introduced here.

Important Files Changed

Filename Overview
pyproject.toml Updates the direct cryptography requirement from the 49.x release line to 50.x; no actionable compatibility defect was identified.
uv.lock Consistently re-locks cryptography at 50.0.0 and updates its artifact hashes and project dependency metadata.

Reviews (1): Last reviewed commit: "chore: bump cryptography to ~=50.0" | Re-trigger Greptile

@gjtorikian gjtorikian changed the title chore: bump cryptography to ~=50.0 fix: bump cryptography to ~=50.0 Aug 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

Support cryptography 50.0.0 for CVE-2026-69247

1 participant