Bump version to 2.11.3 by matthewcummings · Pull Request #397 · finos/symphony-bdk-python

matthewcummings · 2026-08-23T23:20:25Z

Summary

Bumps the version in pyproject.toml from 2.11.2 to 2.11.3 to prepare a patch release.

Context

The cryptography cap on the latest published release (v2.11.2) is ^46.0.0, which does not include the fix for CVE-2026-34180 (DoS via malformed ASN.1 input, patched in cryptography 48.0.1). Bots that depend on symphony-bdk-python cannot pin cryptography>=48.0.1 themselves because pip resolution fails against the transitive cap declared in BDK's own metadata.

The actual fix has already been merged to main via #390 — cryptography is now pinned to >=48.0.1,<49.0.0 and poetry.lock is regenerated accordingly. All that's missing to unblock downstream consumers is a published release cut from main.

This PR is just the version bump so that once merged, a maintainer can publish a GitHub Release tagged v2.11.3 and the existing release.yml workflow picks it up and pushes to PyPI.

Downstream impact

This unblocks CVE remediation on every downstream Symphony bot that depends on symphony-bdk-python — Symphony's InfoSec team is currently tracking the vulnerability across multiple bot deployments and the only unblock is a new release.

Test plan

Verified pyproject.toml version field is the only change.
After merge, a maintainer publishes a v2.11.3 GitHub Release from main.
release.yml fires, poetry publish --build pushes symphony_bdk_python-2.11.3 to PyPI.
Downstream bots pin symphony-bdk-python>=2.11.3 and verify pip install pulls cryptography 48.0.1.

Prepares a patch release so consumers can pull the cryptography>=48.0.1 constraint already merged to main via finos#390, closing CVE-2026-34180 on downstream Symphony bots that depend on symphony-bdk-python.

linux-foundation-easycla · 2026-08-23T23:20:33Z

The committers listed above are authorized under a signed CLA.

✅ login: matthewcummings / name: Matthew Cummings (e757da8)

The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. finos#397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed.

Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in finos#390 sat unreleased for five days because the version bump was a separate change (finos#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as finos#397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

* Raise cryptography ceiling to allow the patched 50.x The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. #397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed. * Bump version to 2.11.4 to prepare a patch release Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in #390 sat unreleased for five days because the version bump was a separate change (#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as #397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

matthewcummings · 2026-08-23T23:20:25Z

Summary

Bumps the version in pyproject.toml from 2.11.2 to 2.11.3 to prepare a patch release.

Context

The cryptography cap on the latest published release (v2.11.2) is ^46.0.0, which does not include the fix for CVE-2026-34180 (DoS via malformed ASN.1 input, patched in cryptography 48.0.1). Bots that depend on symphony-bdk-python cannot pin cryptography>=48.0.1 themselves because pip resolution fails against the transitive cap declared in BDK's own metadata.

The actual fix has already been merged to main via #390 — cryptography is now pinned to >=48.0.1,<49.0.0 and poetry.lock is regenerated accordingly. All that's missing to unblock downstream consumers is a published release cut from main.

This PR is just the version bump so that once merged, a maintainer can publish a GitHub Release tagged v2.11.3 and the existing release.yml workflow picks it up and pushes to PyPI.

Downstream impact

This unblocks CVE remediation on every downstream Symphony bot that depends on symphony-bdk-python — Symphony's InfoSec team is currently tracking the vulnerability across multiple bot deployments and the only unblock is a new release.

Test plan

Verified pyproject.toml version field is the only change.
After merge, a maintainer publishes a v2.11.3 GitHub Release from main.
release.yml fires, poetry publish --build pushes symphony_bdk_python-2.11.3 to PyPI.
Downstream bots pin symphony-bdk-python>=2.11.3 and verify pip install pulls cryptography 48.0.1.

