chore(deps): bump cryptography 48.0.1 -> 50.0.0 (Dependabot alert #61) - #83
Open
pofallon wants to merge 1 commit into
Open
chore(deps): bump cryptography 48.0.1 -> 50.0.0 (Dependabot alert #61)#83pofallon wants to merge 1 commit into
pofallon wants to merge 1 commit into
Conversation
Addresses Dependabot alert #61: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing. Transitive via pyjwt[crypto] <- mcp[crypto] <- claude-agent-sdk; no direct use of the affected PKCS#7 surface, but the lock pin is what the alert tracks. Dependabot had not proposed this itself — the 7-day supply-chain cooldown in .github/dependabot.yml holds newly published versions. Lockfile-only change; `uv lock --upgrade-package cryptography` touches no other package. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UBTr6Q6kTGUMQiwwBHcdMj
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes Dependabot alert #61 (high): cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing. Vulnerable range
>= 44.0.0, < 50.0.0; first patched50.0.0.Why this isn't a Dependabot PR
Dependabot hadn't proposed it — the 7-day supply-chain
cooldownin.github/dependabot.ymlholds newly published versions before proposing them. Filed manually since the alert is a high.Scope
Lockfile-only.
uv lock --upgrade-package cryptographyresolves 80 packages and touches exactly one:No
pyproject.tomlchange —cryptographyis transitive:cryptography <- pyjwt[crypto] <- mcp[crypto] <- claude-agent-sdk.Exposure
Low in practice. The advisory covers PKCS#7
EnvelopedDatadecryption; the only path intocryptographyhere ispyjwt[crypto]for JWT signing/verification, which doesn't touch that surface. Bumping to clear the alert and keep the lock pin current.Verification
make ci(lint + format-check + typecheck + test) green locally: 1024 passed, 40 skipped.🤖 Generated with Claude Code
https://claude.ai/code/session_01UBTr6Q6kTGUMQiwwBHcdMj