fix(anonymizer): bump cryptography to >=50.0.0 for GHSA-g6cj-pr64-35w5 - #2231
Open
Aryan-Pardeshi wants to merge 1 commit into
Open
fix(anonymizer): bump cryptography to >=50.0.0 for GHSA-g6cj-pr64-35w5#2231Aryan-Pardeshi wants to merge 1 commit into
Aryan-Pardeshi wants to merge 1 commit into
Conversation
GHSA-g6cj-pr64-35w5 (CVE-2026-69247) affects cryptography >=44.0.0,<50.0.0 and is first patched in 50.0.0. The <49.0.0 ceiling made presidio-anonymizer and the patched release mutually exclusive, so downstream projects could not take the fix without dropping presidio-anonymizer. Same shape as data-privacy-stack#2143, resolved by data-privacy-stack#2144. Fixes: data-privacy-stack#2229
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change Description
presidio-anonymizerdeclarescryptography (>=48.0.1,<49.0.0). GHSA-g6cj-pr64-35w5 / CVE-2026-69247 affectscryptography >=44.0.0,<50.0.0and is first patched in50.0.0, so the<49.0.0ceiling and the patched release are mutually exclusive — downstream projects cannot take the fix without droppingpresidio-anonymizer, and Dependabot resolution fails outright rather than opening a fix PR.Bumps the constraint to
cryptography (>=50.0.0,<51.0.0), same shape as #2143 → #2144 which moved the floor for GHSA-537c-gmf6-5ccf.Verified locally with
cryptography==50.0.0installed:presidio-anonymizer/testspasses 316 passed, 15 skipped, including the AES cypher suite that exercises thecryptographyAPI surface this package actually uses.Issue reference
Fixes #2229
Checklist