Skip to content

Update cryptography requirement from ~=38.0.1 to ~=38.0.3

Guillaume Everarts de Velp requested to merge dependabot/pip/cryptography-approx-eq-38.0.3 into master

Created by: dependabot[bot]

Updates the requirements on cryptography to permit the latest version.

Changelog

Sourced from cryptography's changelog.

38.0.3 - 2022-11-01


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.0.7,
  which resolves *CVE-2022-3602* and *CVE-2022-3786*.
.. _v38-0-2:
38.0.2 - 2022-10-11 (YANKED)

.. attention::

This release was subsequently yanked from PyPI due to a regression in OpenSSL.
  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.0.6.

.. _v38-0-1:

38.0.1 - 2022-09-07


* Fixed parsing TLVs in ASN.1 with length greater than 65535 bytes (typically
  seen in large CRLs).
.. _v38-0-0:
38.0.0 - 2022-09-06
  • Final deprecation of OpenSSL 1.1.0. The next release of cryptography will drop support.
  • We no longer ship manylinux2010 wheels. Users should upgrade to the latest pip to ensure this doesn't cause issues downloading wheels on their platform. We now ship manylinux_2_28 wheels for users on new enough platforms.
  • Updated the minimum supported Rust version (MSRV) to 1.48.0, from 1.41.0. Users with the latest pip will typically get a wheel and not need Rust installed, but check :doc:/installation for documentation on installing a newer rustc if required.
  • :meth:~cryptography.fernet.Fernet.decrypt and related methods now accept both str and bytes tokens.
  • Parsing CertificateSigningRequest restores the behavior of enforcing that the Extension critical field must be correctly encoded DER. See the issue <https://github.com/pyca/cryptography/issues/6368>_ for complete details.
  • Added two new OpenSSL functions to the bindings to support an upcoming pyOpenSSL release.
  • When parsing :class:~cryptography.x509.CertificateRevocationList and

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Merge request reports