chore(deps): bump the pip group across 5 directories with 4 updates by dependabot[bot] · Pull Request #183 · oib/AITBC

dependabot · 2026-09-05T08:26:31Z

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the pip group with 3 updates in the /apps/ai-engine/examples directory: pydantic-settings, cryptography and pyasn1.
Bumps the pip group with 2 updates in the /apps/api-gateway directory: cryptography and starlette.
Bumps the pip group with 1 update in the /packages/py/aitbc-crypto directory: cryptography.
Bumps the pip group with 1 update in the /requirements-optional directory: cryptography.
Bumps the pip group with 1 update in the /scripts/monitoring/examples/monitoring-service directory: pydantic-settings.

Updates pydantic-settings from 2.14.0 to 2.14.2

Release notes

Sourced from pydantic-settings's releases.

v2.14.2

What's Changed

This is a security patch release.

Prevent NestedSecretsSettingsSource from following symlinks outside secrets_dir by @hramezani in pydantic/pydantic-settings#889

Prepare release 2.14.2 by @hramezani in pydantic/pydantic-settings#890

Security

Fixes GHSA-4xgf-cpjx-pc3j: NestedSecretsSettingsSource with secrets_nested_subdir=True could follow a symbolic link inside secrets_dir pointing outside it, reading out-of-tree files into settings values and bypassing the secrets_dir_max_size cap. Affected versions: >= 2.12.0, < 2.14.2.

Full Changelog: pydantic/pydantic-settings@v2.14.1...v2.14.2

v2.14.1

What's Changed

Bump the python-packages group with 4 updates by @dependabot[bot] in pydantic/pydantic-settings#850

Bump the python-packages group with 5 updates by @dependabot[bot] in pydantic/pydantic-settings#854

Bump the github-actions group with 3 updates by @dependabot[bot] in pydantic/pydantic-settings#853

Bump the python-packages group with 2 updates by @dependabot[bot] in pydantic/pydantic-settings#856

Fix field named cls conflicting with classmethod parameter by @hramezani in pydantic/pydantic-settings#858

Prepare release 2.14.1 by @hramezani in pydantic/pydantic-settings#859

Full Changelog: pydantic/pydantic-settings@v2.14.0...v2.14.1

Commits

d703bd7 Prepare release 2.14.2 (#890)
e95c30b Prepare release 2.14.1 (#859)
0c87345 Fix field named cls conflicting with classmethod parameter (#858)
7bd0072 Bump the python-packages group with 2 updates (#856)
b03e573 Bump the github-actions group with 3 updates (#853)
eaa3b43 Bump the python-packages group with 5 updates (#854)
9f95615 Bump the python-packages group with 4 updates (#850)
See full diff in compare view

Updates cryptography from 47.0.0 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

dcb7050 Prepare for 50.0.0 release (#15372)
53fccd9 Don't leak how PKCS#7 encryptedKey decryption failed (#15369)
d472f97 Add from __future__ import annotations to all src/ Python files (#15371)
908773d Bump downstream dependencies in CI (#15368)
2cc07cc Bump BoringSSL, OpenSSL, AWS-LC in CI (#15367)
c94ede9 chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)
67a8308 chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)
95018ff Release the GIL in one-shot AEAD encrypt/decrypt (#15361)
6954733 Release the GIL during DH and DSA parameter generation (#15364)
6893b94 Import _serialization instead of serialization in x509/extensions (#15363)
Additional commits viewable in compare view

Updates pyasn1 from 0.6.3 to 0.6.4

Release notes

Sourced from pyasn1's releases.

Release 0.6.4

This is a security release.

CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.

CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.

CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.

Pinned PyPI publish GitHub Action to an immutable commit.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.4, released 08-07-2026

CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU. Arcs are now accumulated in linear time; decoded values are unchanged (thanks for reporting, tynus2)

CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits), matching the OID arc limit introduced in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag (thanks for reporting, mikeappsec) IDs due to the integer-to-string conversion limit (Python 3.11+)

CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.float() for values with large base-10 exponents. Conversion no longer materializes huge intermediate integers; values too large to represent as a Python float raise OverflowError promptly, and prettyPrint() renders them as '' as before. Also fixed base-10 mantissa normalization to use exact integer arithmetic; mantissas larger than 2**53 could previously lose precision through float division (thanks for reporting, gvozdila)

Pinned PyPI publish GitHub Action to an immutable commit [pr #113](pyasn1/pyasn1#113)

Commits

72e4803 Prepare release 0.6.4
0c19eeb Pin PyPI publish action to immutable commit (#113)
45bdb19 Merge commit from fork
628e36e Merge commit from fork
e60c691 Merge commit from fork
See full diff in compare view

Updates cryptography from 47.0.0 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

dcb7050 Prepare for 50.0.0 release (#15372)
53fccd9 Don't leak how PKCS#7 encryptedKey decryption failed (#15369)
d472f97 Add from __future__ import annotations to all src/ Python files (#15371)
908773d Bump downstream dependencies in CI (#15368)
2cc07cc Bump BoringSSL, OpenSSL, AWS-LC in CI (#15367)
c94ede9 chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)
67a8308 chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)
95018ff Release the GIL in one-shot AEAD encrypt/decrypt (#15361)
6954733 Release the GIL during DH and DSA parameter generation (#15364)
6893b94 Import _serialization instead of serialization in x509/extensions (#15363)
Additional commits viewable in compare view

Updates cryptography from 47.0.0 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

dcb7050 Prepare for 50.0.0 release (#15372)
53fccd9 Don't leak how PKCS#7 encryptedKey decryption failed (#15369)
d472f97 Add from __future__ import annotations to all src/ Python files (#15371)
908773d Bump downstream dependencies in CI (#15368)
2cc07cc Bump BoringSSL, OpenSSL, AWS-LC in CI (#15367)
c94ede9 chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)
67a8308 chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)
95018ff Release the GIL in one-shot AEAD encrypt/decrypt (#15361)
6954733 Release the GIL during DH and DSA parameter generation (#15364)
6893b94 Import _serialization instead of serialization in x509/extensions (#15363)
Additional commits viewable in compare view

Updates cryptography from 47.0.0 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

dcb7050 Prepare for 50.0.0 release (#15372)
53fccd9 Don't leak how PKCS#7 encryptedKey decryption failed (#15369)
d472f97 Add from __future__ import annotations to all src/ Python files (#15371)
908773d Bump downstream dependencies in CI (#15368)
2cc07cc Bump BoringSSL, OpenSSL, AWS-LC in CI (#15367)
c94ede9 chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)
67a8308 chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)
95018ff Release the GIL in one-shot AEAD encrypt/decrypt (#15361)
6954733 Release the GIL during DH and DSA parameter generation (#15364)
6893b94 Import _serialization instead of serialization in x509/extensions (#15363)
Additional commits viewable in compare view

Updates pydantic-settings from 2.14.0 to 2.14.2

Release notes

Sourced from pydantic-settings's releases.

v2.14.2

What's Changed

This is a security patch release.

Prevent NestedSecretsSettingsSource from following symlinks outside secrets_dir by @hramezani in pydantic/pydantic-settings#889

Prepare release 2.14.2 by @hramezani in pydantic/pydantic-settings#890

Security

Fixes GHSA-4xgf-cpjx-pc3j: NestedSecretsSettingsSource with secrets_nested_subdir=True could follow a symbolic link inside secrets_dir pointing outside it, reading out-of-tree files into settings values and bypassing the secrets_dir_max_size cap. Affected versions: >= 2.12.0, < 2.14.2.

Full Changelog: pydantic/pydantic-settings@v2.14.1...v2.14.2

v2.14.1

What's Changed

Bump the python-packages group with 4 updates by @dependabot[bot] in pydantic/pydantic-settings#850

Bump the python-packages group with 5 updates by @dependabot[bot] in pydantic/pydantic-settings#854

Bump the github-actions group with 3 updates by @dependabot[bot] in pydantic/pydantic-settings#853

Bump the python-packages group with 2 updates by @dependabot[bot] in pydantic/pydantic-settings#856

Fix field named cls conflicting with classmethod parameter by @hramezani in pydantic/pydantic-settings#858

Prepare release 2.14.1 by @hramezani in pydantic/pydantic-settings#859

Full Changelog: pydantic/pydantic-settings@v2.14.0...v2.14.1

Commits

d703bd7 Prepare release 2.14.2 (#890)
e95c30b Prepare release 2.14.1 (#859)
0c87345 Fix field named cls conflicting with classmethod parameter (#858)
7bd0072 Bump the python-packages group with 2 updates (#856)
b03e573 Bump the github-actions group with 3 updates (#853)
eaa3b43 Bump the python-packages group with 5 updates (#854)
9f95615 Bump the python-packages group with 4 updates (#850)
See full diff in compare view

Updates cryptography from 47.0.0 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

dcb7050 Prepare for 50.0.0 release (#15372)
53fccd9 Don't leak how PKCS#7 encryptedKey decryption failed (#15369)
d472f97 Add from __future__ import annotations to all src/ Python files (#15371)
908773d Bump downstream dependencies in CI (#15368)
2cc07cc Bump BoringSSL, OpenSSL, AWS-LC in CI (#15367)
c94ede9 chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)
67a8308 chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)
95018ff Release the GIL in one-shot AEAD encrypt/decrypt (#15361)
6954733 Release the GIL during DH and DSA parameter generation (#15364)
6893b94 Import _serialization instead of serialization in x509/extensions (#15363)
Additional commits viewable in compare view

Updates starlette from 1.0.0 to 1.3.1

Release notes

Sourced from starlette's releases.

Version 1.3.1

What's Changed

Use StarletteDeprecationWarning instead of DeprecationWarning by @Kludex in Kludex/starlette#3119

Enforce max_fields and max_part_size in FormParser by @Kludex in Kludex/starlette#3329

Enforce FormParser limits in parser callbacks by @Kludex in Kludex/starlette#3331

Full Changelog: Kludex/starlette@1.3.0...1.3.1

Version 1.3.0

What's Changed

Clamp oversized suffix ranges in FileResponse by @jiyujie2006 in Kludex/starlette#3307

Catch OSError alongside MultiPartException when closing temp files by @N3XT3R1337 in Kludex/starlette#3191

Add httpx2 to the full extra by @Kludex in Kludex/starlette#3323

Adjust testclient typing and warnings by @waketzheng in Kludex/starlette#3322

Fix IndexError in URL.replace() on a URL with no authority by @LeSingh1 in Kludex/starlette#3317

Annotate URLPath protocol parameter with Literal by @Chang-LeHung in Kludex/starlette#3285

avoid collapsing exception groups from user code by @graingert in Kludex/starlette#2830

Use removeprefix to strip weak ETag indicator in is_not_modified by @gnosyslambda in Kludex/starlette#3193

Build request.url from structured components by @Kludex in Kludex/starlette#3326

New Contributors

@jiyujie2006 made their first contribution in Kludex/starlette#3307

@N3XT3R1337 made their first contribution in Kludex/starlette#3191

@leestana01 made their first contribution in Kludex/starlette#3319

@LeSingh1 made their first contribution in Kludex/starlette#3317

@EmmanuelNiyonshuti made their first contribution in Kludex/starlette#3204

@Chang-LeHung made their first contribution in Kludex/starlette#3285

@gnosyslambda made their first contribution in Kludex/starlette#3193

Full Changelog: Kludex/starlette@1.2.1...1.3.0

Version 1.2.1

What's Changed

Use httpx2 for type checking in the testclient module by @leifwar in Kludex/starlette#3304

Add assert error for requires() when request param is not Request type by @KeeganOP in Kludex/starlette#3298

New Contributors

@leifwar made their first contribution in Kludex/starlette#3304

@diskeu made their first contribution in Kludex/starlette#3243

@KeeganOP made their first contribution in Kludex/starlette#3298

Full Changelog: Kludex/starlette@1.2.0...1.2.1

Version 1.2.0

What's Changed

Support httpx2 in the test client by @Kludex in Kludex/starlette#3291

Full Changelog: Kludex/starlette@1.1.0...1.2.0

Version 1.1.0

... (truncated)

Changelog

Sourced from starlette's changelog.

1.3.1 (June 12, 2026)

Fixed

Enforce max_fields and max_part_size in FormParser #3329.

Enforce FormParser limits in parser callbacks #3331.

1.3.0 (June 11, 2026)

Added

Add httpx2 to the full extra #3323.

Annotate the URLPath protocol parameter with Literal #3285.

Fixed

Build request.url from structured components #3326.

Clamp oversized suffix ranges in FileResponse #3307.

Catch OSError alongside MultiPartException when closing temp files #3191.

Avoid collapsing exception groups raised from user code #2830.

Use removeprefix to strip the weak ETag indicator in is_not_modified #3193.

Fix IndexError in URL.replace() on a URL with no authority #3317.

Adjust testclient typing and warnings #3322.

1.2.1 (May 31, 2026)

Fixed

Use httpx2 for type checking in the testclient module #3304.

Add assert error for requires() when the request parameter is not a Request type #3298.

1.2.0 (May 28, 2026)

Added

Support httpx2 in the test client #3291.

1.1.0 (May 23, 2026)

Added

Use "application/octet-stream" as the FileResponse media type fallback #3283.

Fixed

Only dispatch standard HTTP verbs in HTTPEndpoint #3286.

Reject absolute paths in StaticFiles.lookup_path #3287.

1.0.1 (May 21, 2026)

... (truncated)

Commits

8ebffd0 Version 1.3.1 (#3330)
25b8e17 Enforce FormParser limits in parser callbacks (#3331)
dba1c4b Enforce max_fields and max_part_size in FormParser (#3329)
45e51dc Use StarletteDeprecationWarning instead of DeprecationWarning (#3119)
5f8610c Version 1.3.0 (#3327)
167b585 Build request.url from structured components (#3326)
3730925 Use removeprefix to strip weak ETag indicator in is_not_modified (#3193)
e6f7ad1 avoid collapsing exception groups from user code (#2830)
115228f Annotate URLPath protocol parameter with Literal (#3285)
113f193 docs: replace inline ASGI server list with link to canonical implemen… (#3204)
Additional commits viewable in compare view

Updates starlette from 1.0.0 to 1.3.1

Release notes

Sourced from starlette's releases.

Version 1.3.1

What's Changed

Use StarletteDeprecationWarning instead of DeprecationWarning by @Kludex in Kludex/starlette#3119

Enforce max_fields and max_part_size in FormParser by @Kludex in Kludex/starlette#3329

Enforce FormParser limits in parser callbacks by @Kludex in Kludex/starlette#3331

Full Changelog: Kludex/starlette@1.3.0...1.3.1

Version 1.3.0

What's Changed

Clamp oversized suffix ranges in FileResponse by @jiyujie2006 in Kludex/starlette#3307

Catch OSError alongside MultiPartException when closing temp files by @N3XT3R1337 in Kludex/starlette#3191

Add httpx2 to the full extra by @Kludex in Kludex/starlette#3323

Adjust testclient typing and warnings by @waketzheng in Kludex/starlette#3322

Fix IndexError in URL.replace() on a URL with no authority by @LeSingh1 in Kludex/starlette#3317

Annotate URLPath protocol parameter with Literal by @Chang-LeHung in Kludex/starlette#3285

avoid collapsing exception groups from user code by @graingert in Kludex/starlette#2830

Use removeprefix to strip weak ETag indicator in is_not_modified by @gnosyslambda in Kludex/starlette#3193

Build request.url from structured components by @Kludex in Kludex/starlette#3326

New Contributors

@jiyujie2006 made their first contribution in Kludex/starlette#3307

@N3XT3R1337 made their first contribution in Kludex/starlette#3191

@leestana01 made their first contribution in Kludex/starlette#3319

@LeSingh1 made their first contribution in Kludex/starlette#3317

@EmmanuelNiyonshuti made their first contribution in Kludex/starlette#3204

@Chang-LeHung made their first contribution in Kludex/starlette#3285

@gnosyslambda made their first contribution in Kludex/starlette#3193

Full Changelog: Kludex/starlette@1.2.1...1.3.0

Version 1.2.1

What's Changed

Use httpx2 for type checking in the testclient module by @leifwar in Kludex/starlette#3304

Add assert error for requires() when request param is not Request type by @KeeganOP in Kludex/starlette#3298

New Contributors

@leifwar made their first contribution in Kludex/starlette#3304

@diskeu made their first contribution in Kludex/starlette#3243

@KeeganOP made their first contribution in Kludex/starlette#3298

Full Changelog: Kludex/starlette@1.2.0...1.2.1

Version 1.2.0

What's Changed

Support httpx2 in the test client by @Kludex in Kludex/starlette#3291

Full Changelog: Kludex/starlette@1.1.0...1.2.0

Version 1.1.0

... (truncated)

Changelog

Sourced from starlette's change...

Description has been truncated

Bumps the pip group with 3 updates in the /apps/ai-engine/examples directory: [pydantic-settings](https://github.com/pydantic/pydantic-settings), [cryptography](https://github.com/pyca/cryptography) and [pyasn1](https://github.com/pyasn1/pyasn1). Bumps the pip group with 2 updates in the /apps/api-gateway directory: [cryptography](https://github.com/pyca/cryptography) and [starlette](https://github.com/Kludex/starlette). Bumps the pip group with 1 update in the /packages/py/aitbc-crypto directory: [cryptography](https://github.com/pyca/cryptography). Bumps the pip group with 1 update in the /requirements-optional directory: [cryptography](https://github.com/pyca/cryptography). Bumps the pip group with 1 update in the /scripts/monitoring/examples/monitoring-service directory: [pydantic-settings](https://github.com/pydantic/pydantic-settings). Updates `pydantic-settings` from 2.14.0 to 2.14.2 - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.14.0...v2.14.2) Updates `cryptography` from 47.0.0 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@47.0.0...50.0.0) Updates `pyasn1` from 0.6.3 to 0.6.4 - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4) Updates `cryptography` from 47.0.0 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@47.0.0...50.0.0) Updates `cryptography` from 47.0.0 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@47.0.0...50.0.0) Updates `cryptography` from 47.0.0 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@47.0.0...50.0.0) Updates `pydantic-settings` from 2.14.0 to 2.14.2 - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.14.0...v2.14.2) Updates `cryptography` from 47.0.0 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@47.0.0...50.0.0) Updates `starlette` from 1.0.0 to 1.3.1 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.0...1.3.1) Updates `starlette` from 1.0.0 to 1.3.1 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.0...1.3.1) Updates `starlette` from 1.0.0 to 1.3.1 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.0...1.3.1) Updates `cryptography` from 46.0.6 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@47.0.0...50.0.0) Updates `cryptography` from 46.0.6 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@47.0.0...50.0.0) Updates `cryptography` from 46.0.6 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@47.0.0...50.0.0) Updates `cryptography` from 46.0.6 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@47.0.0...50.0.0) Updates `cryptography` from 48.0.1 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@47.0.0...50.0.0) Updates `cryptography` from 48.0.1 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@47.0.0...50.0.0) Updates `cryptography` from 48.0.1 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@47.0.0...50.0.0) Updates `cryptography` from 48.0.1 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@47.0.0...50.0.0) Updates `pydantic-settings` from 2.14.0 to 2.14.2 - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.14.0...v2.14.2) Updates `pydantic-settings` from 2.14.0 to 2.14.2 - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.14.0...v2.14.2) --- updated-dependencies: - dependency-name: pydantic-settings dependency-version: 2.14.2 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: indirect dependency-group: pip - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect dependency-group: pip - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: indirect dependency-group: pip - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: indirect dependency-group: pip - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: indirect dependency-group: pip - dependency-name: pydantic-settings dependency-version: 2.14.2 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: indirect dependency-group: pip - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect dependency-group: pip - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect dependency-group: pip - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect dependency-group: pip - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production dependency-group: pip - dependency-name: pydantic-settings dependency-version: 2.14.2 dependency-type: direct:production dependency-group: pip - dependency-name: pydantic-settings dependency-version: 2.14.2 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 5, 2026

dependabot Bot requested a review from oib as a code owner September 5, 2026 08:26

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 5, 2026

oib force-pushed the main branch from 8c37851 to e8cece0 Compare September 14, 2026 13:48

Navigation Menu

chore(deps): bump the pip group across 5 directories with 4 updates - #183

chore(deps): bump the pip group across 5 directories with 4 updates#183
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/apps/ai-engine/examples/pip-ef67ed634b

dependabot Bot commented on behalf of github Sep 5, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.14.2

What's Changed

Security

v2.14.1

What's Changed

Release 0.6.4

Revision 0.6.4, released 08-07-2026

v2.14.2

What's Changed

Security

v2.14.1

What's Changed

Version 1.3.1

What's Changed

Version 1.3.0

What's Changed

New Contributors

Version 1.2.1

What's Changed

New Contributors

Version 1.2.0

What's Changed

Version 1.1.0

1.3.1 (June 12, 2026)

Fixed

1.3.0 (June 11, 2026)

Added

Fixed

1.2.1 (May 31, 2026)

Fixed

1.2.0 (May 28, 2026)

Added

1.1.0 (May 23, 2026)

Added

Fixed

1.0.1 (May 21, 2026)

Version 1.3.1

What's Changed

Version 1.3.0

What's Changed

New Contributors

Version 1.2.1

What's Changed

New Contributors

Version 1.2.0

What's Changed

Version 1.1.0

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 5, 2026 •

edited

Loading