Prepares a patch release so consumers can pull the cryptography>=48.0.1 constraint already merged to main via finos#390, closing CVE-2026-34180 on downstream Symphony bots that depend on symphony-bdk-python.

linux-foundation-easycla · 2026-08-23T23:20:33Z

The committers listed above are authorized under a signed CLA.

✅ login: matthewcummings / name: Matthew Cummings (e757da8)

The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. finos#397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed.

Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in finos#390 sat unreleased for five days because the version bump was a separate change (finos#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as finos#397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

* Raise cryptography ceiling to allow the patched 50.x The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. #397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed. * Bump version to 2.11.4 to prepare a patch release Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in #390 sat unreleased for five days because the version bump was a separate change (#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as #397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

matthewcummings · 2026-08-23T23:20:25Z

Summary

Bumps the version in pyproject.toml from 2.11.2 to 2.11.3 to prepare a patch release.

Context

The cryptography cap on the latest published release (v2.11.2) is ^46.0.0, which does not include the fix for CVE-2026-34180 (DoS via malformed ASN.1 input, patched in cryptography 48.0.1). Bots that depend on symphony-bdk-python cannot pin cryptography>=48.0.1 themselves because pip resolution fails against the transitive cap declared in BDK's own metadata.

The actual fix has already been merged to main via #390 — cryptography is now pinned to >=48.0.1,<49.0.0 and poetry.lock is regenerated accordingly. All that's missing to unblock downstream consumers is a published release cut from main.

This PR is just the version bump so that once merged, a maintainer can publish a GitHub Release tagged v2.11.3 and the existing release.yml workflow picks it up and pushes to PyPI.

Downstream impact

This unblocks CVE remediation on every downstream Symphony bot that depends on symphony-bdk-python — Symphony's InfoSec team is currently tracking the vulnerability across multiple bot deployments and the only unblock is a new release.

Test plan

Verified pyproject.toml version field is the only change.
After merge, a maintainer publishes a v2.11.3 GitHub Release from main.
release.yml fires, poetry publish --build pushes symphony_bdk_python-2.11.3 to PyPI.
Downstream bots pin symphony-bdk-python>=2.11.3 and verify pip install pulls cryptography 48.0.1.

Prepares a patch release so consumers can pull the cryptography>=48.0.1 constraint already merged to main via finos#390, closing CVE-2026-34180 on downstream Symphony bots that depend on symphony-bdk-python.

linux-foundation-easycla · 2026-08-23T23:20:33Z

The committers listed above are authorized under a signed CLA.

✅ login: matthewcummings / name: Matthew Cummings (e757da8)

The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. finos#397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed.

Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in finos#390 sat unreleased for five days because the version bump was a separate change (finos#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as finos#397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

* Raise cryptography ceiling to allow the patched 50.x The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. #397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed. * Bump version to 2.11.4 to prepare a patch release Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in #390 sat unreleased for five days because the version bump was a separate change (#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as #397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

matthewcummings · 2026-08-23T23:20:25Z

Summary

Bumps the version in pyproject.toml from 2.11.2 to 2.11.3 to prepare a patch release.

Context

The cryptography cap on the latest published release (v2.11.2) is ^46.0.0, which does not include the fix for CVE-2026-34180 (DoS via malformed ASN.1 input, patched in cryptography 48.0.1). Bots that depend on symphony-bdk-python cannot pin cryptography>=48.0.1 themselves because pip resolution fails against the transitive cap declared in BDK's own metadata.

The actual fix has already been merged to main via #390 — cryptography is now pinned to >=48.0.1,<49.0.0 and poetry.lock is regenerated accordingly. All that's missing to unblock downstream consumers is a published release cut from main.

This PR is just the version bump so that once merged, a maintainer can publish a GitHub Release tagged v2.11.3 and the existing release.yml workflow picks it up and pushes to PyPI.

Downstream impact

This unblocks CVE remediation on every downstream Symphony bot that depends on symphony-bdk-python — Symphony's InfoSec team is currently tracking the vulnerability across multiple bot deployments and the only unblock is a new release.

Test plan

Verified pyproject.toml version field is the only change.
After merge, a maintainer publishes a v2.11.3 GitHub Release from main.
release.yml fires, poetry publish --build pushes symphony_bdk_python-2.11.3 to PyPI.
Downstream bots pin symphony-bdk-python>=2.11.3 and verify pip install pulls cryptography 48.0.1.

Prepares a patch release so consumers can pull the cryptography>=48.0.1 constraint already merged to main via finos#390, closing CVE-2026-34180 on downstream Symphony bots that depend on symphony-bdk-python.

linux-foundation-easycla · 2026-08-23T23:20:33Z

The committers listed above are authorized under a signed CLA.

✅ login: matthewcummings / name: Matthew Cummings (e757da8)

The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. finos#397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed.

Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in finos#390 sat unreleased for five days because the version bump was a separate change (finos#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as finos#397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

* Raise cryptography ceiling to allow the patched 50.x The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. #397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed. * Bump version to 2.11.4 to prepare a patch release Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in #390 sat unreleased for five days because the version bump was a separate change (#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as #397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

matthewcummings · 2026-08-23T23:20:25Z

Summary

Bumps the version in pyproject.toml from 2.11.2 to 2.11.3 to prepare a patch release.

Context

The cryptography cap on the latest published release (v2.11.2) is ^46.0.0, which does not include the fix for CVE-2026-34180 (DoS via malformed ASN.1 input, patched in cryptography 48.0.1). Bots that depend on symphony-bdk-python cannot pin cryptography>=48.0.1 themselves because pip resolution fails against the transitive cap declared in BDK's own metadata.

The actual fix has already been merged to main via #390 — cryptography is now pinned to >=48.0.1,<49.0.0 and poetry.lock is regenerated accordingly. All that's missing to unblock downstream consumers is a published release cut from main.

This PR is just the version bump so that once merged, a maintainer can publish a GitHub Release tagged v2.11.3 and the existing release.yml workflow picks it up and pushes to PyPI.

Downstream impact

This unblocks CVE remediation on every downstream Symphony bot that depends on symphony-bdk-python — Symphony's InfoSec team is currently tracking the vulnerability across multiple bot deployments and the only unblock is a new release.

Test plan

Verified pyproject.toml version field is the only change.
After merge, a maintainer publishes a v2.11.3 GitHub Release from main.
release.yml fires, poetry publish --build pushes symphony_bdk_python-2.11.3 to PyPI.
Downstream bots pin symphony-bdk-python>=2.11.3 and verify pip install pulls cryptography 48.0.1.

Prepares a patch release so consumers can pull the cryptography>=48.0.1 constraint already merged to main via finos#390, closing CVE-2026-34180 on downstream Symphony bots that depend on symphony-bdk-python.

linux-foundation-easycla · 2026-08-23T23:20:33Z

The committers listed above are authorized under a signed CLA.

✅ login: matthewcummings / name: Matthew Cummings (e757da8)

The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. finos#397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed.

Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in finos#390 sat unreleased for five days because the version bump was a separate change (finos#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as finos#397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

* Raise cryptography ceiling to allow the patched 50.x The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. #397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed. * Bump version to 2.11.4 to prepare a patch release Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in #390 sat unreleased for five days because the version bump was a separate change (#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as #397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

matthewcummings · 2026-08-23T23:20:25Z

Summary

Bumps the version in pyproject.toml from 2.11.2 to 2.11.3 to prepare a patch release.

Context

The cryptography cap on the latest published release (v2.11.2) is ^46.0.0, which does not include the fix for CVE-2026-34180 (DoS via malformed ASN.1 input, patched in cryptography 48.0.1). Bots that depend on symphony-bdk-python cannot pin cryptography>=48.0.1 themselves because pip resolution fails against the transitive cap declared in BDK's own metadata.

The actual fix has already been merged to main via #390 — cryptography is now pinned to >=48.0.1,<49.0.0 and poetry.lock is regenerated accordingly. All that's missing to unblock downstream consumers is a published release cut from main.

This PR is just the version bump so that once merged, a maintainer can publish a GitHub Release tagged v2.11.3 and the existing release.yml workflow picks it up and pushes to PyPI.

Downstream impact

This unblocks CVE remediation on every downstream Symphony bot that depends on symphony-bdk-python — Symphony's InfoSec team is currently tracking the vulnerability across multiple bot deployments and the only unblock is a new release.

Test plan

Verified pyproject.toml version field is the only change.
After merge, a maintainer publishes a v2.11.3 GitHub Release from main.
release.yml fires, poetry publish --build pushes symphony_bdk_python-2.11.3 to PyPI.
Downstream bots pin symphony-bdk-python>=2.11.3 and verify pip install pulls cryptography 48.0.1.

Prepares a patch release so consumers can pull the cryptography>=48.0.1 constraint already merged to main via finos#390, closing CVE-2026-34180 on downstream Symphony bots that depend on symphony-bdk-python.

linux-foundation-easycla · 2026-08-23T23:20:33Z

The committers listed above are authorized under a signed CLA.

✅ login: matthewcummings / name: Matthew Cummings (e757da8)

The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. finos#397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed.

Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in finos#390 sat unreleased for five days because the version bump was a separate change (finos#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as finos#397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

* Raise cryptography ceiling to allow the patched 50.x The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. #397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed. * Bump version to 2.11.4 to prepare a patch release Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in #390 sat unreleased for five days because the version bump was a separate change (#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as #397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

matthewcummings · 2026-08-23T23:20:25Z

Summary

Bumps the version in pyproject.toml from 2.11.2 to 2.11.3 to prepare a patch release.

Context

The cryptography cap on the latest published release (v2.11.2) is ^46.0.0, which does not include the fix for CVE-2026-34180 (DoS via malformed ASN.1 input, patched in cryptography 48.0.1). Bots that depend on symphony-bdk-python cannot pin cryptography>=48.0.1 themselves because pip resolution fails against the transitive cap declared in BDK's own metadata.

The actual fix has already been merged to main via #390 — cryptography is now pinned to >=48.0.1,<49.0.0 and poetry.lock is regenerated accordingly. All that's missing to unblock downstream consumers is a published release cut from main.

This PR is just the version bump so that once merged, a maintainer can publish a GitHub Release tagged v2.11.3 and the existing release.yml workflow picks it up and pushes to PyPI.

Downstream impact

This unblocks CVE remediation on every downstream Symphony bot that depends on symphony-bdk-python — Symphony's InfoSec team is currently tracking the vulnerability across multiple bot deployments and the only unblock is a new release.

Test plan

Verified pyproject.toml version field is the only change.
After merge, a maintainer publishes a v2.11.3 GitHub Release from main.
release.yml fires, poetry publish --build pushes symphony_bdk_python-2.11.3 to PyPI.
Downstream bots pin symphony-bdk-python>=2.11.3 and verify pip install pulls cryptography 48.0.1.

Prepares a patch release so consumers can pull the cryptography>=48.0.1 constraint already merged to main via finos#390, closing CVE-2026-34180 on downstream Symphony bots that depend on symphony-bdk-python.

linux-foundation-easycla · 2026-08-23T23:20:33Z

The committers listed above are authorized under a signed CLA.

✅ login: matthewcummings / name: Matthew Cummings (e757da8)

The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. finos#397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed.

Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in finos#390 sat unreleased for five days because the version bump was a separate change (finos#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as finos#397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

* Raise cryptography ceiling to allow the patched 50.x The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. #397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed. * Bump version to 2.11.4 to prepare a patch release Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in #390 sat unreleased for five days because the version bump was a separate change (#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as #397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

matthewcummings · 2026-08-23T23:20:25Z

Summary

Bumps the version in pyproject.toml from 2.11.2 to 2.11.3 to prepare a patch release.

Context

The cryptography cap on the latest published release (v2.11.2) is ^46.0.0, which does not include the fix for CVE-2026-34180 (DoS via malformed ASN.1 input, patched in cryptography 48.0.1). Bots that depend on symphony-bdk-python cannot pin cryptography>=48.0.1 themselves because pip resolution fails against the transitive cap declared in BDK's own metadata.

The actual fix has already been merged to main via #390 — cryptography is now pinned to >=48.0.1,<49.0.0 and poetry.lock is regenerated accordingly. All that's missing to unblock downstream consumers is a published release cut from main.

This PR is just the version bump so that once merged, a maintainer can publish a GitHub Release tagged v2.11.3 and the existing release.yml workflow picks it up and pushes to PyPI.

Downstream impact

This unblocks CVE remediation on every downstream Symphony bot that depends on symphony-bdk-python — Symphony's InfoSec team is currently tracking the vulnerability across multiple bot deployments and the only unblock is a new release.

Test plan

Verified pyproject.toml version field is the only change.
After merge, a maintainer publishes a v2.11.3 GitHub Release from main.
release.yml fires, poetry publish --build pushes symphony_bdk_python-2.11.3 to PyPI.
Downstream bots pin symphony-bdk-python>=2.11.3 and verify pip install pulls cryptography 48.0.1.

Prepares a patch release so consumers can pull the cryptography>=48.0.1 constraint already merged to main via finos#390, closing CVE-2026-34180 on downstream Symphony bots that depend on symphony-bdk-python.

linux-foundation-easycla · 2026-08-23T23:20:33Z

The committers listed above are authorized under a signed CLA.

✅ login: matthewcummings / name: Matthew Cummings (e757da8)

The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. finos#397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed.

Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in finos#390 sat unreleased for five days because the version bump was a separate change (finos#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as finos#397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

* Raise cryptography ceiling to allow the patched 50.x The current constraint, cryptography>=48.0.1,<49.0.0, cannot resolve to a version free of known CVEs: 48.0.1 CVE-2026-69247 and CVE-2026-69249 49.0.0 CVE-2026-69247 50.0.x clean Both CVEs were published 2026-08-03, before 2.11.3 was released, so every version the released constraint permits is affected. Downstream consumers cannot work around this: anything satisfying the BDK is vulnerable, and anything patched fails resolution. It surfaces as a hard failure in image compliance scanning. This is the second time in eight days the ceiling has blocked a security fix. #397 raised it from <47.0.0 to <49.0.0 for CVE-2026-34180, and it is already stale again. Verified: the full test suite passes on the new lock and identically on the old pin, so this is not masking a regression. cryptography 48.0.1 560 passed, 3 skipped cryptography 50.0.0 560 passed, 3 skipped cryptography 50.0.1 560 passed, 3 skipped (the locked version) poetry.lock regenerated with Poetry 2.4.2; cryptography 48.0.1 to 50.0.1 is the only package change, none added or removed. * Bump version to 2.11.4 to prepare a patch release Included here so merging this PR leaves main release-ready, rather than needing a second PR before the fix can reach consumers. The constraint fix in #390 sat unreleased for five days because the version bump was a separate change (#397). The CVEs this PR addresses are live in the released 2.11.3, so the gap matters. Follows the same convention as #397: pyproject.toml only. The lock is unaffected, project version is not part of its content hash.

Bump version to 2.11.3
e757da8
Prepares a patch release so consumers can pull the cryptography>=48.0.1 constraint already merged to main via finos#390, closing CVE-2026-34180 on downstream Symphony bots that depend on symphony-bdk-python.

thibauult approved these changes Aug 26, 2026
View reviewed changes

thibauult merged commit 57aef93 into finos:mainAug 26, 2026
21 checks passed

matthewcummings mentioned this pull request Aug 30, 2026
Raise cryptography ceiling to allow the patched 50.x #399
Merged