[pull] master from aio-libs:master - #698
Merged
Merged
Conversation
Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p> <blockquote> <p>50.0.0 - 2026-07-31</p> <pre><code> * **SECURITY ISSUE**: :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der` and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in :rfc:`3218`. Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247** * Deprecated Diffie-Hellman key exchange over finite fields (FFDH). Everything FFDH is deprecated, including the types in ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or parameters with the key loading APIs. Users should migrate to a more modern key exchange algorithm. * Added ``xof()`` class methods to :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing algorithm instances configured for use with :class:`~cryptography.hazmat.primitives.hashes.XOFHash`. * The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now considered stable and are subject to our API stability policy. * Added the :doc:`/cobblestone` recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP chunked-encryption specification <https://c2sp.org/chunked-encryption>`_ for streaming authenticated encryption of large messages. * Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT, instead of silently ignoring them. * Added support for using :class:`~cryptography.x509.Name` as a field type in the :doc:`/hazmat/asn1/index` module. * Loading a public key or an EC private key now rejects DER where the ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero number of unused bits, instead of silently ignoring it. * Parsing a CRL entry's ``InvalidityDate`` extension now rejects a ``GeneralizedTime`` that carries fractional seconds or another non-DER form, matching the strict encoding already required for every other X.509 time field. * :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request or response whose ``version`` field is not ``v1``, the only version defined by RFC 6960, matching the version validation already performed when loading certificates, CSRs and CRLs. * :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported when building against AWS-LC. * HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when building against AWS-LC. * Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported when building against AWS-LC. </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pyca/cryptography/commit/dcb7050b807b00392fa9fe2eac7cb362fcf355cc"><code>dcb7050</code></a> Prepare for 50.0.0 release (<a href="https://redirect.github.com/pyca/cryptography/issues/15372">#15372</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f"><code>53fccd9</code></a> Don't leak how PKCS#7 encryptedKey decryption failed (<a href="https://redirect.github.com/pyca/cryptography/issues/15369">#15369</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/d472f978470fbefa521b86d98b2ecccbbb4d1dd8"><code>d472f97</code></a> Add <code>from __future__ import annotations</code> to all src/ Python files (<a href="https://redirect.github.com/pyca/cryptography/issues/15371">#15371</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/908773d53829fb1466c6db364b31321c3cd8eb9a"><code>908773d</code></a> Bump downstream dependencies in CI (<a href="https://redirect.github.com/pyca/cryptography/issues/15368">#15368</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/2cc07cc948948211899bcb0cddd1fddf86e95812"><code>2cc07cc</code></a> Bump BoringSSL, OpenSSL, AWS-LC in CI (<a href="https://redirect.github.com/pyca/cryptography/issues/15367">#15367</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/c94ede9f040fa44942f7139772603419000acf66"><code>c94ede9</code></a> chore(deps): bump ruff from 0.16.0 to 0.16.1 (<a href="https://redirect.github.com/pyca/cryptography/issues/15366">#15366</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/67a8308dc9ea4cce6056e0f1438f903c208c3f35"><code>67a8308</code></a> chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (<a href="https://redirect.github.com/pyca/cryptography/issues/15365">#15365</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/95018ffcdbbc510fd92fc872e3a3e80aa6e58596"><code>95018ff</code></a> Release the GIL in one-shot AEAD encrypt/decrypt (<a href="https://redirect.github.com/pyca/cryptography/issues/15361">#15361</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/6954733eaf55a0074abf88f06f7242dfca3a5d02"><code>6954733</code></a> Release the GIL during DH and DSA parameter generation (<a href="https://redirect.github.com/pyca/cryptography/issues/15364">#15364</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/6893b94c33e948f6240082461424cfb5da2dacc6"><code>6893b94</code></a> Import _serialization instead of serialization in x509/extensions (<a href="https://redirect.github.com/pyca/cryptography/issues/15363">#15363</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pyca/cryptography/compare/49.0.0...50.0.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [aiofastnet](https://github.com/tarasko/aiofastnet) from 0.22.0 to 1.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tarasko/aiofastnet/releases">aiofastnet's releases</a>.</em></p> <blockquote> <h2>1.0.1</h2> <ul> <li>Small performance tweaks</li> </ul> <h2>1.0.0</h2> <p>First non-beta release. Loop's transport/protocol layer API is complete. Only subprocess's transports do not exist, but they are not performance critical anyway.</p> <ul> <li>Added connect_read_pipe, connect_write_pipe</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tarasko/aiofastnet/blob/master/HISTORY.rst">aiofastnet's changelog</a>.</em></p> <blockquote> <h2>1.0.1</h2> <ul> <li>Small performance tweaks</li> </ul> <h2>1.0.0</h2> <p>First non-beta release. Loop's transport/protocol layer API is pretty much complete. Only subprocess transports do not exist, but they are not performance critical.</p> <ul> <li>Added connect_read_pipe, connect_write_pipe</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tarasko/aiofastnet/commit/fbec5dbb1c186feb79259d0373ced2feb4aa3403"><code>fbec5db</code></a> Small performance tweaks</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/df4d46016557297bf5751a7c2d8c47d46da710ef"><code>df4d460</code></a> Add history notes</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/ce6037b5f970a4443f7a21ddc5b441366c9d7bef"><code>ce6037b</code></a> Performance tweaks</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/9e56de4c25c5e7f1dca88676f6f273f96f491efa"><code>9e56de4</code></a> Cleanups</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/76ceb0fd305b3e5c8ec2cc44dc988cb17564e36c"><code>76ceb0f</code></a> Prepare 1.0.0 release</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/65bed6dd5c25b61b19839e7821e332b3265e42bc"><code>65bed6d</code></a> Added pipe API and transports</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/f98e7c21005476195b3f84746d355ba6ee3a13d6"><code>f98e7c2</code></a> Refactor</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/11544523d82a1798785723c031e8a05a5f63a589"><code>1154452</code></a> Improve coverage</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/a466fc5d7f7a4518571b5fde8597bbefcd2a6363"><code>a466fc5</code></a> Improve coverage</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/08dcb1210b8ee7e1e5b15a052a696b36d8126e76"><code>08dcb12</code></a> Improve coverage</li> <li>Additional commits viewable in <a href="https://github.com/tarasko/aiofastnet/compare/v0.22.0...v1.0.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [python-discovery](https://github.com/tox-dev/python-discovery) from 1.5.0 to 1.5.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/python-discovery/releases">python-discovery's releases</a>.</em></p> <blockquote> <h2>v1.5.1</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🐛 fix(uv): match uv's interpreter store lookup by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/111">tox-dev/python-discovery#111</a></li> <li>🐛 fix(uv): pick store installs by directory name by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/112">tox-dev/python-discovery#112</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/python-discovery/compare/1.5.0...1.5.1">https://github.com/tox-dev/python-discovery/compare/1.5.0...1.5.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst">python-discovery's changelog</a>.</em></p> <blockquote> <h1>Bug fixes - 1.5.1</h1> <ul> <li>Locate uv's interpreter store the way uv does, using XDG on macOS (<code>~/.local/share/uv/python</code>) and roaming <code>%APPDATA%\uv\python</code> on Windows, neither of which <code>platformdirs</code> reported. The uv variables now come from the <code>env</code> mapping rather than <code>os.environ</code> - by :user:<code>gaborbernat</code>. (:issue:<code>109</code>)</li> <li>Pick uv-managed interpreters by install directory name instead of globbing the store. A bare <code>3.8</code> now means CPython, the way uv resolves it, rather than whichever implementation the filesystem happened to list first, and probing runs newest version first - by :user:<code>gaborbernat</code>. (:issue:<code>110</code>)</li> </ul> <h1>Packaging updates and notes for downstreams - 1.5.1</h1> <ul> <li>Drop the <code>platformdirs</code> runtime dependency; locating uv's store was the only thing it did - by :user:<code>gaborbernat</code>. (:issue:<code>109</code>)</li> </ul> <hr /> <p>v1.5.0 (2026-07-21)</p> <hr /> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/python-discovery/commit/73a83697ba27a33f132a1598e2777d80c5b9238e"><code>73a8369</code></a> release 1.5.1</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/f2bd71321c2699af9f14493b5d5e8156761ffc49"><code>f2bd713</code></a> 🐛 fix(uv): pick store installs by directory name (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/112">#112</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/b94b232560a8296e828c920253f6796066e1b139"><code>b94b232</code></a> 🐛 fix(uv): match uv's interpreter store lookup (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/111">#111</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/97db92fe41cfd41f4e5bfaa837a4a1071de89b63"><code>97db92f</code></a> build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/108">#108</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/dae1a0b33655c03d5185340528008af4c7ffa24b"><code>dae1a0b</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/107">#107</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/45d10b6ab4e269e0fe32f95a71e4ed8630dfb0e9"><code>45d10b6</code></a> build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/106">#106</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/35f701ed0090f6c514ba9119f90d0fe745b3f4de"><code>35f701e</code></a> build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/105">#105</a>)</li> <li>See full diff in <a href="https://github.com/tox-dev/python-discovery/compare/1.5.0...1.5.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )