fix(anonymizer): bump cryptography to >=50.0.0 for GHSA-g6cj-pr64-35w5 - #2231
Conversation
GHSA-g6cj-pr64-35w5 (CVE-2026-69247) affects cryptography >=44.0.0,<50.0.0 and is first patched in 50.0.0. The <49.0.0 ceiling made presidio-anonymizer and the patched release mutually exclusive, so downstream projects could not take the fix without dropping presidio-anonymizer. Same shape as data-privacy-stack#2143, resolved by data-privacy-stack#2144. Fixes: data-privacy-stack#2229
There was a problem hiding this comment.
🟡 Changes recommended
The PR introduces uv lockfile drift and includes a per-PR CHANGELOG edit which conflicts with documented repository contribution rules.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates presidio-anonymizer’s cryptography dependency range to allow installing the first patched release for GHSA-g6cj-pr64-35w5 / CVE-2026-69247, preventing downstream resolution failures caused by an upper bound that excludes cryptography==50.0.0.
Changes:
- Bump
cryptographyconstraint to>=50.0.0,<51.0.0inpresidio-anonymizer. - Add a
CHANGELOG.mdentry describing the security-driven dependency bump.
File summaries
| File | Description |
|---|---|
| presidio-anonymizer/pyproject.toml | Raises cryptography allowed range to include the patched 50.x line. |
| CHANGELOG.md | Adds a release note for the dependency bump (but repo guidance forbids per-PR changelog edits). |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Regenerate the lock with uv 0.11.6 for cryptography 50.0.1 while preserving the >=50.0.0,<51.0.0 constraint and all other package versions. Canonicalize mirror artifact locations against authoritative public metadata and retain the resolved exceptiongroup typing-extensions marker. Remove only the PR-added changelog entry, preserving upstream release notes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 827bfc85-5ab8-4ca3-b15c-21a897b0c0dd
There was a problem hiding this comment.
🟢 Approval recommended
The change is a straightforward dependency-range bump with a consistent lockfile update and no code-path or API modifications introduced.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
Change Description
presidio-anonymizerpreviously declaredcryptography (>=48.0.1,<49.0.0). GHSA-g6cj-pr64-35w5 / CVE-2026-69247 affectscryptography >=44.0.0,<50.0.0and is first patched in50.0.0, so the<49.0.0ceiling and the patched release are mutually exclusive — downstream projects cannot take the fix without droppingpresidio-anonymizer, and Dependabot resolution fails outright rather than opening a fix PR.Bumps the constraint to
cryptography (>=50.0.0,<51.0.0), same shape as #2143 → #2144 which moved the floor for GHSA-537c-gmf6-5ccf. Public APIs and anonymization behavior are unchanged; the supported cryptography dependency range changes as described above.Regenerates
presidio-anonymizer/uv.lockwith the CI-pinned uv 0.11.6, selectingcryptography==50.0.1. All other package versions are retained. Resolution also refreshes the existingexceptiongroup==1.3.1dependency metadata sotyping-extensionsis conditional on Python <3.13, matching its published metadata. The public lock retains public PyPI artifact locations: mirror-generated artifacts were matched by filename and SHA256 against authoritative release metadata, and the complete resolved graph was compared before canonicalization.The final PR changes only the anonymizer
pyproject.tomlanduv.lock. The per-PR changelog entry was removed in accordance with CONTRIBUTING.md; upstream entries are preserved.Validation
Using Python 3.14.4 and
cryptography==50.0.1:uv sync --locked --all-extras --group devsucceeded using an approved package mirror.uv lock --checkanduv sync --locked --all-extras --group devwith explicit public-index configuration and offline mode, reusing that installed environment.GitHub workflow approval is separate from these local results; no workflows were approved or represented as passing.
Issue reference
Fixes #2229
Checklist