Bump cryptography from 49.0.0 to 50.0.0 - #3228
Conversation
Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@49.0.0...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift-eng member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
openshift-ci
Bot
added
the
needs-ok-to-test
WalkthroughThe project metadata raises the minimum required ChangesCryptography dependency update
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pyproject.toml`:
- Line 40: Pin the cryptography dependency in the project dependency list to
exactly version 50.0.0 instead of using a lower-bound constraint, then
regenerate uv.lock so it reflects that exact requirement and resolved version.
No compatibility changes or migration tests are needed beyond this dependency
and lockfile update.
- Line 40: Update the production container dependency installation to use the
locked dependencies from uv.lock, replacing the uv pip install -e . flow with uv
sync --frozen or an equivalent hashed installation so CI’s uv audit --locked
requirements are preserved.
- Line 40: Update the cryptography dependency declaration in pyproject.toml from
a minimum version to the exact version 50.0.0, then regenerate uv.lock so its
metadata matches the pinned requirement.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift-eng/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 9e0ecec9-8b8a-4c17-ae43-67d7e5e66153
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
pyproject.toml
| "bashlex>=0.18", | ||
| "click>=8.1.8", | ||
| "cryptography>=46.0.3", | ||
| "cryptography>=50.0.0", |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n --hidden -S 'requires-python|python_requires|3\.9\.0|3\.9\.1' .
rg -n --hidden -S 'cryptography|DH|Diffie|x509|ocsp|sct|pkcs7|serialization' .Repository: openshift-eng/art-tools
Length of output: 38584
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- pyproject.toml ---'
cat -n pyproject.toml | sed -n '1,60p'
printf '%s\n' '--- cryptography lock entry ---'
cat -n uv.lock | sed -n '810,875p'
printf '%s\n' '--- Python/tooling and test configuration ---'
rg -n --hidden -S 'python-version|python3|pytest|testpaths|requires-python|python_requires|cryptography' \
.github pyproject.toml uv.lock 2>/dev/null || true
printf '%s\n' '--- Relevant cryptography API references ---'
rg -n --hidden -S \
'DHParameterNumbers|DHPrivateKey|DHPublicKey|dh_parameters|generate_parameters|x509\.|Certificate|verify_directly_issued_by|ocsp|SignedCertificateTimestamp|sct|pkcs7|serialization\.' \
--glob '*.py' --glob '*.toml' --glob '*.yaml' --glob '*.yml' --glob '*.json' . || trueRepository: openshift-eng/art-tools
Length of output: 39843
🌐 Web query:
cryptography 50.0.0 release notes Python 3.9.0 3.9.1 deprecations finite-field DH X.509 OCSP SCT PKCS7 serialization
💡 Result:
The cryptography library version 50.0.0, released on July 31, 2026, introduces several significant changes, deprecations, and security updates [1][2]. Deprecations and Security Updates - Diffie-Hellman Key Exchange (FFDH): Finite-field Diffie-Hellman (FFDH) is now deprecated [1][2]. This deprecation encompasses all associated types in cryptography.hazmat.primitives.asymmetric.dh and includes loading FFDH keys or parameters via the key loading APIs [1][2]. Users are advised to migrate to more modern key exchange algorithms [1][2]. - PKCS7 Security Fix: A security issue involving pkcs7_decrypt_der and its PEM/S/MIME variants was addressed [1][2]. These functions no longer expose distinguishable errors or timing when unwrapping a RecipientInfo encryptedKey to prevent potential Bleichenbacher oracle attacks [1][2]. A random key is substituted upon failure, following RFC 3218 [1][2]. X.509, OCSP, and SCT Updates - Stability: X.509 verification APIs are now considered stable and subject to the project's API stability policy [1][2]. - SCT Parsing: Parsing a Signed Certificate Timestamp (SCT) list now rejects encodings that contain trailing bytes after the list or after an individual SCT, rather than silently ignoring them [2][3]. - X.509/ASN.1: Support was added for using x509.Name as a field type in the cryptography.hazmat.asn1 module [2][4]. Additionally, parsing a CRL entry's InvalidityDate extension now strictly rejects GeneralizedTime values that contain fractional seconds or other non-DER forms [2]. Python Support - The cryptography library currently supports Python 3.9+ [2]. Support for older versions, such as Python 3.8, was removed in earlier releases (e.g., v48.0.0) [5]. Other Notable Changes - New features include the addition of xof class methods to SHAKE128 and SHAKE256 for XOFHash usage and the introduction of the Cobblestone recipe for streaming authenticated encryption [1][2]. Additionally, public key and EC private key loading now reject DER encodings where the BIT STRING declares a non-zero number of unused bits [2][4].
Citations:
- 1: https://cryptography.io/en/stable/changelog/
- 2: https://mail.python.org/archives/list/cryptography-dev@python.org/thread/46QIPRIYUQZR7MMM4FEZCBJJW4UAXZUO/
- 3: https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst
- 4: https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst
- 5: https://chromium.googlesource.com/external/github.com/pyca/cryptography/+/d7008e8ac992cc56406f58331be748be2d3eae1d/CHANGELOG.rst
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- project metadata ---'
sed -n '1,55p' pyproject.toml
printf '%s\n' '--- lock package metadata ---'
sed -n '818,830p' uv.lock
printf '%s\n' '--- test and CI Python versions ---'
rg -n --hidden -S 'python-version|python:|Python|pytest|testpaths' \
.github pyproject.toml 2>/dev/null || true
printf '%s\n' '--- cryptography API usage in Python source ---'
rg -n --hidden -S \
'Diffie|DHParameter|DHPrivate|DHPublic|generate_parameters|x509|ocsp|SignedCertificateTimestamp|pkcs7|serialization' \
--glob '*.py' . || trueRepository: openshift-eng/art-tools
Length of output: 6550
🌐 Web query:
cryptography 50.0.0 changelog release notes supported Python versions deprecations
💡 Result:
The cryptography library version 50.0.0 was released on July 31, 2026 [1]. Supported Python Versions Cryptography 50.0.0 supports Python 3.9+ and PyPy3 3.11+ [2]. Key Changes and Deprecations in 50.0.0 - Security Issue: pkcs7_decrypt_der (including PEM and S/MIME variants) was updated to prevent a Bleichenbacher oracle vulnerability. It no longer exposes distinguishable errors or timing when unwrapping an encryptedKey; instead, a random key is substituted on failure [1][2]. - Deprecation: Diffie-Hellman key exchange over finite fields (FFDH) is now deprecated [1][2]. This includes the types in cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or parameters via key loading APIs. Users are advised to migrate to modern key exchange algorithms [1][2]. - API Updates: - Added xof class methods to SHAKE128 and SHAKE256 for use with XOFHash [1][2]. - X.509 verification APIs are now considered stable and subject to the project's API stability policy [1][2]. - Introduced the Cobblestone recipe (implementing Cobblestone-128 and Cobblestone-256 for chunked-encryption) [2]. - Behavioral Changes: - Parsing a Signed Certificate Timestamp (SCT) list now strictly rejects encodings containing trailing bytes [2]. - Loading a public or EC private key now rejects DER where the subjectPublicKey/publicKey BIT STRING declares a non-zero number of unused bits [2]. - Parsing an InvalidityDate extension now rejects non-DER forms (such as those with fractional seconds) [2]. - Added support for using x509.Name as a field type in the cryptography.hazmat.asn1 module [2].
