Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump cryptography from 36.0.2 to 39.0.1 in /scripts/tools/telink #24912

Merged

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 8, 2023

Bumps cryptography from 36.0.2 to 39.0.1.

Changelog

Sourced from cryptography's changelog.

39.0.1 - 2023-02-07


* **SECURITY ISSUE** - Fixed a bug where ``Cipher.update_into`` accepted Python
  buffer protocol objects, but allowed immutable buffers. **CVE-2023-23931**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.0.8.

.. _v39-0-0:

39.0.0 - 2023-01-01

  • BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.0 has been removed. Users on older version of OpenSSL will need to upgrade.
  • BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL < 3.5. The new minimum LibreSSL version is 3.5.0. Going forward our policy is to support versions of LibreSSL that are available in versions of OpenBSD that are still receiving security support.
  • BACKWARDS INCOMPATIBLE: Removed the encode_point and from_encoded_point methods on :class:~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicNumbers, which had been deprecated for several years. :meth:~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.public_bytes and :meth:~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.from_encoded_point should be used instead.
  • BACKWARDS INCOMPATIBLE: Support for using MD5 or SHA1 in :class:~cryptography.x509.CertificateBuilder, other X.509 builders, and PKCS7 has been removed.
  • BACKWARDS INCOMPATIBLE: Dropped support for macOS 10.10 and 10.11, macOS users must upgrade to 10.12 or newer.
  • ANNOUNCEMENT: The next version of cryptography (40.0) will change the way we link OpenSSL. This will only impact users who build cryptography from source (i.e., not from a wheel), and specify their own version of OpenSSL. For those users, the CFLAGS, LDFLAGS, INCLUDE, LIB, and CRYPTOGRAPHY_SUPPRESS_LINK_FLAGS environment variables will no longer be respected. Instead, users will need to configure their builds as documented here_.
  • Added support for :ref:disabling the legacy provider in OpenSSL 3.0.x<legacy-provider>.
  • Added support for disabling RSA key validation checks when loading RSA keys via :func:~cryptography.hazmat.primitives.serialization.load_pem_private_key, :func:~cryptography.hazmat.primitives.serialization.load_der_private_key, and :meth:~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateNumbers.private_key. This speeds up key loading but is :term:unsafe if you are loading potentially attacker supplied keys.
  • Significantly improved performance for :class:~cryptography.hazmat.primitives.ciphers.aead.ChaCha20Poly1305

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [cryptography](https://github.com/pyca/cryptography) from 36.0.2 to 39.0.1.
- [Release notes](https://github.com/pyca/cryptography/releases)
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@36.0.2...39.0.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Copy link

github-actions bot commented Feb 8, 2023

PR #24912: Size comparison from 2e0737c to 2eb47c8

Increases (4 builds for bl602, bl702, qpg)
platform target config section 2e0737c 2eb47c8 change % change
bl602 lighting-app bl602 .text 1023094 1023096 2 0.0
bl602+rpc .text 1054028 1054030 2 0.0
bl702 lighting-app bl702 .debug_info 40468475 40468476 1 0.0
.text 952210 952212 2 0.0
qpg lighting-app qpg6105+debug (read/write) 1148528 1148536 8 0.0
.text 595628 595636 8 0.0
Decreases (2 builds for bl702, esp32)
platform target config section 2e0737c 2eb47c8 change % change
bl702 lighting-app bl702+rpc .debug_info 44869670 44869669 -1 -0.0
.text 1029406 1029404 -2 -0.0
esp32 all-clusters-app c3devkit (read only) 1047438 1047436 -2 -0.0
.flash.text 1047438 1047436 -2 -0.0
Full report (19 builds for bl602, bl702, efr32, esp32, k32w, mbed, nrfconnect, qpg)
platform target config section 2e0737c 2eb47c8 change % change
bl602 lighting-app bl602 (read/write) 1346338 1346338 0 0.0
.bss 94794 94794 0 0.0
.data 9736 9736 0 0.0
.text 1023094 1023096 2 0.0
bl602+rpc (read/write) 1391778 1391778 0 0.0
.bss 102842 102842 0 0.0
.data 10128 10128 0 0.0
.text 1054028 1054030 2 0.0
bl702 lighting-app bl702 (read only) 3358 3358 0 0.0
(read/write) 1184411 1184411 0 0.0
.bleromro 6342 6342 0 0.0
.bleromrw 124 124 0 0.0
.boot2 292 292 0 0.0
.bss 69905 69905 0 0.0
.bss_psram 30048 30048 0 0.0
.comment 48 48 0 0.0
.data 4056 4056 0 0.0
.debug_abbrev 1550344 1550344 0 0.0
.debug_aranges 134176 134176 0 0.0
.debug_frame 491408 491408 0 0.0
.debug_info 40468475 40468476 1 0.0
.debug_line 5272207 5272207 0 0.0
.debug_loc 3409212 3409212 0 0.0
.debug_ranges 371736 371736 0 0.0
.debug_str 3535897 3535897 0 0.0
.hbn 536 536 0 0.0
.hbn_noinit 260 260 0 0.0
.init 342 342 0 0.0
.init_array 144 144 0 0.0
.psram 0 0 0 0.0
.riscv.attributes 47 47 0 0.0
.rodata 107104 107104 0 0.0
.rsvd 2960 2960 0 0.0
.sha_ocram 72 72 0 0.0
.shstrtab 304 304 0 0.0
.stack 2048 2048 0 0.0
.strtab 572338 572338 0 0.0
.symtab 173376 173376 0 0.0
.tcm_data 36 36 0 0.0
.tcmcode 3358 3358 0 0.0
.text 0 0 0 0.0
952210 952212 2 0.0
bl702+rpc (read only) 3358 3358 0 0.0
(read/write) 1277295 1277295 0 0.0
.bleromro 6342 6342 0 0.0
.bleromrw 124 124 0 0.0
.boot2 292 292 0 0.0
.bss 77953 77953 0 0.0
.bss_psram 30304 30304 0 0.0
.comment 48 48 0 0.0
.data 4608 4608 0 0.0
.debug_abbrev 1698758 1698758 0 0.0
.debug_aranges 142408 142408 0 0.0
.debug_frame 519152 519152 0 0.0
.debug_info 44869670 44869669 -1 -0.0
.debug_line 5670914 5670914 0 0.0
.debug_loc 3605957 3605957 0 0.0
.debug_ranges 395504 395504 0 0.0
.debug_str 3939261 3939261 0 0.0
.hbn 536 536 0 0.0
.hbn_noinit 260 260 0 0.0
.init 342 342 0 0.0
.init_array 160 160 0 0.0
.psram 0 0 0 0.0
.riscv.attributes 47 47 0 0.0
.rodata 121680 121680 0 0.0
.rsvd 2960 2960 0 0.0
.sha_ocram 72 72 0 0.0
.shstrtab 304 304 0 0.0
.stack 2048 2048 0 0.0
.strtab 633131 633131 0 0.0
.symtab 191792 191792 0 0.0
.tcm_data 36 36 0 0.0
.tcmcode 3358 3358 0 0.0
.text 0 0 0 0.0
1029406 1029404 -2 -0.0
efr32 lighting-app BRD4161A+rs911x (read/write) 1038448 1038448 0 0.0
.bss 181560 181560 0 0.0
.data 2044 2044 0 0.0
.text 854824 854824 0 0.0
BRD4187C (read/write) 1135000 1135000 0 0.0
.bss 133256 133256 0 0.0
.data 2532 2532 0 0.0
.text 974616 974616 0 0.0
lock-app BRD4161A+wf200 (read/write) 1066168 1066168 0 0.0
.bss 153088 153088 0 0.0
.data 2052 2052 0 0.0
.text 911004 911004 0 0.0
window-app BRD4187C (read/write) 1136600 1136600 0 0.0
.bss 134848 134848 0 0.0
.data 2572 2572 0 0.0
.text 974584 974584 0 0.0
esp32 all-clusters-app c3devkit (read only) 1047438 1047436 -2 -0.0
(read/write) 1519578 1519578 0 0.0
.dram0.bss 77960 77960 0 0.0
.dram0.data 13792 13792 0 0.0
.flash.rodata 221600 221600 0 0.0
.flash.text 1047438 1047436 -2 -0.0
.iram0.text 72896 72896 0 0.0
m5stack (read only) 1099879 1099879 0 0.0
(read/write) 501203 501203 0 0.0
.dram0.bss 83008 83008 0 0.0
.dram0.data 34080 34080 0 0.0
.flash.rodata 250344 250344 0 0.0
.flash.text 1094495 1094495 0 0.0
.iram0.text 124855 124855 0 0.0
k32w contact k32w0+release (read/write) 660124 660124 0 0.0
.bss 76560 76560 0 0.0
.data 2112 2112 0 0.0
.text 562340 562340 0 0.0
light k32w0+release (read/write) 672216 672216 0 0.0
.bss 74344 74344 0 0.0
.data 2064 2064 0 0.0
.text 593080 593080 0 0.0
lock k32w0+release (read/write) 631760 631760 0 0.0
.bss 75112 75112 0 0.0
.data 2084 2084 0 0.0
.text 551836 551836 0 0.0
mbed lock-app CY8CPROTO_062_4343W+release (read only) 6224 6224 0 0.0
(read/write) 2464392 2464392 0 0.0
.bss 215892 215892 0 0.0
.data 5880 5880 0 0.0
.text 1427036 1427036 0 0.0
nrfconnect all-clusters-app nrf52840dk_nrf52840 (read only) 4 4 0 0.0
(read/write) 1162268 1162268 0 0.0
bss 143531 143531 0 0.0
rodata 134376 134376 0 0.0
text 804468 804468 0 0.0
nrf7002dk_nrf5340_cpuapp (read only) 4 4 0 0.0
(read/write) 1367520 1367520 0 0.0
bss 105990 105990 0 0.0
rodata 211808 211808 0 0.0
text 764200 764200 0 0.0
all-clusters-minimal-app nrf52840dk_nrf52840 (read only) 4 4 0 0.0
(read/write) 1108272 1108272 0 0.0
bss 142687 142687 0 0.0
rodata 111356 111356 0 0.0
text 774464 774464 0 0.0
qpg lighting-app qpg6105+debug (read/write) 1148528 1148536 8 0.0
.bss 99876 99876 0 0.0
.data 848 848 0 0.0
.text 595628 595636 8 0.0
lock-app qpg6105+debug (read/write) 1116600 1116600 0 0.0
.bss 96396 96396 0 0.0
.data 860 860 0 0.0
.text 563696 563696 0 0.0

@yufengwangca yufengwangca merged commit 709dc0f into master Mar 18, 2023
@yufengwangca yufengwangca deleted the dependabot/pip/scripts/tools/telink/cryptography-39.0.1 branch March 18, 2023 16:37
lecndav pushed a commit to lecndav/connectedhomeip that referenced this pull request Mar 22, 2023
…ject-chip#24912)

Bumps [cryptography](https://github.com/pyca/cryptography) from 36.0.2 to 39.0.1.
- [Release notes](https://github.com/pyca/cryptography/releases)
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@36.0.2...39.0.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
external dependency Bugs that require changes in third party projects. python review - approved scripts
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants