Skip to content

deps(mcp): bump cryptography to 50.0.1 - #8467

Open
matthewelwell wants to merge 1 commit into
mainfrom
fix/mcp-cryptography-bump
Open

deps(mcp): bump cryptography to 50.0.1#8467
matthewelwell wants to merge 1 commit into
mainfrom
fix/mcp-cryptography-bump

Conversation

@matthewelwell

@matthewelwell matthewelwell commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

mcp/uv.lock pins cryptography 48.0.0, in range for three HIGH advisories. #8433 bumped api/uv.lock but only touched api/ — cryptography resolves independently per lock file, so mcp/ stayed two majors behind.

Item Context
Change cryptography 48.0.0 → 50.0.1, mcp/uv.lock only
Advisories GHSA-537c-gmf6-5ccf (< 48.0.1), CVE-2026-69249 (<= 48.0.0), CVE-2026-69247 (< 50.0.0) — all HIGH
Why unnoticed here Dependabot alerts were disabled on this repo and Vanta has never scanned it, so nothing reported it upstream. It surfaced via flagsmith-ee, which shares this lock file and does have alerting. Alerts have since been re-enabled
Why Renovate missed it cryptography is transitive here (via fastmcp, flagsmith-common), and Renovate only raises security PRs for manifest-declared packages. #8466 addresses that gap generally
Resolution uv lock --upgrade-package cryptography — no constraint to relax
Blast radius One package, one file; 114 → 114 packages, nothing else moved
Tests make test in mcp/ — 51 passed, 100% coverage

Supersedes the equivalent change I raised against flagsmith-ee; landing it here means it flows down on the next release merge instead of diverging the shared lock file.

@matthewelwell @claude
fix(mcp): bump cryptography to 50.0.1
5a21efc 
mcp/uv.lock pins cryptography 48.0.0, which is in range for three HIGH
advisories:

  - GHSA-537c-gmf6-5ccf (>= 0.5.0 < 48.0.1) - statically linked OpenSSL
  - CVE-2026-69249      (<= 48.0.0)
  - CVE-2026-69247      (>= 44.0.0 < 50.0.0)

api/uv.lock was bumped in #8433, but that PR only touched api/. cryptography
resolves independently in each lock file, so mcp/ stayed two majors behind.

It went unnoticed here because Dependabot alerts were disabled on this
repository and Vanta has never scanned it, so nothing reported the finding
upstream. It surfaced only via flagsmith-ee, which shares this lock file and
does have alerting enabled. Alerts have since been re-enabled here.

Renovate did not raise it either: cryptography is purely transitive in mcp/
(via fastmcp and flagsmith-common), and Renovate only raises security PRs for
packages declared in a manifest. #8466 addresses that gap generally.

Being transitive means there is no constraint to relax:
`uv lock --upgrade-package cryptography` resolves it in isolation. No other
package version changed (114 -> 114). `make test` in mcp/ passes, 51 tests at
100% coverage.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@vercel

vercel Bot commented Sep 4, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments
Project Deployment Actions Updated
docs Ignored Ignored Sep 4, 2026 2:28pm UTC
flagsmith-frontend-preview Ignored Ignored Sep 4, 2026 2:28pm UTC
flagsmith-frontend-staging Ignored Ignored Sep 4, 2026 2:28pm UTC

Request Review

@coderabbitai

coderabbitai Bot commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)
  • mcp/uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: c906c2f9-70db-4995-9c4c-c416cbd10752

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added the fix label Sep 4, 2026
@matthewelwell matthewelwell changed the title fix(mcp): bump cryptography to 50.0.1 deps(mcp): bump cryptography to 50.0.1 Sep 4, 2026
@matthewelwell
matthewelwell marked this pull request as ready for review September 4, 2026 14:35
@matthewelwell
matthewelwell requested a review from a team as a code owner September 4, 2026 14:35
@matthewelwell
matthewelwell requested review from emyller and removed request for a team September 4, 2026 14:36
@github-actions github-actions Bot added dependencies Pull requests that update a dependency file and removed fix labels Sep 4, 2026
@github-actions

github-actions Bot commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Docker builds report

Image Build Status Security report
ghcr.io/flagsmith/flagsmith-api-test:pr-8467 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-frontend:pr-8467 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith-e2e:pr-8467 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-api:pr-8467 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith:pr-8467 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-8467 Finished ✅ Results ✅

@github-actions

github-actions Bot commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor
✅ private-cloud · depot-ubuntu-latest-arm-16 — run #20183 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  3 passed

Details

stats  3 tests across 3 suites
duration  39.1 seconds
commit  5a21efc
info  🔄 Run: #20183 (attempt 1)

🗂️ Previous results
✅ private-cloud · depot-ubuntu-latest-16 — run #20183 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  3 passed

Details

stats  3 tests across 3 suites
duration  49.5 seconds
commit  5a21efc
info  🔄 Run: #20183 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #20183 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  43.8 seconds
commit  5a21efc
info  🔄 Run: #20183 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #20183 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  33.8 seconds
commit  5a21efc
info  🔄 Run: #20183 (attempt 1)

@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Visual Regression

19 screenshots compared. See report for details.
View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@emyller emyller Awaiting requested review from emyller emyller is a code owner automatically assigned from Flagsmith/flagsmith-back-end

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@matthewelwell