Skip to content

fix(server): bump cryptography 48.0.1 → 50.0.0 to clear two HIGH CVEs #83

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AlexanderMakarov merged 1 commit into from
Aug 5, 2026
+59 −51
Merged

fix(server): bump cryptography 48.0.1 → 50.0.0 to clear two HIGH CVEs #83

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 16 additions & 6 deletions server/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,12 +31,22 @@ build-backend = "hatchling.build"
# 7 days of public scrutiny before we'll pick it up).
exclude-newer = "7 days"

# Per-package cooldown exemption. starlette 1.3.1 (published 2026-06-12) is the
# only release that patches HIGH CVE-2026-54283 (form-limit DoS), but it landed
# 1 day inside the 7-day window. The known, published CVE outweighs the marginal
# supply-chain risk of a 6-day-old release from a reputable maintainer (Encode),
# so we exempt starlette with a fixed cutoff that admits 1.3.1.
exclude-newer-package = { starlette = "2026-06-13" }
# Per-package cooldown exemptions. Each one trades a few days of the window for
# a known, published CVE fix, and pins a fixed cutoff so the exemption admits
# exactly the release it was opened for. Cutoffs are written as explicit UTC
# timestamps: a bare date is resolved against the locking machine's local
# timezone, so it produces a different lock depending on who runs `uv lock`.
#
# starlette 1.3.1 (published 2026-06-12) is the only release that patches HIGH
# CVE-2026-54283 (form-limit DoS), but it landed 1 day inside the 7-day window.
# The known, published CVE outweighs the marginal supply-chain risk of a 6-day-old
# release from a reputable maintainer (Encode).
#
# cryptography 50.0.0 (published 2026-07-31) is the first release that patches
# HIGH CVE-2026-69247 (PKCS#7 EnvelopedData Bleichenbacher oracle); it also
# carries the CVE-2026-69249 path-building fix from 49.0.0. It landed 5 days
# inside the window, and the maintainer is PyCA.
exclude-newer-package = { starlette = "2026-06-13T22:00:00Z", cryptography = "2026-08-01T00:00:00Z" }

[tool.hatch.build.targets.wheel]
packages = ["src/awos_recruitment_mcp"]
Expand Down
Loading
Loading