Skip to content

build(deps): Bump cryptography from 46.0.7 to 48.0.1 in /framework#7417

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/framework/cryptography-48.0.1
Open

build(deps): Bump cryptography from 46.0.7 to 48.0.1 in /framework#7417
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/framework/cryptography-48.0.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps cryptography from 46.0.7 to 48.0.1.

Changelog

Sourced from cryptography's changelog.

48.0.1 - 2026-06-09


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.

.. _v48-0-0:


48.0.0 - 2026-05-04

  • BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been removed. cryptography now requires Python 3.9 or later.

  • BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner TBSCertList.signature algorithm does not match the outer signatureAlgorithm now raises ValueError. Previously, such CRLs were parsed successfully and only rejected during signature validation.

  • Added support for :doc:/hazmat/primitives/asymmetric/mlkem and :doc:/hazmat/primitives/asymmetric/mldsa when using OpenSSL 3.5.0 or later, in addition to the existing AWS-LC and BoringSSL support. This means post-quantum algorithms are now available to users of our wheels.

    • Note: Going forward, we do not guarantee that all functionality in cryptography will be available when building against OpenSSL. See :doc:/statements/state-of-openssl for more information.

.. _v47-0-0:

47.0.0 - 2026-04-24


* Support for Python 3.8 is deprecated and will be removed in the next
  ``cryptography`` release.
* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves
  (``SECT*`` classes) has been removed. These curves are rarely used and
  have additional security considerations that make them undesirable.
* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.
  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC
  continue to be supported.
* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 4.1.
* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or
  keys with unsupported explicit curve encodings now raises
  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of
  ``ValueError``. This change affects
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,
  and :meth:`~cryptography.x509.Certificate.public_key` when called on
  certificates with unsupported public key algorithms.
</tr></table>

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jun 18, 2026
Copilot AI review requested due to automatic review settings June 18, 2026 07:38
Copilot AI reviewed Jun 18, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@dependabot dependabot Bot mentioned this pull request Jun 18, 2026
Closed
@github-actions github-actions Bot added the Bot Created by bot (automation). label Jun 18, 2026
@dependabot dependabot Bot force-pushed the dependabot/uv/framework/cryptography-48.0.1 branch from 2b21a51 to 483a32b Compare June 20, 2026 19:04
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Jun 20, 2026

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

@dependabot dependabot Bot force-pushed the dependabot/uv/framework/cryptography-48.0.1 branch 4 times, most recently from 5136ec6 to 5d99b9b Compare June 26, 2026 09:56
@dependabot
build(deps): Bump cryptography from 46.0.7 to 48.0.1 in /framework
340b1d7 
Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.7 to 48.0.1.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@46.0.7...48.0.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 48.0.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/uv/framework/cryptography-48.0.1 branch from 5d99b9b to 340b1d7 Compare June 28, 2026 21:27
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Jun 28, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 340b1d7a4e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread framework/pyproject.toml
"grpcio-health-checking>=1.70.0,<2.0.0",
"protobuf>=5.28.0,<7.0.0",
"cryptography>=46.0.7,<47.0.0",
"cryptography>=46.0.7,<49.0.0",

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Require cryptography 48.0.1 in the published dependency range

This line still advertises cryptography>=46.0.7 in the wheel/sdist metadata; uv.lock is not consulted when users install flwr from PyPI or into an environment with an existing constrained resolver. In those installs the resolver can keep 46.0.7, so the PR does not actually roll consumers forward to 48.0.1 despite the lock update. If the bump is needed for the dependency update, raise the lower bound to >=48.0.1 and regenerate the lock metadata.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@tanertopal tanertopal Awaiting requested review from tanertopal tanertopal is a code owner
@danieljanes danieljanes Awaiting requested review from danieljanes danieljanes is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

Bot Created by bot (automation). dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant