From 407c9f84cf2cd40f50188e35b51db5d2128db35a Mon Sep 17 00:00:00 2001 From: maziggy Date: Sun, 22 Mar 2026 13:24:36 +0100 Subject: [PATCH] Bump pyOpenSSL and pyasn1 to fix 3 CVEs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pyOpenSSL 25.3.0 → 26.0.0 (CVE-2026-27448, CVE-2026-27459) pyasn1 0.6.2 → 0.6.3 (CVE-2026-30922) No breaking changes — Python 3.7 drop is irrelevant (we use 3.13), cryptography >=46.0.0 requirement already satisfied (we have 46.0.5), and we don't use set_tlsext_servername_callback (the behavioral change). --- CHANGELOG.md | 2 ++ requirements-dev.txt | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 455d5d03d..9b5e3c645 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -48,6 +48,8 @@ All notable changes to Bambuddy will be documented in this file. - **Reformatted AMS Drying Presets Table** ([#732](https://github.com/maziggy/bambuddy/issues/732)) — The drying presets table in Settings now groups columns by AMS type (AMS 2 Pro, AMS-HT) with inline °C and h unit labels next to each input, replacing the previous flat column layout. Requested by @cadtoolbox. ### Security +- **Bump pyOpenSSL 25.3.0 → 26.0.0** — Fixes CVE-2026-27448 (exception swallowing in TLS servername callback) and CVE-2026-27459 (buffer overflow in DTLS cookie callback). +- **Bump pyasn1 0.6.2 → 0.6.3** — Fixes CVE-2026-30922 (stack overflow from deeply nested ASN.1 structures). ## [0.2.2] - 2026-03-16 diff --git a/requirements-dev.txt b/requirements-dev.txt index 522e76236..de6a8e58b 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -8,7 +8,7 @@ httpx>=0.27.0 ruff>=0.8.0 # Required by pyftpdlib TLS_FTPHandler for mock FTP server tests -pyOpenSSL>=24.0.0 +pyOpenSSL>=26.0.0 # Security scanning bandit[sarif]>=1.7.0