chore(deps): bump cryptography from 48.0.1 to 49.0.0 #81

Closed

dependabot[bot] wants to merge 1 commit from dependabot/pip/cryptography-49.0.0 into main

dependabot[bot] commented

2026-06-26 09:25:08 +00:00

(Migrated from github.com)

Bumps cryptography from 48.0.1 to 49.0.0.

Changelog

Sourced from cryptography's changelog.

49.0.0 - 2026-06-12


* **BACKWARDS INCOMPATIBLE:** Support for ``x86_64`` macOS has been removed.
  We now only publish ``arm64`` wheels for macOS.
* **BACKWARDS INCOMPATIBLE:** Support for 32-bit Windows has been removed.
  Users should move to a 64-bit Python installation.
* **BACKWARDS INCOMPATIBLE:** Removed the deprecated
  ``PUBLIC_KEY_TYPES``, ``PRIVATE_KEY_TYPES``,
  ``CERTIFICATE_PRIVATE_KEY_TYPES``, ``CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES``,
  and ``CERTIFICATE_PUBLIC_KEY_TYPES`` type aliases. Use
  ``PublicKeyTypes``, ``PrivateKeyTypes``, ``CertificateIssuerPrivateKeyTypes``,
  ``CertificateIssuerPublicKeyTypes``, and ``CertificatePublicKeyTypes``
  instead. These were deprecated in version 40.0.
* **BACKWARDS INCOMPATIBLE:** :class:`~cryptography.hazmat.primitives.ciphers.algorithms.ChaCha20`
  now treats the first 4 bytes of the ``nonce`` as a 32-bit little-endian block
  counter (as defined in :rfc:`7539`) and tracks the number of bytes processed.
  Attempting to encrypt or decrypt more data than the counter allows before it
  would overflow now raises a :class:`ValueError` rather than silently diverging
  from RFC 7539. Setting the counter portion of the ``nonce`` to zero allows
  encrypting up to 256 GiB with a given nonce.
* **BACKWARDS INCOMPATIBLE:** Loading an X.509 certificate whose ECDSA or DSA
  signature ``AlgorithmIdentifier`` contains encoded NULL parameters now raises
  a :class:`ValueError`. Such certificates are invalid, but older versions of
  Java emitted them; previously they loaded with a deprecation warning.
* Fixed cross-compilation of the CFFI bindings when ``PYO3_CROSS_LIB_DIR``
  is set. The build now derives the Python include directory from
  ``PYO3_CROSS_LIB_DIR`` instead of querying the host interpreter, which
  previously caused the build to fail during cross-compilations for embedded
  systems, on hosts which have same-version Python development headers
  installed as the target Python.
* Added support for signing and verifying X.509 certificates, certificate
  signing requests, and certificate revocation lists with
  :doc:`/hazmat/primitives/asymmetric/mldsa` keys, as well as loading
  certificates that contain ML-DSA public keys.
* Added :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length` to
  :class:`~cryptography.hazmat.primitives.hpke.KEM` so callers can split the
  encapsulated key from the ciphertext returned by
  :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
* :meth:`~cryptography.x509.verification.ExtensionPolicy.require_present`,
  :meth:`~cryptography.x509.verification.ExtensionPolicy.may_be_present`, and
  :meth:`~cryptography.x509.verification.ExtensionPolicy.require_not_present`
  now accept any extension type. Previously only a fixed set of extension
  types was supported, which made it impossible to account for otherwise
  unrecognized critical extensions during path validation.
* Added support for using :class:`~cryptography.x509.Certificate`,
  :class:`~cryptography.x509.CertificateSigningRequest`, and
  :class:`~cryptography.x509.CertificateRevocationList` as field types in
  :doc:`/hazmat/asn1/index` structures.
* Added :func:`~cryptography.hazmat.asn1.value_set`, a class decorator that
</tr></table>

... (truncated)

Commits

e300bbe bump version and changelog for 49.0.0 (#15030)
fa74cd8 Add external mu (message representative) support for ML-DSA (#14979)
f594db3 chore(deps): bump openssl from 0.10.80 to 0.10.81 (#15029)
608e011 chore(deps): bump openssl-sys from 0.9.116 to 0.9.117 (#15028)
a322bc4 chore(deps): bump cc from 1.2.63 to 1.2.64 (#15027)
33181a7 Reject critical nameConstraints extensions containing directoryName constrain...
6080dc7 Bump dependencies that dependabot isn't (#15026)
121faa3 chore(deps): bump virtualenv from 21.4.2 to 21.4.3 (#15023)
829520b Add more robust processing for DH parameters. (#15016)
0f05001 Bump downstream dependencies in CI (#15025)
Additional commits viewable in compare view

Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.1 to 49.0.0. <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>. <blockquote> 49.0.0 - 2026-06-12 <pre><code> * **BACKWARDS INCOMPATIBLE:** Support for ``x86_64`` macOS has been removed. We now only publish ``arm64`` wheels for macOS. * **BACKWARDS INCOMPATIBLE:** Support for 32-bit Windows has been removed. Users should move to a 64-bit Python installation. * **BACKWARDS INCOMPATIBLE:** Removed the deprecated ``PUBLIC_KEY_TYPES``, ``PRIVATE_KEY_TYPES``, ``CERTIFICATE_PRIVATE_KEY_TYPES``, ``CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES``, and ``CERTIFICATE_PUBLIC_KEY_TYPES`` type aliases. Use ``PublicKeyTypes``, ``PrivateKeyTypes``, ``CertificateIssuerPrivateKeyTypes``, ``CertificateIssuerPublicKeyTypes``, and ``CertificatePublicKeyTypes`` instead. These were deprecated in version 40.0. * **BACKWARDS INCOMPATIBLE:** :class:`~cryptography.hazmat.primitives.ciphers.algorithms.ChaCha20` now treats the first 4 bytes of the ``nonce`` as a 32-bit little-endian block counter (as defined in :rfc:`7539`) and tracks the number of bytes processed. Attempting to encrypt or decrypt more data than the counter allows before it would overflow now raises a :class:`ValueError` rather than silently diverging from RFC 7539. Setting the counter portion of the ``nonce`` to zero allows encrypting up to 256 GiB with a given nonce. * **BACKWARDS INCOMPATIBLE:** Loading an X.509 certificate whose ECDSA or DSA signature ``AlgorithmIdentifier`` contains encoded NULL parameters now raises a :class:`ValueError`. Such certificates are invalid, but older versions of Java emitted them; previously they loaded with a deprecation warning. * Fixed cross-compilation of the CFFI bindings when ``PYO3_CROSS_LIB_DIR`` is set. The build now derives the Python include directory from ``PYO3_CROSS_LIB_DIR`` instead of querying the host interpreter, which previously caused the build to fail during cross-compilations for embedded systems, on hosts which have same-version Python development headers installed as the target Python. * Added support for signing and verifying X.509 certificates, certificate signing requests, and certificate revocation lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys, as well as loading certificates that contain ML-DSA public keys. * Added :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length` to :class:`~cryptography.hazmat.primitives.hpke.KEM` so callers can split the encapsulated key from the ciphertext returned by :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`. * :meth:`~cryptography.x509.verification.ExtensionPolicy.require_present`, :meth:`~cryptography.x509.verification.ExtensionPolicy.may_be_present`, and :meth:`~cryptography.x509.verification.ExtensionPolicy.require_not_present` now accept any extension type. Previously only a fixed set of extension types was supported, which made it impossible to account for otherwise unrecognized critical extensions during path validation. * Added support for using :class:`~cryptography.x509.Certificate`, :class:`~cryptography.x509.CertificateSigningRequest`, and :class:`~cryptography.x509.CertificateRevocationList` as field types in :doc:`/hazmat/asn1/index` structures. * Added :func:`~cryptography.hazmat.asn1.value_set`, a class decorator that </tr></table> </code></pre> </blockquote> ... (truncated) </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pyca/cryptography/commit/e300bbe2f1bec75e5ee7e0ab7b196958831b3db6"><code>e300bbe</code></a> bump version and changelog for 49.0.0 (<a href="https://redirect.github.com/pyca/cryptography/issues/15030">#15030</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/fa74cd8031b263edb50307f6d5a9a70df9f0a541"><code>fa74cd8</code></a> Add external mu (message representative) support for ML-DSA (<a href="https://redirect.github.com/pyca/cryptography/issues/14979">#14979</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/f594db3f315e621473c58721961f502ba2a286ec"><code>f594db3</code></a> chore(deps): bump openssl from 0.10.80 to 0.10.81 (<a href="https://redirect.github.com/pyca/cryptography/issues/15029">#15029</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/608e0119532153336310e51747724c6b9d107df7"><code>608e011</code></a> chore(deps): bump openssl-sys from 0.9.116 to 0.9.117 (<a href="https://redirect.github.com/pyca/cryptography/issues/15028">#15028</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/a322bc4fb2bd2fd6f345fdb155cac226b1770dad"><code>a322bc4</code></a> chore(deps): bump cc from 1.2.63 to 1.2.64 (<a href="https://redirect.github.com/pyca/cryptography/issues/15027">#15027</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/33181a74d41aa859b05f3720700a31c8e5b9e54c"><code>33181a7</code></a> Reject critical nameConstraints extensions containing directoryName constrain...</li> <li><a href="https://github.com/pyca/cryptography/commit/6080dc7f08e7473544b07df95833ff2ee843266e"><code>6080dc7</code></a> Bump dependencies that dependabot isn't (<a href="https://redirect.github.com/pyca/cryptography/issues/15026">#15026</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/121faa33a717559a8b0f0180b2d4e7785234af79"><code>121faa3</code></a> chore(deps): bump virtualenv from 21.4.2 to 21.4.3 (<a href="https://redirect.github.com/pyca/cryptography/issues/15023">#15023</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/829520baa909eff95d64e5ebd165544d6fd60172"><code>829520b</code></a> Add more robust processing for DH parameters. (<a href="https://redirect.github.com/pyca/cryptography/issues/15016">#15016</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/0f0500141cec535846f36c4c68d02b03126386b5"><code>0f05001</code></a> Bump downstream dependencies in CI (<a href="https://redirect.github.com/pyca/cryptography/issues/15025">#15025</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pyca/cryptography/compare/48.0.1...49.0.0">compare view</a></li> </ul> </details>

amoussa1229 commented

2026-06-26 16:20:41 +00:00

(Migrated from github.com)

Closing: cryptography is now an orphaned dependency. It existed only to back RS256 JWT signing in agent_team/github_app.py, and the agent-team subsystem was removed in #82. Nothing in the repo imports it anymore, so bumping 48→49 (a major release) adds no value. Tracking removal of all agent-team-only deps (cryptography, PyJWT, fastapi, uvicorn) in a separate issue.

Closing: `cryptography` is now an orphaned dependency. It existed only to back RS256 JWT signing in `agent_team/github_app.py`, and the agent-team subsystem was removed in #82. Nothing in the repo imports it anymore, so bumping 48→49 (a major release) adds no value. Tracking removal of all agent-team-only deps (cryptography, PyJWT, fastapi, uvicorn) in a separate issue.

amoussa1229 commented

2026-06-26 16:20:43 +00:00

(Migrated from github.com)

@dependabot close

dependabot[bot] commented

2026-06-26 16:20:45 +00:00

(Migrated from github.com)

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting `@dependabot ignore this major version` or `@dependabot ignore this minor version`. You can also ignore all major, minor, or patch releases for a dependency by adding an [`ignore` condition](https://docs.github.com/en/code-security/supply-chain-security/configuration-options-for-dependency-updates#ignore) with the desired `update_types` to your config file. If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

This repo is archived. You cannot comment on pull requests.

No reviewers