From 310745836d61aa4952d009e4725cdea1185e49fc Mon Sep 17 00:00:00 2001 From: shuningc Date: Tue, 11 Aug 2026 14:29:56 -0700 Subject: [PATCH 1/7] fix(deps): bump cryptography to >=50.0.0 for VULN-106433 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remediate PKCS#7 decrypt Bleichenbacher oracle (CVE-2026-69247) in pkcs7_decrypt_der/pem/smime for cryptography 44.0.0–49.x. Add explicit floor and refresh poetry.lock to resolve cryptography 50.0.0. --- poetry.lock | 103 ++++++++++++++++++++++++------------------------- pyproject.toml | 1 + 2 files changed, 52 insertions(+), 52 deletions(-) diff --git a/poetry.lock b/poetry.lock index eebeeca..3623e48 100644 --- a/poetry.lock +++ b/poetry.lock @@ -500,7 +500,7 @@ files = [ {file = "cffi-2.1.0-cp315-cp315t-win_arm64.whl", hash = "sha256:cbb7640ce37159548d2147b5b8c241f962143d4c71231431820783f4dc78f210"}, {file = "cffi-2.1.0.tar.gz", hash = "sha256:efc1cdd798b1aaf39b4610bba7aad28c9bea9b910f25c784ccf9ec1fa719d1f9"}, ] -markers = {main = "platform_python_implementation != \"PyPy\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or (extra == \"langchain\" or extra == \"all\") and platform_python_implementation == \"PyPy\" or (extra == \"langchain\" or extra == \"all\") and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")", test = "platform_python_implementation == \"PyPy\""} +markers = {main = "extra == \"langchain\" or extra == \"all\" or platform_python_implementation != \"PyPy\"", test = "platform_python_implementation == \"PyPy\""} [package.dependencies] pycparser = {version = "*", markers = "implementation_name != \"PyPy\""} @@ -864,59 +864,58 @@ watson = ["ibm-watsonx-ai (>=1.3.39)"] [[package]] name = "cryptography" -version = "49.0.0" +version = "50.0.0" description = "cryptography is a package which provides cryptographic recipes and primitives to Python developers." -optional = true +optional = false python-versions = "!=3.9.0,!=3.9.1,>=3.9" groups = ["main"] -markers = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or extra == \"openai\" or extra == \"all\" or extra == \"crewai\"" files = [ - {file = "cryptography-49.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db"}, - {file = "cryptography-49.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db"}, - {file = "cryptography-49.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0e959b578856a3924bc0cbb710fc12c387b9412a951389f3ca61704a9e25f325"}, - {file = "cryptography-49.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:53ecee2e23f7169b6117e99fc8a944e5e50f79e69758a83b52a00cb98ab2b2d2"}, - {file = "cryptography-49.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:2eda353d8a27bcbcaa4cbed18994a74ab4d19a2ca897db188ea269ab9b71419b"}, - {file = "cryptography-49.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:2afe9051da7ae7bd5905da5a949280c7d2bb75682e188f650a9d0f2756b834c6"}, - {file = "cryptography-49.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:0b82e28ee398a386f0807bba7884d30f25218855690f45115831bcce5d90822c"}, - {file = "cryptography-49.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:ccac2bfebc306b862133e3bb71f3f6ee8bb525240089b2d952e4144b3a6d5da7"}, - {file = "cryptography-49.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:d0527ce944105f257f605a827d6ebead966c752038b6e8656abb9c5edee6fc68"}, - {file = "cryptography-49.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:cbc77da8c523d5abd028635ba850a6966fcee2c82e2bf65a41d1d8afe0f98be9"}, - {file = "cryptography-49.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:b87e65d263b3e5d3bb92a57e2a6638e2f31110fa7aa890c7b2dbba42248d0a3f"}, - {file = "cryptography-49.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:66ec79c3904820572d7e987abdf304281f141d37ad9a489b8e97066e7b9b6459"}, - {file = "cryptography-49.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e"}, - {file = "cryptography-49.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:73a205dce83953d131a4aa1e0fd917a2fd1c5b1eef251e9d7152efefcbf5caf7"}, - {file = "cryptography-49.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:196ecd6a36e4e9aa10270393bb98d8df88fccee0bf1e5128b91ae4eb4375896d"}, - {file = "cryptography-49.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7abcee80084cda3f7691f3eb1ce480d8df49cec637b429aa35986c1de71738aa"}, - {file = "cryptography-49.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:4ae387c9cb68ea569ca17e490d66d8142b81c3cc814bf179974b7d146e490bbb"}, - {file = "cryptography-49.0.0-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:f37d847238971164fdbc68ade6f6574aecc9c0af714190e2083429ff68f4ce9d"}, - {file = "cryptography-49.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:c2bc30226390d60ea19d9f82b19db005fe0452154a23c1c410c12ea801e43561"}, - {file = "cryptography-49.0.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:07cab27cc7b7e0fd28e5e26bb9eeedde5c135c868b46de4a27845abe94af6122"}, - {file = "cryptography-49.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:b20133d204d2bb56ba047642199603876c872026ca53e79c35b83772ab2cc505"}, - {file = "cryptography-49.0.0-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:b970c6da94d5bb18629db453d14f2a1300f6bf59b61e9b82377931ef95504866"}, - {file = "cryptography-49.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:d8ecde755e2e91bf773fc94e8c9d730cd7f2007004cb492263a794ec3899a1c8"}, - {file = "cryptography-49.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e3fb64c420688e5319ae25113a354015abbd8dffbfbc41781a1ea66fc7622ac3"}, - {file = "cryptography-49.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:32703d93296f5c1f4b53349ad3a250c2cae0fdecd3a3dd5d47e616d8d616af27"}, - {file = "cryptography-49.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:33cd0565932807baddb67b96dbee92f2c374b5c89dee09fd74079aeb8c8dba61"}, - {file = "cryptography-49.0.0-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:ec5e529fb80935c94fe7b729f9972b50e351a0e6b50aa294fd5cabb109fcc29a"}, - {file = "cryptography-49.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f78ff2c9ed8dc2d036b0f4d640e22522213d047c1b14e61205a7e55c80a494d4"}, - {file = "cryptography-49.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:35b151772baff2c74cba7fa290ceaff4c3b11c0c881eb93eb5dbc05a7cfbba18"}, - {file = "cryptography-49.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:0f21641cf4b30fca7aee061ced0ec7ad7b073518088b7c9969a297c0ae796c69"}, - {file = "cryptography-49.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9e82dcc8e56052715fb18b2429e3bca4823b1629136a2084fc45a9a5cecb9b64"}, - {file = "cryptography-49.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:6f2debedf9ca60cf1d5bd466475638af5130f89965605cd818484d19987d3a21"}, - {file = "cryptography-49.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:8c25ceb16df5b9435f3f6a9829204985b0e0cbee3b48aacd432c7d2c850b44d9"}, - {file = "cryptography-49.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:28d8b15e6275f12c8a207dc309dfa957903c927d08d0cc937ee3f63f200693cc"}, - {file = "cryptography-49.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:6fc361c34fb6aac015ce19435876635e5c6d21db31998b0920f675f131e043b8"}, - {file = "cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:2400ef9c9e2299a25614eb1dea3db54a69b1349efd043bfac9c67630d136df36"}, - {file = "cryptography-49.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:67e1d20ad9ef3a563c59ef22e7a8a0b8210bd26604369ea4a30a7c66aefe504e"}, - {file = "cryptography-49.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:42b0684e0e40cf26122427802486f6d93aea593612603a94fbf260c7eb1e9c1b"}, - {file = "cryptography-49.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:026ac7423e6fa66872d3bf889be5974507da3944f866f704fa200eadacd00001"}, - {file = "cryptography-49.0.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:fc1e275c2f1d97b1a6450b8b0ea3ebfa6e087a611c2b26cb2404d48588abab7b"}, - {file = "cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:c83782480a4a9da4d0feb51950131ba32e12e70813848b3343f6e18c28a66838"}, - {file = "cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:b39efa323140595abd3ecca8529d321ae50f55f3aa3ba9cc81ea56a6011953d5"}, - {file = "cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:b47db11c2c3525083296069b98ac5221907455e989ae0c2e3008bde851921615"}, - {file = "cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:084ef1af862eb07ec46d25f68689f2102a9fc0e05ce7b80f14f5fe51e4eef0f6"}, - {file = "cryptography-49.0.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:be9fcb48a55f023493482827d4f459bd263cc20efde64f204b97c123201850c6"}, - {file = "cryptography-49.0.0.tar.gz", hash = "sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493"}, + {file = "cryptography-50.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:031e2d5dd4bb9caa3ca9c82e5a197fd8ae680232cee62603d1a813f3f07e3d03"}, + {file = "cryptography-50.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:fd9192b7b70c573d7f214eb1ae35e00d359f6f5e4b27c7e21e30de1fc6204645"}, + {file = "cryptography-50.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:06a32a980526a6ab9a4b9bf8f7385800791e2bb960903cb6b530e4817509a3b7"}, + {file = "cryptography-50.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:a1b30560f2acc95aa8b2e06e716a13dbfc97314747b80d9707e307f77b40d6b3"}, + {file = "cryptography-50.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:8d89f3976b10b4ce31118de72329025f70d2c6ead14a8217c5514dd2c6d5a78f"}, + {file = "cryptography-50.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:b42a28c1844fd9de8f3f7d540e36b66f3a9c83fceac7170ebc7a6a19edd9dcae"}, + {file = "cryptography-50.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:900131fafd8aead39ac7dd3a7e833be754c17a95cfd91221636949fe4eb0aa8a"}, + {file = "cryptography-50.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:07949c449a1abcf60d1ee6e88956d89404c7df3c8258f46589e912988e551987"}, + {file = "cryptography-50.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:f89831ef99dd7dd169ab06d63a831adb9e20a87aac6d380266bbda5823349169"}, + {file = "cryptography-50.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:82148ec5bddac30b51a5b3c1945075f896fa022cb93f8e4a01e9f6ee95292c5f"}, + {file = "cryptography-50.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:1489e263a8048bb8b6a8bac662eb2d402ea5d2b7b4699b72f385f1e2772db105"}, + {file = "cryptography-50.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:7cec5b856506da6defb290f30c9ee687d5f5e8cb0bd3f6459dde43b0b4fa40ef"}, + {file = "cryptography-50.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:bd1c592e4d5974f0d08d4888e432157adba757c66da0246918e43677fafa2d30"}, + {file = "cryptography-50.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:49e7d93abdbd2990caced757e5fade25302f719c3c8fb6e6fff2dde98999fc41"}, + {file = "cryptography-50.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:19736989797678c6af1e55cd49055cdbcb55d8f6b5583ac5335f933aba9101dc"}, + {file = "cryptography-50.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:80b63928fa35083b33966ce1efb70e5b9607181e49dcd1c22c8c005e319f667f"}, + {file = "cryptography-50.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:d58c3db7cd6eed54e6c06744db55456b65ebd7492ddeae9c1e93cfca7aa857d3"}, + {file = "cryptography-50.0.0-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:df2a58a472f332225671c35b0a830208b86d004f82baa8530fa3782c85646533"}, + {file = "cryptography-50.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:11b74db56cdbe3cdee6e3f6982ecb70334fa10dce99ed58bf7894aaaa3b2a037"}, + {file = "cryptography-50.0.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:f59e38625469987d7ef6d495323c55e7db6c212eaf6112267e0d3b565a2e9c9f"}, + {file = "cryptography-50.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:ecfed7367f965a0328cfbdd70da860f15441f002f613185668c6e6ebf5a0ac11"}, + {file = "cryptography-50.0.0-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:9aa87839c383bdbab6ef865787a1fb877af8dd03464c4400322726feaaadfc6d"}, + {file = "cryptography-50.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:6ba6a53445bd3cfa809ef3ef5f1589aa6ba08784a1d962bf47d0940e871dab1c"}, + {file = "cryptography-50.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:3f5735ffe4996d28b809371756219f5354864902a3b9e7c0b9ee87041209fc9c"}, + {file = "cryptography-50.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:1b4a266766514614f8aa60416e71f2fc6e575d36e7bdc90f644fadb2f4b75b95"}, + {file = "cryptography-50.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:12b9c6996425c76ea6c457ace4f3073e715b8c545add07cd1a8f3a4f90691269"}, + {file = "cryptography-50.0.0-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:ccdc4a71a4dabae05de219404f9f4abc38e3b58422177ff93d0da05967dafa07"}, + {file = "cryptography-50.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:910e1d2668e7de9648f2bcee30e180db2a6b15c30f887d7c4c93ddf96e3992e3"}, + {file = "cryptography-50.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:a91296cb61e8df6f86d0c19cc4068228da256bf59bf86049fbd821084565327f"}, + {file = "cryptography-50.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:e722f16708d854fe924790e051061f6704a472c3bac347b6fd88033ea8dd0dc5"}, + {file = "cryptography-50.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:d764dcf130c428ef66786f866dd750f53182bc608813489915e9fc106bb0c82f"}, + {file = "cryptography-50.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:105110f43a471dbd0060b9c9516cb8a6a79233631a04cc2ba16f28323ac6e025"}, + {file = "cryptography-50.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:828743d939e9629bc267b8e2d08d8bb67cd4319c771a33d4b18b22dd8fb7440a"}, + {file = "cryptography-50.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:2a8183b489dc1f7f80f135780fadc1108f14b31b8a40411c7a5b17425f65f28b"}, + {file = "cryptography-50.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:6e7d61120573a7f2cd94cc095f9e81f6967c61ccdf194285aa143ecec8e0b708"}, + {file = "cryptography-50.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:37fdb0d0111f1e2ff07139dfb79f1b49531f8e213c46f1163dd7642979b58c47"}, + {file = "cryptography-50.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:c87f62a3d3b9888ed0fdde100ec06aa61ca9cd44bad9057d1dff9a516b5f5bb9"}, + {file = "cryptography-50.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:65c2c3add92b45fd0709db8594536aea39c2a67af0e27ffcf049c498501140b7"}, + {file = "cryptography-50.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:d24fead1d4d076e1bfb006dcec392074a3cd8d7b4fc8a595aa64073b2b7a96ba"}, + {file = "cryptography-50.0.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:5e34edd123674534acd70147f0ca331eaa2c74e6325fb2028c886aa26ba0b68c"}, + {file = "cryptography-50.0.0-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:8eb5e1172eb569ea8a872796576e6a67c276351728b6455d5beb01242b027c6a"}, + {file = "cryptography-50.0.0-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:910d11e1a385c654bf738bf3e6b8e6ed5de0f5610fcae2be9e5b398d8081d20e"}, + {file = "cryptography-50.0.0-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:62598a8a57f815db4c6259a4e97d857dab56697e7de8e8ab02352ab74da1995d"}, + {file = "cryptography-50.0.0-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:07479a1cb08219ab719147e742e76090c9c773321959bb94946fffdd397a6437"}, + {file = "cryptography-50.0.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:c99c003e088647b8a5b7c145d6f78c335f6348332b62e142d411c4b63d1460b9"}, + {file = "cryptography-50.0.0.tar.gz", hash = "sha256:eeac2acb5a20ed25e0ad6d1df9891a520b78b404266b6d11778f25d5d691a6c9"}, ] [package.dependencies] @@ -3983,7 +3982,7 @@ files = [ {file = "pycparser-2.22-py3-none-any.whl", hash = "sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc"}, {file = "pycparser-2.22.tar.gz", hash = "sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6"}, ] -markers = {main = "(python_version <= \"3.13\" or extra == \"langchain\" or extra == \"all\" or extra == \"openai\" or extra == \"crewai\") and (platform_python_implementation != \"PyPy\" or extra == \"langchain\" or extra == \"all\") and implementation_name != \"PyPy\" and (extra == \"langchain\" or extra == \"all\" or extra == \"crewai\" or extra == \"openai\") and (platform_python_implementation == \"PyPy\" or python_version <= \"3.13\" or extra == \"openai\" or extra == \"all\" or extra == \"crewai\") and (platform_python_implementation == \"PyPy\" or extra == \"crewai\" or extra == \"all\" or extra == \"openai\")", test = "platform_python_implementation == \"PyPy\" and implementation_name != \"PyPy\""} +markers = {main = "(extra == \"langchain\" or extra == \"all\" or platform_python_implementation != \"PyPy\") and implementation_name != \"PyPy\"", test = "platform_python_implementation == \"PyPy\" and implementation_name != \"PyPy\""} [[package]] name = "pydantic" @@ -6519,4 +6518,4 @@ openai = ["mcp", "openai", "openai-agents", "packaging"] [metadata] lock-version = "2.1" python-versions = "^3.11,<3.15" -content-hash = "b9d2fb0193b83eb832e12d573345281366dd7d1e87af50f46059781a83402c1d" +content-hash = "45eb4fe12c39e5ea838a57858bcdf4e363329ced24c1ff7da944d84acd8de0fe" diff --git a/pyproject.toml b/pyproject.toml index fb11f10..c32e1e5 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -61,6 +61,7 @@ opentelemetry-exporter-otlp-proto-http = "^1.38.0" filelock = ">=3.20.1" idna = ">=3.15,<4" python-dotenv = ">=1.2.2" +cryptography = ">=50.0.0" requests = ">=2.33.0" uv = { version = ">=0.9.6", optional = true, python = ">=3.11,<3.14" } mcp = { version = ">=1.27.2,<2", optional = true } From f46a8721ae65ba193ac7afe3f28f0010c5f39368 Mon Sep 17 00:00:00 2001 From: shuningc Date: Tue, 11 Aug 2026 14:58:25 -0700 Subject: [PATCH 2/7] fix(VULN-106433): scope cryptography>=50.0.0 to crewai/all extras Keep cryptography optional so base pip install splunk-ao is unchanged and openai-agents[encrypt] / litellm[proxy] pins stay resolvable. Floor only the crewai/all path where pdfminer-six pulls cryptography transitively. --- poetry.lock | 13 +++++++------ pyproject.toml | 6 +++--- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/poetry.lock b/poetry.lock index 3623e48..71f5230 100644 --- a/poetry.lock +++ b/poetry.lock @@ -500,7 +500,7 @@ files = [ {file = "cffi-2.1.0-cp315-cp315t-win_arm64.whl", hash = "sha256:cbb7640ce37159548d2147b5b8c241f962143d4c71231431820783f4dc78f210"}, {file = "cffi-2.1.0.tar.gz", hash = "sha256:efc1cdd798b1aaf39b4610bba7aad28c9bea9b910f25c784ccf9ec1fa719d1f9"}, ] -markers = {main = "extra == \"langchain\" or extra == \"all\" or platform_python_implementation != \"PyPy\"", test = "platform_python_implementation == \"PyPy\""} +markers = {main = "platform_python_implementation != \"PyPy\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or (extra == \"langchain\" or extra == \"all\") and platform_python_implementation == \"PyPy\" or (extra == \"langchain\" or extra == \"all\") and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")", test = "platform_python_implementation == \"PyPy\""} [package.dependencies] pycparser = {version = "*", markers = "implementation_name != \"PyPy\""} @@ -866,9 +866,10 @@ watson = ["ibm-watsonx-ai (>=1.3.39)"] name = "cryptography" version = "50.0.0" description = "cryptography is a package which provides cryptographic recipes and primitives to Python developers." -optional = false +optional = true python-versions = "!=3.9.0,!=3.9.1,>=3.9" groups = ["main"] +markers = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or extra == \"openai\" or extra == \"all\" or extra == \"crewai\"" files = [ {file = "cryptography-50.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:031e2d5dd4bb9caa3ca9c82e5a197fd8ae680232cee62603d1a813f3f07e3d03"}, {file = "cryptography-50.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:fd9192b7b70c573d7f214eb1ae35e00d359f6f5e4b27c7e21e30de1fc6204645"}, @@ -3982,7 +3983,7 @@ files = [ {file = "pycparser-2.22-py3-none-any.whl", hash = "sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc"}, {file = "pycparser-2.22.tar.gz", hash = "sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6"}, ] -markers = {main = "(extra == \"langchain\" or extra == \"all\" or platform_python_implementation != \"PyPy\") and implementation_name != \"PyPy\"", test = "platform_python_implementation == \"PyPy\" and implementation_name != \"PyPy\""} +markers = {main = "(extra == \"openai\" or extra == \"all\" or extra == \"crewai\") and implementation_name != \"PyPy\" and platform_python_implementation != \"PyPy\" or (extra == \"langchain\" or extra == \"all\") and implementation_name != \"PyPy\" and platform_python_implementation == \"PyPy\" or (extra == \"langchain\" or extra == \"all\") and implementation_name != \"PyPy\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")", test = "platform_python_implementation == \"PyPy\" and implementation_name != \"PyPy\""} [[package]] name = "pydantic" @@ -6509,8 +6510,8 @@ cffi = {version = ">=1.11", markers = "platform_python_implementation == \"PyPy\ cffi = ["cffi (>=1.11)"] [extras] -all = ["aiohttp", "crewai", "langchain", "langchain-core", "langsmith", "litellm", "mcp", "openai", "openai-agents", "packaging", "pdfminer-six", "starlette", "uv"] -crewai = ["aiohttp", "crewai", "litellm", "mcp", "pdfminer-six", "uv"] +all = ["aiohttp", "crewai", "cryptography", "langchain", "langchain-core", "langsmith", "litellm", "mcp", "openai", "openai-agents", "packaging", "pdfminer-six", "starlette", "uv"] +crewai = ["aiohttp", "crewai", "cryptography", "litellm", "mcp", "pdfminer-six", "uv"] langchain = ["langchain", "langchain-core", "langsmith"] middleware = ["starlette"] openai = ["mcp", "openai", "openai-agents", "packaging"] @@ -6518,4 +6519,4 @@ openai = ["mcp", "openai", "openai-agents", "packaging"] [metadata] lock-version = "2.1" python-versions = "^3.11,<3.15" -content-hash = "45eb4fe12c39e5ea838a57858bcdf4e363329ced24c1ff7da944d84acd8de0fe" +content-hash = "1bb611e381c7146409bed26fba0f5b70830753e476818d7b77c0ad8831e3bbfc" diff --git a/pyproject.toml b/pyproject.toml index c32e1e5..dd70027 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -28,9 +28,9 @@ packages = [ [project.optional-dependencies] langchain = ["langchain-core", "langchain", "langsmith (>=0.8.0)"] openai = ["openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "mcp (>=1.27.2,<2)"] -crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'", "aiohttp (>=3.14.1,<4); python_version < '3.14'", "mcp (>=1.27.2,<2)", "pdfminer-six (>=20251107)"] +crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'", "aiohttp (>=3.14.1,<4); python_version < '3.14'", "cryptography (>=50.0.0); python_version < '3.14'", "mcp (>=1.27.2,<2)", "pdfminer-six (>=20251107)"] middleware = ["starlette"] -all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'", "aiohttp (>=3.14.1,<4); python_version < '3.14'", "mcp (>=1.27.2,<2)", "pdfminer-six (>=20251107)"] +all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'", "aiohttp (>=3.14.1,<4); python_version < '3.14'", "cryptography (>=50.0.0); python_version < '3.14'", "mcp (>=1.27.2,<2)", "pdfminer-six (>=20251107)"] @@ -61,7 +61,7 @@ opentelemetry-exporter-otlp-proto-http = "^1.38.0" filelock = ">=3.20.1" idna = ">=3.15,<4" python-dotenv = ">=1.2.2" -cryptography = ">=50.0.0" +cryptography = { version = ">=50.0.0", optional = true, python = ">=3.11,<3.14" } requests = ">=2.33.0" uv = { version = ">=0.9.6", optional = true, python = ">=3.11,<3.14" } mcp = { version = ">=1.27.2,<2", optional = true } From 9397032926a6c8779ce2cbdba2b7660930e0c4ba Mon Sep 17 00:00:00 2001 From: shuningc Date: Tue, 11 Aug 2026 15:21:48 -0700 Subject: [PATCH 3/7] Update pyproject.toml --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index dd70027..16e24a3 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -28,7 +28,7 @@ packages = [ [project.optional-dependencies] langchain = ["langchain-core", "langchain", "langsmith (>=0.8.0)"] openai = ["openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "mcp (>=1.27.2,<2)"] -crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'", "aiohttp (>=3.14.1,<4); python_version < '3.14'", "cryptography (>=50.0.0); python_version < '3.14'", "mcp (>=1.27.2,<2)", "pdfminer-six (>=20251107)"] +crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'", "aiohttp (>=3.14.1,<4); python_version < '3.14'", "cryptography (>=50.0.0)", "mcp (>=1.27.2,<2)", "pdfminer-six (>=20251107)"] middleware = ["starlette"] all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'", "aiohttp (>=3.14.1,<4); python_version < '3.14'", "cryptography (>=50.0.0); python_version < '3.14'", "mcp (>=1.27.2,<2)", "pdfminer-six (>=20251107)"] From e97829aca890e098c1b4f60ebdeb180abc14aaf2 Mon Sep 17 00:00:00 2001 From: shuningc Date: Tue, 11 Aug 2026 15:21:54 -0700 Subject: [PATCH 4/7] Update pyproject.toml --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 16e24a3..5ca0c30 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -61,7 +61,7 @@ opentelemetry-exporter-otlp-proto-http = "^1.38.0" filelock = ">=3.20.1" idna = ">=3.15,<4" python-dotenv = ">=1.2.2" -cryptography = { version = ">=50.0.0", optional = true, python = ">=3.11,<3.14" } +cryptography = { version = ">=50.0.0", optional = true } requests = ">=2.33.0" uv = { version = ">=0.9.6", optional = true, python = ">=3.11,<3.14" } mcp = { version = ">=1.27.2,<2", optional = true } From 4b2f16e5f4e5dcbe1256a7185a02b00f7be035d5 Mon Sep 17 00:00:00 2001 From: shuningc Date: Tue, 11 Aug 2026 15:23:05 -0700 Subject: [PATCH 5/7] fix(VULN-106433): cover openai extra and Python 3.14 for cryptography Add cryptography>=50.0.0 to the openai extra (mcp/pyjwt[crypto] path) and remove the python_version<3.14 gate from the all extra so pdfminer-six on 3.14 cannot resolve a vulnerable transitive cryptography. --- poetry.lock | 6 +++--- pyproject.toml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/poetry.lock b/poetry.lock index 71f5230..5edd982 100644 --- a/poetry.lock +++ b/poetry.lock @@ -3983,7 +3983,7 @@ files = [ {file = "pycparser-2.22-py3-none-any.whl", hash = "sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc"}, {file = "pycparser-2.22.tar.gz", hash = "sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6"}, ] -markers = {main = "(extra == \"openai\" or extra == \"all\" or extra == \"crewai\") and implementation_name != \"PyPy\" and platform_python_implementation != \"PyPy\" or (extra == \"langchain\" or extra == \"all\") and implementation_name != \"PyPy\" and platform_python_implementation == \"PyPy\" or (extra == \"langchain\" or extra == \"all\") and implementation_name != \"PyPy\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")", test = "platform_python_implementation == \"PyPy\" and implementation_name != \"PyPy\""} +markers = {main = "(python_version <= \"3.13\" or extra == \"langchain\" or extra == \"all\" or extra == \"openai\" or extra == \"crewai\") and (platform_python_implementation != \"PyPy\" or extra == \"langchain\" or extra == \"all\") and implementation_name != \"PyPy\" and (extra == \"langchain\" or extra == \"all\" or extra == \"crewai\" or extra == \"openai\") and (platform_python_implementation == \"PyPy\" or python_version <= \"3.13\" or extra == \"openai\" or extra == \"all\" or extra == \"crewai\") and (platform_python_implementation == \"PyPy\" or extra == \"crewai\" or extra == \"all\" or extra == \"openai\")", test = "platform_python_implementation == \"PyPy\" and implementation_name != \"PyPy\""} [[package]] name = "pydantic" @@ -6514,9 +6514,9 @@ all = ["aiohttp", "crewai", "cryptography", "langchain", "langchain-core", "lang crewai = ["aiohttp", "crewai", "cryptography", "litellm", "mcp", "pdfminer-six", "uv"] langchain = ["langchain", "langchain-core", "langsmith"] middleware = ["starlette"] -openai = ["mcp", "openai", "openai-agents", "packaging"] +openai = ["cryptography", "mcp", "openai", "openai-agents", "packaging"] [metadata] lock-version = "2.1" python-versions = "^3.11,<3.15" -content-hash = "1bb611e381c7146409bed26fba0f5b70830753e476818d7b77c0ad8831e3bbfc" +content-hash = "5472c5c6216450621d5aae8e3dbdb21a3a071c4c2e3fb383f3552b4dc365d63c" diff --git a/pyproject.toml b/pyproject.toml index 5ca0c30..2aaa102 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -27,10 +27,10 @@ packages = [ [project.optional-dependencies] langchain = ["langchain-core", "langchain", "langsmith (>=0.8.0)"] -openai = ["openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "mcp (>=1.27.2,<2)"] +openai = ["openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "cryptography (>=50.0.0)", "mcp (>=1.27.2,<2)"] crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'", "aiohttp (>=3.14.1,<4); python_version < '3.14'", "cryptography (>=50.0.0)", "mcp (>=1.27.2,<2)", "pdfminer-six (>=20251107)"] middleware = ["starlette"] -all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'", "aiohttp (>=3.14.1,<4); python_version < '3.14'", "cryptography (>=50.0.0); python_version < '3.14'", "mcp (>=1.27.2,<2)", "pdfminer-six (>=20251107)"] +all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'", "aiohttp (>=3.14.1,<4); python_version < '3.14'", "cryptography (>=50.0.0)", "mcp (>=1.27.2,<2)", "pdfminer-six (>=20251107)"] From f47b46bd55f5fcc599e563070c561a4a78ccaa4d Mon Sep 17 00:00:00 2001 From: shuningc Date: Wed, 12 Aug 2026 10:37:00 -0700 Subject: [PATCH 6/7] Update pyproject.toml --- pyproject.toml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pyproject.toml b/pyproject.toml index 2aaa102..50a05cc 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -61,7 +61,17 @@ opentelemetry-exporter-otlp-proto-http = "^1.38.0" filelock = ">=3.20.1" idna = ">=3.15,<4" python-dotenv = ">=1.2.2" +filelock = ">=3.20.1" +idna = ">=3.15,<4" +python-dotenv = ">=1.2.2" +requests = ">=2.33.0" +# Security floor only (VULN-106433 / CVE-2026-69247): not imported directly under src/; +# pulled in transitively via pdfminer-six (crewai/all) and mcp -> pyjwt[crypto] (openai). +# Do not remove as "unused". cryptography = { version = ">=50.0.0", optional = true } +uv = { version = ">=0.9.6", optional = true, python = ">=3.11,<3.14" } +mcp = { version = ">=1.27.2,<2", optional = true } +pdfminer-six = { version = ">=20251107", optional = true } requests = ">=2.33.0" uv = { version = ">=0.9.6", optional = true, python = ">=3.11,<3.14" } mcp = { version = ">=1.27.2,<2", optional = true } From 5ed67e6b17ce4a45b217ab56034acb266df6c78d Mon Sep 17 00:00:00 2001 From: shuningc Date: Wed, 12 Aug 2026 10:39:19 -0700 Subject: [PATCH 7/7] fix(VULN-106433): dedupe pyproject.toml and refresh poetry.lock Remove duplicate dependency keys introduced by an applied suggested change (filelock, idna, python-dotenv, requests, uv, mcp, pdfminer-six) and rerun poetry lock so CI can parse pyproject.toml again. --- pyproject.toml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 50a05cc..c9e1aa6 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -61,9 +61,6 @@ opentelemetry-exporter-otlp-proto-http = "^1.38.0" filelock = ">=3.20.1" idna = ">=3.15,<4" python-dotenv = ">=1.2.2" -filelock = ">=3.20.1" -idna = ">=3.15,<4" -python-dotenv = ">=1.2.2" requests = ">=2.33.0" # Security floor only (VULN-106433 / CVE-2026-69247): not imported directly under src/; # pulled in transitively via pdfminer-six (crewai/all) and mcp -> pyjwt[crypto] (openai). @@ -72,10 +69,6 @@ cryptography = { version = ">=50.0.0", optional = true } uv = { version = ">=0.9.6", optional = true, python = ">=3.11,<3.14" } mcp = { version = ">=1.27.2,<2", optional = true } pdfminer-six = { version = ">=20251107", optional = true } -requests = ">=2.33.0" -uv = { version = ">=0.9.6", optional = true, python = ">=3.11,<3.14" } -mcp = { version = ">=1.27.2,<2", optional = true } -pdfminer-six = { version = ">=20251107", optional = true } [tool.poetry.group.test.dependencies] pytest = ">=9.0.3"