From e956a6e381f55b934e1d434ca186ecaff01983f1 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Sun, 6 Sep 2026 16:04:30 -0700 Subject: [PATCH] fix(deps): raise the cryptography floor past PYSEC-2026-3552 embodied-action-receipts floored cryptography at >=42.0.8. PYSEC-2026-3552 is a Bleichenbacher oracle: PKCS#7 EnvelopedData decryption exposes distinguishable errors. Fixed in 50.0.0, which cmcp already requires, so this brings the example in line with the runtime it demonstrates rather than ahead of it. A floor raise, not a pin. pip already resolves higher today; what this removes is a resolution that could legally pick a vulnerable version in an example whose subject is cryptographic receipts. demos vendors this directory as a submodule, so it follows from here. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t --- embodied-action-receipts/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/embodied-action-receipts/requirements.txt b/embodied-action-receipts/requirements.txt index 7163694..8bf0dcd 100644 --- a/embodied-action-receipts/requirements.txt +++ b/embodied-action-receipts/requirements.txt @@ -1,2 +1,2 @@ -cryptography>=42.0.8 +cryptography>=50.0.0