Skip to content

Bump cryptography from 46.0.5 to 46.0.7 in /nemo_retriever#1827

Merged
jdye64 merged 1 commit intomainfrom
dependabot/uv/nemo_retriever/cryptography-46.0.7
Apr 15, 2026
Merged

Bump cryptography from 46.0.5 to 46.0.7 in /nemo_retriever#1827
jdye64 merged 1 commit intomainfrom
dependabot/uv/nemo_retriever/cryptography-46.0.7

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 8, 2026

Bumps cryptography from 46.0.5 to 46.0.7.

Changelog

Sourced from cryptography's changelog.

46.0.7 - 2026-04-07


* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
  passed to APIs that accept Python buffers, which could lead to buffer
  overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.

.. _v46-0-6:

46.0.6 - 2026-03-25

  • SECURITY ISSUE: Fixed a bug where name constraints were not applied to peer names during verification when the leaf certificate contains a wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug, including those used by the Web PKI. Credit to Oleh Konko (1seal) for reporting the issue. CVE-2026-34073

.. _v46-0-5:

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Apr 8, 2026
@dependabot dependabot Bot requested a review from a team as a code owner April 8, 2026 22:28
@dependabot dependabot Bot added the python:uv Pull requests that update python:uv code label Apr 8, 2026
@dependabot dependabot Bot requested a review from a team as a code owner April 8, 2026 22:28
@dependabot dependabot Bot requested a review from edknv April 8, 2026 22:28
@copy-pr-bot
Copy link
Copy Markdown

copy-pr-bot Bot commented Apr 8, 2026

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.5 to 46.0.7.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@46.0.5...46.0.7)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/uv/nemo_retriever/cryptography-46.0.7 branch from 78a5319 to 4366110 Compare April 13, 2026 14:23
@jdye64 jdye64 merged commit 4b30c55 into main Apr 15, 2026
6 checks passed
@dependabot dependabot Bot deleted the dependabot/uv/nemo_retriever/cryptography-46.0.7 branch April 15, 2026 18:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant