build(no-ticket): upgrade cryptography to 50.0.0 - #346
Open
cloudsmith-iduffy wants to merge 1 commit into
Open
Conversation
CVE-2026-69247 (high): pkcs7_decrypt_der/_pem/_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in distinguishable ways, one of which disclosed the length recovered from the RSA operation — a Bleichenbacher oracle against the content-encryption key for any service that decrypts attacker- supplied EnvelopedData and reflects the result. The CLI does not call the PKCS#7 decryption APIs; cryptography arrives transitively via PyJWT[crypto], keyring and secretstorage. This is a lockfile bump to clear the CodeQL dependency alert on every branch, not a fix for anything the CLI itself is exposed to. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Clears the high-severity CodeQL dependency alert CVE-2026-69247 (
cryptography49.0.0 → 50.0.0), which currently fails the CodeQL check on every open PR.pkcs7_decrypt_der,pkcs7_decrypt_pemandpkcs7_decrypt_smimereported the outcome of decrypting aRecipientInfo'sencryptedKeyin several distinguishable ways — one of which disclosed the exact length recovered from the RSA operation, and the same distinction was observable by timing. A service that auto-decrypts attacker-suppliedEnvelopedDataand answers adaptively gets a Bleichenbacher oracle against the content-encryption key.The CLI never calls those APIs;
cryptographyarrives transitively viaPyJWT[crypto],keyringandsecretstorage. So this is a lockfile bump to clear the alert, not a fix for exposure in this codebase.Lockfile only —
pyproject.tomlis unchanged, sincecryptographyis not a direct dependency.Type of Change
Dependency/security bump.
Additional Notes
uv lock --upgrade-package cryptography, thenuv sync --all-extras --dev. Test suite on this branch: 628 passed, 40 skipped.Note this touches
uv.lock, as does the companionmcpbump — whichever merges second will need a re-lock.🤖 Generated with Claude Code