Citations:
- 1: https://cryptography.io/en/stable/changelog/
- 2: https://mail.python.org/archives/list/cryptography-dev@python.org/thread/46QIPRIYUQZR7MMM4FEZCBJJW4UAXZUO/
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- pyproject dependency context ---'
cat -n pyproject.toml | sed -n '1,50p'
printf '%s\n' '--- direct cryptography call sites ---'
python3 - <<'PY'
from pathlib import Path
import re
terms = re.compile(
r'(?:from\s+cryptography|import\s+cryptography|'
r'\b(?:DHParameterNumbers|DHPrivateKey|DHPublicKey|'
r'generate_parameters|x509|ocsp|SignedCertificateTimestamp|'
r'pkcs7|serialization)\b)'
)
for path in Path('.').rglob('*.py'):
text = path.read_text(errors='ignore')
for number, line in enumerate(text.splitlines(), 1):
if terms.search(line):
print(f'{path}:{number}:{line}')
PY
printf '%s\n' '--- test matrix references ---'
find .github -type f -maxdepth 4 -print 2>/dev/null |
xargs -r grep -nE 'python-version|3\.([0-9]+)' 2>/dev/null || trueRepository: openshift-eng/art-tools
Length of output: 3951
Pin and scope the cryptography compatibility check. Replace cryptography>=50.0.0 with cryptography==50.0.0 and update uv.lock. The project requires Python >=3.11, so Python 3.9.0 and 3.9.1 are outside its support range. Repository usage is limited to X.509 certificate loading and test certificate generation; no finite-field DH, X.509 verification, OCSP/SCT, PKCS#7, or key-serialization call sites require migration tests.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pyproject.toml` at line 40, Pin the cryptography dependency in the project
dependency list to exactly version 50.0.0 instead of using a lower-bound
constraint, then regenerate uv.lock so it reflects that exact requirement and
resolved version. No compatibility changes or migration tests are needed beyond
this dependency and lockfile update.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
curl -fsSL https://pypi.org/pypi/cryptography/50.0.0/json \
| jq '[.releases["50.0.0"][] | {filename, yanked, digests}]'
curl -fsSL https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
--data '{"package":{"ecosystem":"PyPI","name":"cryptography"},"version":"50.0.0"}' \
| jq '{vulnerabilities: [.vulns[]? | {id, summary}]}'
rg -n --hidden -S 'cryptography|--hash=|pip-audit|osv|cyclonedx|syft|cosign|sigstore' .Repository: openshift-eng/art-tools
Length of output: 219
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- pyproject.toml ---'
sed -n '1,100p' pyproject.toml
printf '%s\n' '--- dependency and supply-chain controls ---'
rg -n --hidden -S 'cryptography|--hash=|pip-audit|osv|cyclonedx|syft|cosign|sigstore|constraints|lock' \
-g '!*.lock' -g '!node_modules' -g '!dist' -g '!build' . || true
printf '%s\n' '--- PyPI release metadata ---'
curl -fsSL https://pypi.org/pypi/cryptography/50.0.0/json \
| python3 -c 'import json,sys; d=json.load(sys.stdin); print(json.dumps({"info_version": d.get("info",{}).get("version"), "release_files": [{"filename": x.get("filename"), "yanked": x.get("yanked"), "digests": x.get("digests")} for x in d.get("releases",{}).get("50.0.0",[])]}, indent=2))'
printf '%s\n' '--- OSV result ---'
curl -fsSL https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
--data '{"package":{"ecosystem":"PyPI","name":"cryptography"},"version":"50.0.0"}' \
| python3 -c 'import json,sys; d=json.load(sys.stdin); print(json.dumps({"vulnerabilities":[{"id":v.get("id"),"summary":v.get("summary")} for v in d.get("vulns",[])]}, indent=2))'Repository: openshift-eng/art-tools
Length of output: 50380
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- dependency declaration ---'
nl -ba pyproject.toml | sed -n '30,50p'
printf '%s\n' '--- relevant tracked files only ---'
git ls-files | rg '(^|/)(pyproject\.toml|requirements[^/]*\.txt|Pipfile[^/]*|poetry\.lock|uv\.lock|.*constraints.*|.*requirements.*|.*lock.*|.*workflow.*\.ya?ml)$' | head -200
printf '%s\n' '--- exact control matches in tracked files ---'
git grep -n -E -- '--hash=|pip-audit|osv|cyclonedx|syft|cosign|sigstore|cryptography' -- \
'*.toml' '*.txt' '*.lock' '*.yaml' '*.yml' '*.json' '*.ini' '*.cfg' '*.conf' 2>/dev/null | head -300
printf '%s\n' '--- PyPI metadata for the declared version ---'
curl -fsSL https://pypi.org/pypi/cryptography/50.0.0/json \
| python3 -c 'import json,sys; d=json.load(sys.stdin); r=d.get("releases",{}).get("50.0.0"); print(json.dumps({"info_version":d.get("info",{}).get("version"),"release_count":None if r is None else len(r),"release_files":r},indent=2))'
printf '%s\n' '--- OSV metadata for the declared version ---'
curl -fsSL https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
--data '{"package":{"ecosystem":"PyPI","name":"cryptography"},"version":"50.0.0"}' \
| python3 -c 'import json,sys; d=json.load(sys.stdin); print(json.dumps({"vulnerability_ids":[v.get("id") for v in d.get("vulns",[])],"count":len(d.get("vulns",[]))},indent=2))'Repository: openshift-eng/art-tools
Length of output: 18405
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- project metadata and dependency groups ---'
sed -n '1,90p' pyproject.toml
printf '%s\n' '--- uv lock metadata and cryptography entry ---'
sed -n '1,35p' uv.lock
sed -n '810,880p' uv.lock
printf '%s\n' '--- build and CI use of uv.lock ---'
git grep -n -E 'uv\.lock|uv (sync|pip|lock)|--(locked|frozen)|pip(3)? (install|sync)|requirements\.txt' -- \
':!uv.lock' ':!*.json' ':!*.md' ':!*.py' ':!*.go' ':!*.js' ':!*.ts' ':!*.tsx' ':!*.yaml' ':!*.yml' \
2>/dev/null | head -300Repository: openshift-eng/art-tools
Length of output: 24867
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- production container dependency installation ---'
sed -n '70,105p' art-cluster/pipelines/data/project/art-cd/image/Containerfile.base
sed -n '1,25p' art-cluster/pipelines/data/project/art-cd/image/Containerfile.latest
printf '%s\n' '--- audit target and callers ---'
sed -n '35,70p' Makefile
git grep -n -E 'make( [^[:space:]]*)*audit|uv audit|audit --locked' -- \
'.github' 'Makefile' '*.yaml' '*.yml' 2>/dev/null | head -100Repository: openshift-eng/art-tools
Length of output: 3752
🌐 Web query:
uv documentation whether uv pip installreads or enforcesuv.lock, and how to install from a uv lockfile in production
💡 Result:
The uv pip install command does not read or enforce uv.lock [1][2]. The uv pip interface is designed as an alternative to pip and pip-tools and interacts with packages similarly to traditional pip, without awareness of the project-specific uv.lock file [1][2][3]. To install from a lockfile in production, you should use uv sync [4][5]. ### Installing from a Lockfile in Production For reproducible production environments—such as in CI/CD pipelines or Docker builds—the uv sync command is the standard and recommended approach [4][6][5]. * Standard Usage: Running uv sync will automatically lock (if necessary) and sync the environment to match the dependencies specified in uv.lock [4]. * Production/Docker Usage: To ensure strict adherence to the lockfile during build processes, use: uv sync --frozen --no-install-project [7][5] * --frozen: This flag forces uv to use the existing uv.lock file as-is without attempting to update or re-resolve dependencies [7][6]. It will cause the operation to fail if the lockfile is missing or out of sync with pyproject.toml [6]. * --no-install-project: This is often used in Docker builds to install only the dependencies into the environment without installing the current project itself, which is useful for optimizing layer caching [4][7][5]. By using uv sync --frozen, you guarantee that the exact versions specified in your uv.lock are installed, providing the reproducibility required for production deployments [6][5].
Citations:
- 1: Package installation does not respect lockfile; why? astral-sh/uv#15361
- 2: [bug] Stop using
uv pip install, because it does not honor uv.lock invoke-ai/launcher#131 - 3: https://docs.astral.sh/uv/getting-started/features/
- 4: https://docs.astral.sh/uv/concepts/projects/sync/
- 5: https://linuxize.com/post/how-to-install-and-use-uv/
- 6: https://pydevtools.com/handbook/how-to/how-to-use-a-uv-lockfile-for-reproducible-python-environments/
- 7: https://nickjanetakis.com/blog/switching-pip-to-uv-in-a-dockerized-flask-or-django-app
Security Misconfiguration (CWE-494): Download of Code Without Integrity Check
Reachability: External · Exploitability: Moderate
Install production dependencies from uv.lock.
uv.lock records hashes for cryptography==50.0.0, and CI runs uv audit --locked. The production container uses uv pip install -e ., which ignores uv.lock and resolves the open-ended requirements. Replace it with uv sync --frozen or an equivalent hashed installation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pyproject.toml` at line 40, Update the production container dependency
installation to use the locked dependencies from uv.lock, replacing the uv pip
install -e . flow with uv sync --frozen or an equivalent hashed installation so
CI’s uv audit --locked requirements are preserved.
Source: Path instructions
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- dependency and lock files ---'
git ls-files | grep -E '(^|/)(pyproject\.toml|poetry\.lock|uv\.lock|Pipfile(\.lock)?|requirements[^/]*\.txt|constraints[^/]*\.txt|pdm\.lock)$' || true
printf '%s\n' '--- pyproject context ---'
sed -n '1,100p' pyproject.toml
printf '%s\n' '--- dependency and install-control references ---'
rg -n -i 'cryptography|--require-hashes|hashes|poetry|uv sync|pip install|pip-compile|constraints|lock|sbom|cosign|sigstore|provenance' \
-g '*.yml' -g '*.yaml' -g '*.toml' -g '*.txt' -g '*.md' -g 'Dockerfile*' -g '*.sh' . || true
printf '%s\n' '--- parsed project metadata ---'
python3 - <<'PY'
import tomllib
from pathlib import Path
p = Path("pyproject.toml")
data = tomllib.loads(p.read_text())
project = data.get("project", {})
print("project.dependencies =", project.get("dependencies"))
print("build-system =", data.get("build-system"))
for section in ("tool.poetry", "tool.uv", "tool.pdm"):
cur = data
for part in section.split("."):
cur = cur.get(part, {}) if isinstance(cur, dict) else {}
print(section, "=", cur)
PYRepository: openshift-eng/art-tools
Length of output: 7524
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- dependency and lock files ---'
git ls-files | grep -E '(^|/)(pyproject\.toml|poetry\.lock|uv\.lock|Pipfile(\.lock)?|requirements[^/]*\.txt|constraints[^/]*\.txt|pdm\.lock)$' || true
printf '%s\n' '--- pyproject context ---'
sed -n '1,100p' pyproject.toml
printf '%s\n' '--- dependency and install-control references ---'
rg -n -i 'cryptography|--require-hashes|hashes|poetry|uv sync|pip install|pip-compile|constraints|lock|sbom|cosign|sigstore|provenance' \
-g '*.yml' -g '*.yaml' -g '*.toml' -g '*.txt' -g '*.md' -g 'Dockerfile*' -g '*.sh' . || true
printf '%s\n' '--- parsed project metadata ---'
python3 - <<'PY'
import tomllib
from pathlib import Path
data = tomllib.loads(Path("pyproject.toml").read_text())
print("project.dependencies =", data.get("project", {}).get("dependencies"))
print("build-system =", data.get("build-system"))
PYRepository: openshift-eng/art-tools
Length of output: 7524
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- cryptography entries in uv.lock ---'
rg -n -C 8 'name = "cryptography"|cryptography' uv.lock
printf '%s\n' '--- lock metadata and package source/hash fields ---'
sed -n '1,80p' uv.lock
python3 - <<'PY'
from pathlib import Path
text = Path("uv.lock").read_text().splitlines()
for i, line in enumerate(text):
if line.strip() == 'name = "cryptography"':
start = max(0, i - 3)
end = min(len(text), i + 35)
print("\n".join(f"{j+1}: {text[j]}" for j in range(start, end)))
PY
printf '%s\n' '--- tracked install entry points ---'
for f in install.sh doozer/Dockerfile doozer/container_install.sh ocp-build-data-validator/Dockerfile ocp-build-data-validator/deploy/Dockerfile.base; do
if git ls-files --error-unmatch "$f" >/dev/null 2>&1; then
echo "### $f"
sed -n '1,180p' "$f"
fi
done
printf '%s\n' '--- targeted diff summary ---'
git diff --stat -- pyproject.toml uv.lock
git diff --unified=3 -- pyproject.toml uv.lock || trueRepository: openshift-eng/art-tools
Length of output: 50379
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- cryptography entries in uv.lock ---'
rg -n -C 8 'name = "cryptography"|cryptography' uv.lock
printf '%s\n' '--- lock metadata and package source/hash fields ---'
sed -n '1,80p' uv.lock
python3 - <<'PY'
from pathlib import Path
text = Path("uv.lock").read_text().splitlines()
for i, line in enumerate(text):
if line.strip() == 'name = "cryptography"':
for j in range(max(0, i - 3), min(len(text), i + 35)):
print(f"{j+1}: {text[j]}")
PY
printf '%s\n' '--- tracked install entry points ---'
for f in install.sh doozer/Dockerfile doozer/container_install.sh ocp-build-data-validator/Dockerfile ocp-build-data-validator/deploy/Dockerfile.base; do
if git ls-files --error-unmatch "$f" >/dev/null 2>&1; then
echo "### $f"
sed -n '1,180p' "$f"
fi
done
printf '%s\n' '--- targeted diff summary ---'
git diff --stat -- pyproject.toml uv.lock
git diff --unified=3 -- pyproject.toml uv.lock || trueRepository: openshift-eng/art-tools
Length of output: 50379
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import re
from pathlib import Path
pyproject = Path("pyproject.toml").read_text()
lock = Path("uv.lock").read_text()
dep = re.search(r'^\s*"cryptography([^"]*)",\s*$', pyproject, re.M)
pkg = re.search(
r'\[\[package\]\]\s*name = "cryptography"\s*'
r'version = "([^"]+)"\s*'
r'.*?sdist = \{[^}]*hash = "([^"]+)"',
lock,
re.S,
)
assert dep, "cryptography is absent from pyproject.toml"
assert pkg, "cryptography is absent or lacks a locked source hash in uv.lock"
print("pyproject_specifier:", dep.group(1))
print("locked_version:", pkg.group(1))
print("locked_sdist_hash:", pkg.group(2))
print("specifier_is_exact:", bool(re.fullmatch(r"==\d+\.\d+\.\d+", dep.group(1))))
print("lock_version_satisfies_declared_lower_bound:",
tuple(map(int, pkg.group(1).split("."))) >=
tuple(map(int, re.search(r">=(\d+\.\d+\.\d+)", dep.group(1)).group(1).split("."))))
PY
printf '%s\n' '--- uv installation controls in tracked files ---'
rg -n -S 'uv (sync|lock)|--locked|--frozen|pip install \.' \
-g '*.yml' -g '*.yaml' -g '*.sh' -g 'Dockerfile*' -g '*.md' . || true
printf '%s\n' '--- lockfile tracking ---'
git ls-files --stage uv.lockRepository: openshift-eng/art-tools
Length of output: 787
Dependency Version Not Pinned (CWE-829): Inclusion of Functionality from Untrusted Control Sphere
Reachability: External · Exploitability: Difficult
Pin the production dependency to an exact version.
uv.lock currently resolves cryptography to 50.0.0 with hashes, but the project metadata still permits later versions. Use cryptography==50.0.0 and update uv.lock.
Suggested change
- "cryptography>=50.0.0",
+ "cryptography==50.0.0",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "cryptography>=50.0.0", | |
| "cryptography==50.0.0", |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pyproject.toml` at line 40, Update the cryptography dependency declaration in
pyproject.toml from a minimum version to the exact version 50.0.0, then
regenerate uv.lock so its metadata matches the pinned requirement.
Source: Path instructions
Bumps cryptography from 49.0.0 to 50.0.0.
Changelog
Sourced from cryptography's changelog.
... (truncated)
Commits
dcb7050Prepare for 50.0.0 release (#15372)53fccd9Don't leak how PKCS#7 encryptedKey decryption failed (#15369)d472f97Addfrom __future__ import annotationsto all src/ Python files (#15371)908773dBump downstream dependencies in CI (#15368)2cc07ccBump BoringSSL, OpenSSL, AWS-LC in CI (#15367)c94ede9chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)67a8308chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)95018ffRelease the GIL in one-shot AEAD encrypt/decrypt (#15361)6954733Release the GIL during DH and DSA parameter generation (#15364)6893b94Import _serialization instead of serialization in x509/extensions (#15363)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by CodeRabbit