build(deps): bump cryptography from 49.0.0 to 50.0.0 - #774
build(deps): bump cryptography from 49.0.0 to 50.0.0#774dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@49.0.0...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthrough
Changescryptography 의존성 업데이트
Estimated code review effort: 1 (매우 간단) | ~5분 Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Closing as superseded by #743. That reviewed integration already carries |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head bounded evidence and requested changes before merge. Findings1. P1 requirements-strix-ci.txt:4 - Strix Security Scan fails at Install Strix after the cryptography 50.0.0 bump
SummaryPR #774 bumps cryptography 49.0.0 -> 50.0.0 in requirements-strix-ci.txt (line 4) and requirements-strix-ci-hashes.txt (new lines 402-462). Active failed GitHub Check Strix Security Scan/strix (run 30981901684, job 92227922394, step 17 'Install Strix', annotation .github:313-313) exited 1 after 'pip install --require-hashes -r requirements-strix-ci-hashes.txt' printed 'Pinned Strix installation did not produce a trusted absolute executable path.', 'Refusing a Strix executable from a workspace or runner-temp path.', 'Pinned Strix installation did not produce a trusted absolute scripts root.', 'Pinned Strix executable is outside the trusted scripts root.', 'Process completed with exit code 1.'; no superseding same-head success is listed, so the security scan does not run on head dd3415e and approval is blocked until the install is diagnosed and green. Approval sufficiency: insufficient, active failed check. Verification posture: failed-check log plus Focused changed hunks; reproduction required. Linter/static: no lint contract changed by requirements files. TDD/regression: no tests changed; regression direction is the failing workflow step (pip install --require-hashes + command -v strix) and a re-run of .github/workflows/strix.yml. Coverage: PASS, not applicable (no supported changed source files or package manifests), per Coverage execution evidence. Docstring coverage: not applicable, same evidence. DAG: Mermaid flowchart of head flow requirements-strix-ci.txt -> requirements-strix-ci-hashes.txt -> Install Strix step -> trusted-path guard -> check FAILURE; reflects head flow. PoC/execution: none beyond the trusted failed-check log; no execution receipts supplied. DDD/domain: not applicable, requirements-only change. CDD/context: not applicable. Similar issues: none evidenced. Claim/concept check: PR claims only a dependency bump; the major-version (49->50, 2026-07-31, SECURITY ISSUE changelog) install behavior is unverified on head. Standards search: hash set must match the official cryptography 50.0.0 distribution; regenerate with the pinned resolver. Compatibility/convention: naming n/a (no new identifiers); pin+hash-file convention preserved. Breaking-change/backcompat: major bump must be validated against strix-agent==1.0.4 and dependents google-auth/pyjwt/pyopenssl; check failure blocks. Implementation completeness: n/a. Performance: n/a. Developer experience: CI surface is the Install Strix trusted-path guard failing. User experience: n/a non-web; CI workflow/log surface. Visual/DOM: non-web interaction surface = workflow logs and check annotations reviewed. Accessibility/i18n: n/a non-web. Supply-chain/license: cryptography 50.0.0 new major with security fix; hash-set completeness must be verified. Packaging: requirements pin/hash install fails on head. Security/privacy: the failing install guard means the Strix security scan did not run on this head. Changed files inspected as evidence: requirements-strix-ci.txt and requirements-strix-ci-hashes.txt (Focused changed hunks and failed-check log). Adversarial validation{"status":"failed","probes":[{"path":"requirements-strix-ci.txt","line":4,"hypothesis":"Bumping cryptography to 50.0.0 breaks the pinned Strix CI install on the current head.","attack_or_counterexample":"Re-running the failing workflow step's own sequence on head dd3415e36df7dbcc9604d3d667948a1827f9284a: python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-strix-ci-hashes.txt followed by the trusted-executable-path checks (command -v strix, absolute, non-symlink, outside $GITHUB_WORKSPACE/$RUNNER_TEMP).","evidence":"Failed GitHub Check evidence (run 30981901684, job 92227922394, step 17 'Install Strix', annotation .github:313-313): step exited 1 after installing the changed requirements and printed '::error::Pinned Strix installation did not produce a trusted absolute executable path.', '::error::Refusing a Strix executable from a workspace or runner-temp path.', '::error::Pinned Strix installation did not produce a trusted absolute scripts root.', '::error::Pinned Strix executable is outside the trusted scripts root.', '##[error]Process completed with exit code 1.'; source-line-sha256=cf042e5bbae9cdc8854c27a0cf2f22a0020c2b2f338be6a1ccd1800f1ade4193 at requirements-strix-ci.txt:4","outcome":"confirmed"},{"path":"requirements-strix-ci-hashes.txt","line":404,"hypothesis":"The new cryptography==50.0.0 hash block does not yield a working pinned strix install on the CI runner.","attack_or_counterexample":"The failing step installs exactly the changed file: python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-strix-ci-hashes.txt (cryptography==50.0.0 block at lines 402-462), then the trusted-path guard rejects the result.","evidence":"Failed GitHub Check evidence: the same Install Strix step consumed the changed hashes file and exited 1 with all four trusted-path guard errors printed, so the pinned install did not produce the expected strix console script at a trusted absolute path on head dd3415e36df7dbcc9604d3d667948a1827f9284a; source-line-sha256=8a6c384c2c7b84cdd563bbdee7129a2d2c70b09e4f82d20cbcd9f8a15df87f95 at requirements-strix-ci-hashes.txt:404","outcome":"confirmed"}],"residual_risk":"The exact pip-level cause (missing platform wheel hash vs. cryptography 50.0.0 console-script/install regression) is not visible in the truncated log and must be reproduced; until the Install Strix step is green, the Strix security scan does not run on this head, and strix-agent==1.0.4 runtime compatibility with cryptography 50.0.0 remains unverified."}
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and requested changes before merge.
Findings
1. P1 requirements-strix-ci.txt:4 - Strix Security Scan fails at Install Strix after the cryptography 50.0.0 bump
- Problem: Active GitHub Check Strix Security Scan/strix failed on head dd3415e at step 17 'Install Strix' (run 30981901684, job 92227922394, annotation .github:313-313). The step ran 'python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-strix-ci-hashes.txt' (the file this PR changes) and could not validate the strix executable, printing 'Pinned Strix installation did not produce a trusted absolute executable path.', 'Refusing a Strix executable from a workspace or runner-temp path.', 'Pinned Strix installation did not produce a trusted absolute scripts root.', 'Pinned Strix executable is outside the trusted scripts root.' and exiting with code 1; the security scan therefore did not run on this head.
- Root cause: This PR is the only head change touching the requirements consumed by the failing step: the cryptography==50.0.0 pin (line 4) and its new hash block in requirements-strix-ci-hashes.txt. A major-version bump (49 -> 50, released 2026-07-31 with a SECURITY ISSUE changelog entry) can change wheel selection or console-script installation behavior such that the pinned install does not produce a trusted strix entry point; the truncated log does not expose the pip-level message, so the exact cause must be reproduced.
- Fix: Reproduce the failing install on head content: python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-strix-ci-hashes.txt and confirm 'command -v strix' yields an absolute, non-symlink path outside $GITHUB_WORKSPACE/$RUNNER_TEMP. If the 50.0.0 hash set is incomplete for the runner platform (Python 3.13 per .github/workflows/strix.yml), regenerate requirements-strix-ci-hashes.txt with the pinned resolver so all platform wheel hashes are present; confirm strix-agent==1.0.4 and dependents (google-auth, pyjwt, pyopenssl) accept cryptography 50. Re-run the Strix Security Scan workflow on this head and require green. Interim remediation: revert the pin to cryptography==49.0.0 until the 50.0.0 install is verified.
- Regression test: python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-strix-ci-hashes.txt && test -x "$(command -v strix)" plus python3 -m pip check (mirrors the failing workflow step), then a re-run of .github/workflows/strix.yml on head dd3415e.
- Suggested diff: posted in this finding's inline review thread.
Summary
PR #774 bumps cryptography 49.0.0 -> 50.0.0 in requirements-strix-ci.txt (line 4) and requirements-strix-ci-hashes.txt (new lines 402-462). Active failed GitHub Check Strix Security Scan/strix (run 30981901684, job 92227922394, step 17 'Install Strix', annotation .github:313-313) exited 1 after 'pip install --require-hashes -r requirements-strix-ci-hashes.txt' printed 'Pinned Strix installation did not produce a trusted absolute executable path.', 'Refusing a Strix executable from a workspace or runner-temp path.', 'Pinned Strix installation did not produce a trusted absolute scripts root.', 'Pinned Strix executable is outside the trusted scripts root.', 'Process completed with exit code 1.'; no superseding same-head success is listed, so the security scan does not run on head dd3415e and approval is blocked until the install is diagnosed and green. Approval sufficiency: insufficient, active failed check. Verification posture: failed-check log plus Focused changed hunks; reproduction required. Linter/static: no lint contract changed by requirements files. TDD/regression: no tests changed; regression direction is the failing workflow step (pip install --require-hashes + command -v strix) and a re-run of .github/workflows/strix.yml. Coverage: PASS, not applicable (no supported changed source files or package manifests), per Coverage execution evidence. Docstring coverage: not applicable, same evidence. DAG: Mermaid flowchart of head flow requirements-strix-ci.txt -> requirements-strix-ci-hashes.txt -> Install Strix step -> trusted-path guard -> check FAILURE; reflects head flow. PoC/execution: none beyond the trusted failed-check log; no execution receipts supplied. DDD/domain: not applicable, requirements-only change. CDD/context: not applicable. Similar issues: none evidenced. Claim/concept check: PR claims only a dependency bump; the major-version (49->50, 2026-07-31, SECURITY ISSUE changelog) install behavior is unverified on head. Standards search: hash set must match the official cryptography 50.0.0 distribution; regenerate with the pinned resolver. Compatibility/convention: naming n/a (no new identifiers); pin+hash-file convention preserved. Breaking-change/backcompat: major bump must be validated against strix-agent==1.0.4 and dependents google-auth/pyjwt/pyopenssl; check failure blocks. Implementation completeness: n/a. Performance: n/a. Developer experience: CI surface is the Install Strix trusted-path guard failing. User experience: n/a non-web; CI workflow/log surface. Visual/DOM: non-web interaction surface = workflow logs and check annotations reviewed. Accessibility/i18n: n/a non-web. Supply-chain/license: cryptography 50.0.0 new major with security fix; hash-set completeness must be verified. Packaging: requirements pin/hash install fails on head. Security/privacy: the failing install guard means the Strix security scan did not run on this head. Changed files inspected as evidence: requirements-strix-ci.txt and requirements-strix-ci-hashes.txt (Focused changed hunks and failed-check log).
Adversarial validation
{"status":"failed","probes":[{"path":"requirements-strix-ci.txt","line":4,"hypothesis":"Bumping cryptography to 50.0.0 breaks the pinned Strix CI install on the current head.","attack_or_counterexample":"Re-running the failing workflow step's own sequence on head dd3415e36df7dbcc9604d3d667948a1827f9284a: python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-strix-ci-hashes.txt followed by the trusted-executable-path checks (command -v strix, absolute, non-symlink, outside $GITHUB_WORKSPACE/$RUNNER_TEMP).","evidence":"Failed GitHub Check evidence (run 30981901684, job 92227922394, step 17 'Install Strix', annotation .github:313-313): step exited 1 after installing the changed requirements and printed '::error::Pinned Strix installation did not produce a trusted absolute executable path.', '::error::Refusing a Strix executable from a workspace or runner-temp path.', '::error::Pinned Strix installation did not produce a trusted absolute scripts root.', '::error::Pinned Strix executable is outside the trusted scripts root.', '##[error]Process completed with exit code 1.'; source-line-sha256=cf042e5bbae9cdc8854c27a0cf2f22a0020c2b2f338be6a1ccd1800f1ade4193 at requirements-strix-ci.txt:4","outcome":"confirmed"},{"path":"requirements-strix-ci-hashes.txt","line":404,"hypothesis":"The new cryptography==50.0.0 hash block does not yield a working pinned strix install on the CI runner.","attack_or_counterexample":"The failing step installs exactly the changed file: python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-strix-ci-hashes.txt (cryptography==50.0.0 block at lines 402-462), then the trusted-path guard rejects the result.","evidence":"Failed GitHub Check evidence: the same Install Strix step consumed the changed hashes file and exited 1 with all four trusted-path guard errors printed, so the pinned install did not produce the expected strix console script at a trusted absolute path on head dd3415e36df7dbcc9604d3d667948a1827f9284a; source-line-sha256=8a6c384c2c7b84cdd563bbdee7129a2d2c70b09e4f82d20cbcd9f8a15df87f95 at requirements-strix-ci-hashes.txt:404","outcome":"confirmed"}],"residual_risk":"The exact pip-level cause (missing platform wheel hash vs. cryptography 50.0.0 console-script/install regression) is not visible in the truncated log and must be reproduced; until the Install Strix step is green, the Strix security scan does not run on this head, and strix-agent==1.0.4 runtime compatibility with cryptography 50.0.0 remains unverified."}-
Result: REQUEST_CHANGES
-
Reason: Active Strix Security Scan check fails at Install Strix on this head after the cryptography 50.0.0 bump; the pinned install of the changed requirements does not produce the trusted strix executable.
-
Head SHA:
dd3415e36df7dbcc9604d3d667948a1827f9284a -
Workflow run: 30981954027
-
Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
| google-cloud-aiplatform==1.133.0 | ||
| protobuf<7.0.0 | ||
| cryptography==49.0.0 | ||
| cryptography==50.0.0 |
There was a problem hiding this comment.
P1 Strix Security Scan fails at Install Strix after the cryptography 50.0.0 bump
- Location:
requirements-strix-ci.txt:4 - Problem: Active GitHub Check Strix Security Scan/strix failed on head dd3415e at step 17 'Install Strix' (run 30981901684, job 92227922394, annotation .github:313-313). The step ran 'python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-strix-ci-hashes.txt' (the file this PR changes) and could not validate the strix executable, printing 'Pinned Strix installation did not produce a trusted absolute executable path.', 'Refusing a Strix executable from a workspace or runner-temp path.', 'Pinned Strix installation did not produce a trusted absolute scripts root.', 'Pinned Strix executable is outside the trusted scripts root.' and exiting with code 1; the security scan therefore did not run on this head.
- Root cause: This PR is the only head change touching the requirements consumed by the failing step: the cryptography==50.0.0 pin (line 4) and its new hash block in requirements-strix-ci-hashes.txt. A major-version bump (49 -> 50, released 2026-07-31 with a SECURITY ISSUE changelog entry) can change wheel selection or console-script installation behavior such that the pinned install does not produce a trusted strix entry point; the truncated log does not expose the pip-level message, so the exact cause must be reproduced.
- Fix: Reproduce the failing install on head content: python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-strix-ci-hashes.txt and confirm 'command -v strix' yields an absolute, non-symlink path outside $GITHUB_WORKSPACE/$RUNNER_TEMP. If the 50.0.0 hash set is incomplete for the runner platform (Python 3.13 per .github/workflows/strix.yml), regenerate requirements-strix-ci-hashes.txt with the pinned resolver so all platform wheel hashes are present; confirm strix-agent==1.0.4 and dependents (google-auth, pyjwt, pyopenssl) accept cryptography 50. Re-run the Strix Security Scan workflow on this head and require green. Interim remediation: revert the pin to cryptography==49.0.0 until the 50.0.0 install is verified.
- Regression test: python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-strix-ci-hashes.txt && test -x "$(command -v strix)" plus python3 -m pip check (mirrors the failing workflow step), then a re-run of .github/workflows/strix.yml on head dd3415e.
Suggested diff
-cryptography==50.0.0
+cryptography==49.0.01 participant
Bumps cryptography from 49.0.0 to 50.0.0.
Changelog
Sourced from cryptography's changelog.
... (truncated)
Commits
dcb7050Prepare for 50.0.0 release (#15372)53fccd9Don't leak how PKCS#7 encryptedKey decryption failed (#15369)d472f97Addfrom __future__ import annotationsto all src/ Python files (#15371)908773dBump downstream dependencies in CI (#15368)2cc07ccBump BoringSSL, OpenSSL, AWS-LC in CI (#15367)c94ede9chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)67a8308chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)95018ffRelease the GIL in one-shot AEAD encrypt/decrypt (#15361)6954733Release the GIL during DH and DSA parameter generation (#15364)6893b94Import _serialization instead of serialization in x509/extensions (#15363)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by CodeRabbit