Skip to content

Bump cryptography from 43.0.3 to 46.0.6#4

Closed
dependabot[bot] wants to merge 14 commits intomainfrom
dependabot/uv/cryptography-46.0.6
Closed

Bump cryptography from 43.0.3 to 46.0.6#4
dependabot[bot] wants to merge 14 commits intomainfrom
dependabot/uv/cryptography-46.0.6

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 28, 2026 •
edited
Loading

Bumps cryptography from 43.0.3 to 46.0.6.

Changelog

Sourced from cryptography's changelog.

46.0.6 - 2026-03-25


* **SECURITY ISSUE**: Fixed a bug where name constraints were not applied
  to peer names during verification when the leaf certificate contains a
  wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug,
  including those used by the Web PKI. Credit to **Oleh Konko (1seal)** for
  reporting the issue. **CVE-2026-34073**

.. _v46-0-5:


46.0.5 - 2026-02-10

  • An attacker could create a malicious public key that reveals portions of your private key when using certain uncommon elliptic curves (binary curves). This version now includes additional security checks to prevent this attack. This issue only affects binary elliptic curves, which are rarely used in real-world applications. Credit to XlabAI Team of Tencent Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting the issue. CVE-2026-26007
  • Support for SECT* binary elliptic curves is deprecated and will be removed in the next release.

.. v46-0-4:

46.0.4 - 2026-01-27


* `Dropped support for win_arm64 wheels`_.
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.

.. _v46-0-3:


46.0.3 - 2025-10-15

  • Fixed compilation when using LibreSSL 4.2.0.

.. _v46-0-2:

46.0.2 - 2025-09-30


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.4.

.. _v46-0-1:


46.0.1 - 2025-09-16

... (truncated)

Commits

@RaghavChamadiya
Add CODEOWNERS, security policy, and governance files (#3)
5137cee 
* Add open source governance files and clean up tracked files

- CODEOWNERS: @RaghavChamadiya and @swati510 as code owners
- SECURITY.md: vulnerability reporting policy
- CONTRIBUTING.md: setup guide and PR workflow
- Issue and PR templates
- Gitignore local dev scripts, API keys, and internal docs

* Fix security vulnerabilities and restore uv.lock for CI

- Upgrade next-mdx-remote 5.0.0 → 6.0.0 (arbitrary code execution fix)
- Upgrade next 15.5.13 → 15.5.14 (image cache growth fix)
- Fix picomatch, brace-expansion, yaml transitive vulnerabilities
- Pin next to ~15.5.14 to prevent accidental major version jumps
- Re-track uv.lock (needed by CI for reproducible Python installs)

* Restore [project] tables in sub-package pyproject.toml for uv sync

uv sync --all-packages requires a [project] table when package = true.
Added minimal project metadata to core, cli, and server sub-packages.

* Fix ruff lint errors and skip tests for missing optional deps

- Fix all ruff lint violations across packages/ and tests/
- Add pytest.importorskip for anthropic and openai test modules
  so CI passes without optional provider SDKs installed

* Update uv.lock after sub-package pyproject.toml changes

* Disable mypy strict mode in CI until type annotations are cleaned up

Relax mypy config and skip mypy CI step — the codebase has 38 type
annotation issues that need proper fixes. Ruff still catches the
important lint and formatting errors.

* Fix test failures: skip optional SDK tests, fix version assertion

- Add pytest.importorskip for gemini and openai embedder test modules
- Update test_version assertion from 0.1.0 to 0.1.2

* Add ESLint config to prevent next lint interactive prompt on CI
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Mar 28, 2026
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Mar 28, 2026
swati510 and others added 13 commits March 29, 2026 13:04
@swati510
Add architecture improvements and comprehensive documentation
bba1799 
Improvements:
- Adaptive cascade budget: scales 10-50 based on change magnitude
- LLM output validation: cross-checks backtick refs against AST symbols
- Generation report: rich table with token counts, cost estimate, and warnings
- Framework-aware synthetic edges: conftest, Django, FastAPI, Flask patterns
- Doctor --repair: three-store consistency checks with auto-repair

Documentation:
- graph-algorithms-guide.md: full guide to all graph algorithms with math
- architecture-guide.md: complete architecture walkthrough
- deep-dives-guide.md: dead code, decisions, search, webhooks, cascades
- critical-analysis.md: failure analysis, probabilities, and improvements
@swati510
Fix lint, formatting, and integration tests
4e1899b 
- Fix ruff lint: remove unused imports, combine nested ifs, rename unused
  loop vars, simplify embedder resolution in doctor --repair
- Apply ruff formatting to all modified files
- Fix test_creates_db_and_state: match actual "init complete" output
- Fix test_mcp_dead_code_and_freshness_flow: use tiers["high"]["findings"]
  to match the actual get_dead_code return shape
- Fix test_gemini_live: skip when google-genai module is not installed
@swati510
Fix web UI serve: standalone path, server-side API routing, and dashb…
f515fd2 
…oard stats

- Fix standalone server.js path for Next.js monorepo builds (packages/web/server.js)
- Add cwd-based lookup so _find_local_web works from pip-installed venvs
- Fix server-side API client to use REPOWISE_API_URL instead of defaulting to port 80
- Replace hardcoded dashboard stats with real data from getRepoStats
- Add .sfdx/ to .gitignore
@RaghavChamadiya
Feat/claude code plugin (#6)
7e9e7c8 
* Add Claude Code plugin with MCP server, slash commands, and model-invoked skills

