You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@caldera.apache.org by rc...@apache.org on 2026/08/26 22:51:34 UTC
(caldera) branch deps/security-bumps created (now 8965438d)
This is an automated email from the ASF dual-hosted git repository.
HackedRico pushed a change to branch deps/security-bumps
in repository https://gitbox.apache.org/repos/asf/caldera.git
at 8965438d build(deps): bump aiohttp, cryptography, and asyncssh for security advisories
This branch includes the following new commits:
new 8965438d build(deps): bump aiohttp, cryptography, and asyncssh for security advisories
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(caldera) 01/01: build(deps): bump aiohttp, cryptography, and asyncssh for security advisories
Posted by rc...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
HackedRico pushed a commit to branch deps/security-bumps
in repository https://gitbox.apache.org/repos/asf/caldera.git
commit 8965438db5b0d8c25c935b8a37d9714b9e4ab29c
Author: HackedRico <ch...@gmail.com>
AuthorDate: Wed Aug 26 18:51:14 2026 -0400
build(deps): bump aiohttp, cryptography, and asyncssh for security advisories
Bumps three dependencies flagged by pip-audit in the safety tox env:
- aiohttp 3.14.1 -> 3.14.3 (PYSEC-2026-3545/3546/3547)
- cryptography 48.0.1 -> 50.0.1 (PYSEC-2026-3552/3553/3554)
- asyncssh 2.20.0 -> 2.23.1 (CVE-2026-54591)
Supersedes #3405 (aiohttp) and #3406 (cryptography). The asyncssh
advisory has no Dependabot PR yet and safety fails on master without
it, so all three are bumped together; neither open PR passes CI alone.
All three require Python >= 3.10, leaving the test matrix unaffected.
---
requirements.txt | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/requirements.txt b/requirements.txt
index 3bc6c616..fb410279 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,12 +1,12 @@
aiohttp-jinja2==1.5.1
-aiohttp==3.14.1
+aiohttp==3.14.3
aiohttp_session==2.12.0
aiohttp-security==0.4.0
aiohttp-apispec==3.0.0b2
argon2-cffi==25.1.0
jinja2==3.1.6
pyyaml==6.0.1
-cryptography==48.0.1
+cryptography==50.0.1
websockets==15.0
Sphinx==7.1.2
sphinx_rtd_theme==1.3.0
@@ -22,7 +22,7 @@ lxml==6.1.0 # debrief
svglib==1.5.1 # debrief
Markdown==3.8.1 # training
dnspython==2.6.1
-asyncssh==2.20.0
+asyncssh==2.23.1
aioftp==0.27.2
packaging==23.2
croniter~=3.0.3