You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/11 12:11:47 UTC
[I] Update `cryptography` in asfpy due to CVE-2026-26007 (tooling-trusted-releases)
sbp opened a new issue, #644:
URL: https://github.com/apache/tooling-trusted-releases/issues/644
The alert is https://github.com/apache/tooling-trusted-releases/security/dependabot/12
Waiting on upstream at https://github.com/apache/infrastructure-asfpy/pull/35
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Update `cryptography` in asfpy due to CVE-2026-26007 (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #644:
URL: https://github.com/apache/tooling-trusted-releases/issues/644#issuecomment-3891169059
Upstream accepted our patch. Just waiting on a new release, or authorisation for us to make a new release, now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Update `cryptography` in asfpy due to CVE-2026-26007 (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #644:
URL: https://github.com/apache/tooling-trusted-releases/issues/644#issuecomment-3884291526
We need to remove https://github.com/apache/tooling-trusted-releases/blob/6de01e2c58d329d5121f4470458c4e291e60d2fe/.pre-commit-config.yaml#L108-L110 when this issue is closed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Update `cryptography` in asfpy due to CVE-2026-26007 (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #644:
URL: https://github.com/apache/tooling-trusted-releases/issues/644#issuecomment-3893172123
The patch was accepted as https://github.com/apache/infrastructure-asfpy/commit/8bfb3811e9c96f03063fe0c20a1946281ee6f9b6 and I was authorised to make a 0.57 release from it. I did so, but there was a dependency resolution problem. We decided to migrate it to uv anyway, so I contributed https://github.com/apache/infrastructure-asfpy/pull/36 which was reviewed and I merged as https://github.com/apache/infrastructure-asfpy/commit/1f275032aeacaabf8505028ed813eab22ca81947. I released this as 0.58.
We have this transitively in our dependencies because we depend on asfquart, and asfquart depends on asfpy. Therefore to this this problem we'd also need to modify asfquart too, but for now I've created an asfquart branch and, because we depend directly on asfquart and use a branch of it on GitHub, I was able to just change the branch that we depend on. Assuming that our use of the asfquart branch works, we should merge the version bump into asfquart main. I'll keep this issue open to remind us to do that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Update `cryptography` in asfpy due to CVE-2026-26007 (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #644:
URL: https://github.com/apache/tooling-trusted-releases/issues/644#issuecomment-3952150105
ASFQuart uses `asfpy>=0.56,<1` so it automatically got fixed when I made a new release of `asfpy`. We updated `pyproject.toml` to use `asfquart@main` in 7281bdce756e84d7fd1ac80d3304d3939b9c098b.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Update `cryptography` in asfpy due to CVE-2026-26007 (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #644: Update `cryptography` in asfpy due to CVE-2026-26007
URL: https://github.com/apache/tooling-trusted-releases/issues/644
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org