Skip to content

Bump cryptography from 46.0.5 to 46.0.6 - #3261

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/cryptography-46.0.6
Closed

Bump cryptography from 46.0.5 to 46.0.6#3261
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/cryptography-46.0.6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 29, 2026

Copy link
Copy Markdown
Contributor

Bumps cryptography from 46.0.5 to 46.0.6.

Changelog

Sourced from cryptography's changelog.

46.0.6 - 2026-03-25


* **SECURITY ISSUE**: Fixed a bug where name constraints were not applied
  to peer names during verification when the leaf certificate contains a
  wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug,
  including those used by the Web PKI. Credit to **Oleh Konko (1seal)** for
  reporting the issue. **CVE-2026-34073**

.. _v46-0-5:

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Mar 29, 2026
@deruyter92
deruyter92 self-requested a review March 30, 2026 16:21
@C-Achard

Copy link
Copy Markdown
Collaborator

@dependabot rebase

Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.5 to 46.0.6.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@46.0.5...46.0.6)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/cryptography-46.0.6 branch from dcb46fa to a1955ce Compare March 30, 2026 18:14

@JiwaniZakir JiwaniZakir left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a patch-level bump of cryptography in uv.lock (46.0.5 → 46.0.6), which typically indicates a security or bug-fix release. It's worth checking the cryptography changelog to confirm what CVE or fix is addressed, since cryptography patch releases are frequently security-motivated — the PR description doesn't mention the motivation. The lock file change looks mechanically correct (sdist hash and all wheel hashes are updated consistently across platforms), but pyproject.toml or any other manifest that pins cryptography directly should be verified to ensure the constraint allows 46.0.6 (i.e., isn't pinned to an exact version like ==46.0.5). If this bump was triggered by a vulnerability, that context should be captured in the PR body for audit trail purposes.

@dependabot @github

dependabot Bot commented on behalf of github Apr 8, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #3277.

@dependabot dependabot Bot closed this Apr 8, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/cryptography-46.0.6 branch April 8, 2026 21:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants