You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/13 07:02:51 UTC
[PR] chore(deps): bump cryptography from 46.0.7 to 48.0.0 [superset]
dependabot[bot] opened a new pull request, #41010:
URL: https://github.com/apache/superset/pull/41010
Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.7 to 48.0.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p>
<blockquote>
<p>48.0.0 - 2026-05-04</p>
<pre><code>
* **BACKWARDS INCOMPATIBLE:** Support for Python 3.8 has been removed.
``cryptography`` now requires Python 3.9 or later.
* **BACKWARDS INCOMPATIBLE:** Loading an X.509 CRL whose inner
``TBSCertList.signature`` algorithm does not match the outer
``signatureAlgorithm`` now raises ``ValueError``. Previously, such CRLs
were parsed successfully and only rejected during signature validation.
* Added support for :doc:`/hazmat/primitives/asymmetric/mlkem` and
:doc:`/hazmat/primitives/asymmetric/mldsa` when using OpenSSL 3.5.0 or
later, in addition to the existing AWS-LC and BoringSSL support. This means
post-quantum algorithms are now available to users of our wheels.
<ul>
<li><strong>Note:</strong> Going forward, we do not guarantee that all functionality<br />
in <code>cryptography</code> will be available when building against<br />
OpenSSL. See :doc:<code>/statements/state-of-openssl</code> for more information.</li>
</ul>
<p>.. _v47-0-0:</p>
<p>47.0.0 - 2026-04-24<br />
</code></pre></p>
<ul>
<li>Support for Python 3.8 is deprecated and will be removed in the next
<code>cryptography</code> release.</li>
<li><strong>BACKWARDS INCOMPATIBLE:</strong> Support for binary elliptic curves
(<code>SECT*</code> classes) has been removed. These curves are rarely used and
have additional security considerations that make them undesirable.</li>
<li><strong>BACKWARDS INCOMPATIBLE:</strong> Support for OpenSSL 1.1.x has been removed.
OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC
continue to be supported.</li>
<li><strong>BACKWARDS INCOMPATIBLE:</strong> Dropped support for LibreSSL < 4.1.</li>
<li><strong>BACKWARDS INCOMPATIBLE:</strong> Loading keys with unsupported algorithms or
keys with unsupported explicit curve encodings now raises
:class:<code>~cryptography.exceptions.UnsupportedAlgorithm</code> instead of
<code>ValueError</code>. This change affects
:func:<code>~cryptography.hazmat.primitives.serialization.load_pem_private_key</code>,
:func:<code>~cryptography.hazmat.primitives.serialization.load_der_private_key</code>,
:func:<code>~cryptography.hazmat.primitives.serialization.load_pem_public_key</code>,
:func:<code>~cryptography.hazmat.primitives.serialization.load_der_public_key</code>,
and :meth:<code>~cryptography.x509.Certificate.public_key</code> when called on
certificates with unsupported public key algorithms.</li>
<li><strong>BACKWARDS INCOMPATIBLE:</strong> When parsing elliptic curve private keys, we now
reject keys that incorrectly encode a private key of the wrong length because
such keys are impossible to process in a constant-time manner. We do not
believe keys with this problem are in wide use, however we may revert this
change based on the feedback we receive.</li>
<li>Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys to
:class:<code>~cryptography.hazmat.decrepit.ciphers.algorithms.TripleDES</code>. In a</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pyca/cryptography/commit/8e03e30e3aae01632a697e903e3593c924f0139d"><code>8e03e30</code></a> bump for 48.0.0 release (<a href="https://redirect.github.com/pyca/cryptography/issues/14796">#14796</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/295e0d254ef31ab864730aa41312ec355416ee71"><code>295e0d2</code></a> Add AGENTS.md with CLAUDE.md symlink (<a href="https://redirect.github.com/pyca/cryptography/issues/14794">#14794</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/104a2de19e268a433e6da92be9cb872dcf0003c8"><code>104a2de</code></a> Bump BoringSSL, OpenSSL, AWS-LC in CI (<a href="https://redirect.github.com/pyca/cryptography/issues/14793">#14793</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/67ec1e51988195e17993d2edef5258b27509b926"><code>67ec1e5</code></a> call check_length early on AesSiv::encrypt (<a href="https://redirect.github.com/pyca/cryptography/issues/14792">#14792</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/b2da57a0d9e4bfd2b95364299091a18f74127b26"><code>b2da57a</code></a> changelog for mldsa/mlkem for openssl (<a href="https://redirect.github.com/pyca/cryptography/issues/14791">#14791</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/3cf44adee25c368d4a136e072fa9f80465d91eb0"><code>3cf44ad</code></a> ML-KEM OpenSSL support (<a href="https://redirect.github.com/pyca/cryptography/issues/14781">#14781</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/2e31639666766f846fbab2c605879db0fa64fe83"><code>2e31639</code></a> ML-DSA OpenSSL support (<a href="https://redirect.github.com/pyca/cryptography/issues/14773">#14773</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/5affe5a286a986fdf512c4a5cb280d28a96c10e3"><code>5affe5a</code></a> fix rust nightly clippy (<a href="https://redirect.github.com/pyca/cryptography/issues/14790">#14790</a>)</li>
<li><a href="https://github.com/pyca/cryptography/commit/2e73ca448eaf64b6f0d4ffbb794cf96170cef5ec"><code>2e73ca4</code></a> bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (<a href="https://redirect.github.com/pyca/cryptography/issues/1">#1</a>...</li>
<li><a href="https://github.com/pyca/cryptography/commit/82ebd3b9f49d49ad5fd8b4b1f1dd02487b6e1466"><code>82ebd3b</code></a> Bump BoringSSL, OpenSSL, AWS-LC in CI (<a href="https://redirect.github.com/pyca/cryptography/issues/14785">#14785</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/pyca/cryptography/compare/46.0.7...48.0.0">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(deps): bump cryptography from 46.0.7 to 48.0.0 [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #41010:
URL: https://github.com/apache/superset/pull/41010#issuecomment-4697813432
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(deps): bump cryptography from 46.0.7 to 48.0.0 [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #41010:
URL: https://github.com/apache/superset/pull/41010#issuecomment-4723245154
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/41010?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 54.85%. Comparing base ([`1f95a6c`](https://app.codecov.io/gh/apache/superset/commit/1f95a6c48652d002a33224f896a20a4c1705c84c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`b5c8d07`](https://app.codecov.io/gh/apache/superset/commit/b5c8d07b82210d0793cca767ae59c82b678adfb4?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 1 commits behind head on master.
> :exclamation: There is a different number of reports uploaded between BASE (1f95a6c) and HEAD (b5c8d07). Click for more details.
>
> <details><summary>HEAD has 42 uploads less than BASE</summary>
>
>| Flag | BASE (1f95a6c) | HEAD (b5c8d07) |
>|------|------|------|
>|python|38|1|
>|hive|6|1|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #41010 +/- ##
==========================================
- Coverage 64.31% 54.85% -9.46%
==========================================
Files 2652 2652
Lines 144799 144799
Branches 33415 33415
==========================================
- Hits 93122 79429 -13693
- Misses 50016 64973 +14957
+ Partials 1661 397 -1264
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/41010/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [hive](https://app.codecov.io/gh/apache/superset/pull/41010/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `39.33% <ø> (ø)` | |
| [mysql](https://app.codecov.io/gh/apache/superset/pull/41010/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [postgres](https://app.codecov.io/gh/apache/superset/pull/41010/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [presto](https://app.codecov.io/gh/apache/superset/pull/41010/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [python](https://app.codecov.io/gh/apache/superset/pull/41010/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `39.33% <ø> (-20.23%)` | :arrow_down: |
| [sqlite](https://app.codecov.io/gh/apache/superset/pull/41010/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unit](https://app.codecov.io/gh/apache/superset/pull/41010/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/superset/pull/41010?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(deps): bump cryptography from 46.0.7 to 48.0.0 [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #41010:
URL: https://github.com/apache/superset/pull/41010#issuecomment-4723633224
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(deps): bump cryptography from 46.0.7 to 48.0.1 [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #41010:
URL: https://github.com/apache/superset/pull/41010#issuecomment-4734759642
Did some digging here, since `cryptography` majors have bitten us before. Worth noting this jumps 46 → 48 and skips 47 entirely, so *both* releases' breaking changes are in play. Walking through what we actually touch:
- **Fernet** (encrypted DB passwords, SSH tunnel creds, OAuth tokens) is untouched across 47/48, so the historically scary part is fine.
- `parse_ssl_cert` in `superset/utils/core.py` catches `ValueError` from `load_pem_x509_certificate`, and that still raises `ValueError` on bad input. The 47.0 exception-type change only affects `Certificate.public_key()` and CRL loading, neither of which we call there, so the handler stays correct.
- Snowflake keypair auth (`load_pem_private_key` in `db_engine_specs/snowflake.py`) can now raise `UnsupportedAlgorithm` instead of `ValueError` for unsupported-algorithm keys. But we don't wrap that call in a `ValueError` handler (only the `json.loads` above it), so it propagates the same either way, and genuinely malformed keys still raise `ValueError`. `test_snowflake` exercises the keypair path (incl. a bad-key case) and it's green.
- The OpenSSL 1.1 drop and Python 3.8 removal don't affect us: manylinux wheels bundle their own OpenSSL, our images are Debian (OpenSSL 3), and our floor is already py3.9. CI's build + test jobs pass, which backs that up.
- SECT* binary curves / LibreSSL / TripleDES changes: not used anywhere I can find.
So core-wise I think this is safe. The one thing I'd sanity-check before merging is **third-party DB connector extras that pin `cryptography` narrowly** (the usual historical pain). Base resolves clean and co-bumps `pyopenssl` to 26.2.0, but extras resolve at the user's install, not here. If someone's confirmed the common ones (`snowflake-connector-python`, `databricks-sql-connector`) accept 48.x, I'm comfortable.
No new tests strictly required given the existing coverage on these paths, though an explicit "parses-but-unsupported-algorithm" key case would be the only way to actually lock in the new `UnsupportedAlgorithm` behavior if we want belt-and-suspenders.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(deps): bump cryptography from 46.0.7 to 48.0.1 [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas merged PR #41010:
URL: https://github.com/apache/superset/pull/41010
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org