Plugin at plugins/claude-code/ provides frictionless Repowise setup via Claude Code:
- Auto-registers MCP server (8 tools) via .mcp.json
- 5 slash commands: /repowise:init, status, update, search, reindex
- 4 model-invoked skills: codebase exploration, pre-modification risk check,
  architectural decisions, dead code cleanup
- /repowise:init handles full setup flow (install, provider selection, indexing)
- Marketplace-ready with plugin.json and marketplace.json

* Update README with Claude Code plugin install path, add plugin developer guide

- Add plugin as the recommended install method in main README
- Add --index-only quick start option
- Link to plugin repo from MCP tools section
- Fix marketplace org reference (repowise-dev, not repowise)
- Add DEVELOPER.md with plugin maintenance and release workflow
@swati510
Auto-configure MCP and write .claude/CLAUDE.md during repowise init (#7)
d06811c 
- Write .mcp.json at repo root so Claude Code auto-discovers the MCP server
  (with merge semantics to preserve other MCP servers)
- Move CLAUDE.md generation to .claude/CLAUDE.md for Claude Code project config
- Strengthen template language (MUST/ALWAYS/MANDATORY) to compel tool usage
- Update format_setup_instructions to reflect auto-config for Claude Code
- Fix test_init_no_provider: patch GOOGLE_API_KEY and GEMINI_API_KEY env vars
@swati510
Feat UI beautification (#8)
22db86d 
* Auto-configure MCP and write .claude/CLAUDE.md during repowise init

- Write .mcp.json at repo root so Claude Code auto-discovers the MCP server
  (with merge semantics to preserve other MCP servers)
- Move CLAUDE.md generation to .claude/CLAUDE.md for Claude Code project config
- Strengthen template language (MUST/ALWAYS/MANDATORY) to compel tool usage
- Update format_setup_instructions to reflect auto-config for Claude Code
- Fix test_init_no_provider: patch GOOGLE_API_KEY and GEMINI_API_KEY env vars


* graph beautification

---------
@RaghavChamadiya
Feat/claude code plugin (#10)
8bff7b6 
* Add Claude Code plugin with MCP server, slash commands, and model-invoked skills

Plugin at plugins/claude-code/ provides frictionless Repowise setup via Claude Code:
- Auto-registers MCP server (8 tools) via .mcp.json
- 5 slash commands: /repowise:init, status, update, search, reindex
- 4 model-invoked skills: codebase exploration, pre-modification risk check,
  architectural decisions, dead code cleanup
- /repowise:init handles full setup flow (install, provider selection, indexing)
- Marketplace-ready with plugin.json and marketplace.json

* Update README with Claude Code plugin install path, add plugin developer guide

- Add plugin as the recommended install method in main README
- Add --index-only quick start option
- Link to plugin repo from MCP tools section
- Fix marketplace org reference (repowise-dev, not repowise)
- Add DEVELOPER.md with plugin maintenance and release workflow
@RaghavChamadiya
Release v0.1.21
1bbe1f5
@RaghavChamadiya
chore: add GitHub Pages docs site and deploy workflow
4f5c51f 
Adds website/ with 10 external-facing documentation pages (getting
started, core concepts, CLI reference, MCP server, web dashboard,
CLAUDE.md generator, Claude Code plugin, configuration, self-hosting,
contributing) built with Jekyll and the Just the Docs theme.

Adds .github/workflows/docs.yml to auto-deploy on pushes to main.
@RaghavChamadiya
Add rich git visualizations to web UI and fix QoL issues across all p…
39d9c21 
…ages

- Add churn distribution histogram, commit category donut, and enhanced
  hotspot table with bus factor, line stats, and trend indicators
- Add D3 ownership treemap and bus factor risk panel to ownership page
- Enhance wiki git history panel with lifecycle section, author bars,
  co-change visualization, and commit category sparkline
- Wire dashboard with real stats from getRepoStats and getGitSummary
- Fix server bugs: top_owners missing pct, co-changes filter key mismatch
- Extend HotspotResponse and GitMetadataResponse with bus_factor,
  commit_categories, line stats, and other previously hidden fields
- Fix truncation across all tables: use proper CSS truncation with title
  tooltips, rewrite truncatePath to keep more path components
- Widen all pages from max-w-6xl to max-w-[1600px] for better space usage
- Add search and filter controls to hotspot and ownership tables
- Fix StatCard to render trend prop, loading skeleton mismatches
@RaghavChamadiya
fix: restore dashboard stat cards to Total/Fresh/Stale Pages design
274f710
@swati510
released two packages with bug fixes, fixed serve and init cmds (#12)
e27ec16
@dependabot
Bump cryptography from 43.0.3 to 46.0.6
da6c0b2 
Bumps [cryptography](https://github.com/pyca/cryptography) from 43.0.3 to 46.0.6.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@43.0.3...46.0.6)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.6
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/uv/cryptography-46.0.6 branch from fa56b70 to da6c0b2 Compare March 31, 2026 10:26
RaghavChamadiya
RaghavChamadiya approved these changes Apr 6, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@RaghavChamadiya RaghavChamadiya left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security patch, merging.

@RaghavChamadiya
Copy link
Copy Markdown
Collaborator

RaghavChamadiya commented Apr 6, 2026

@dependabot rebase

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Apr 6, 2026

The dependabot.yml entry that created this PR has been deleted so this PR can't be rebased. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

@RaghavChamadiya
Copy link
Copy Markdown
Collaborator

RaghavChamadiya commented Apr 11, 2026

Closing this since the dependabot config has changed and it can't be rebased. Will bump cryptography separately in a fresh branch.

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Apr 11, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot bot deleted the dependabot/uv/cryptography-46.0.6 branch April 11, 2026 06:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@RaghavChamadiya RaghavChamadiya RaghavChamadiya approved these changes

@swati510 swati510 Awaiting requested review from swati510 swati510 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@RaghavChamadiya @swati510