Summary

Update cryptography and bleach dependencies.

Review Request #15127 — Created June 22, 2026 and submitted June 22, 2026, 3:22 p.m.

Information

Owner

david

Repository

Review Board

Branch

release-7.x

Bugs

Depends On

Reviewers

Groups

reviewboard

People

Description

This change bumps two of our dependencies to account for some pip-audit

flags:
cryptography has been updated to 49.0 (on Python versions that support

it), and pyOpenSSL updated to match. There's a log warning that the

CFB8 cipher was going to be moved in 49.0, but it looks like that didn't

actually happen and it's still available in the old import path, so we

don't need to handle that move yet.
bleach has been updated to >=6.1. 6.1 is the last version that

supported Python 3.8, and 6.4 is the last release that will ever happen.

I've filed a task for us to find a replacement for bleach, since there

won't be any python version or security updates in the future.

Testing Done

Ran unit tests.

Commits

Summary	ID
Update cryptography and bleach dependencies. This change bumps two of our dependencies to account for some pip-audit flags: `cryptography` has been updated to 49.0 (on Python versions that support it), and `pyOpenSSL` updated to match. There's a log warning that the CFB8 cipher was going to be moved in 49.0, but it looks like that didn't actually happen and it's still available in the old import path, so we don't need to handle that move yet. `bleach` has been updated to >=6.1. 6.1 is the last version that supported Python 3.8, and 6.4 is the last release that will ever happen. I've filed a task for us to find a replacement for bleach, since there won't be any python version or security updates in the future. Testing Done: Ran unit tests.	pvxsyzrswpmrpmvtsnuttwyqpnsvszkv

Summary

Update cryptography and bleach dependencies.

This change bumps two of our dependencies to account for some pip-audit flags: `cryptography` has been updated to 49.0 (on Python versions that support it), and `pyOpenSSL` updated to match. There's a log warning that the CFB8 cipher was going to be moved in 49.0, but it looks like that didn't actually happen and it's still available in the old import path, so we don't need to handle that move yet. `bleach` has been updated to >=6.1. 6.1 is the last version that supported Python 3.8, and 6.4 is the last release that will ever happen. I've filed a task for us to find a replacement for bleach, since there won't be any python version or security updates in the future. Testing Done: Ran unit tests.

pvxsyzrswpmrpmvtsnuttwyqpnsvszkv

Issues

Description	From	Last Updated
This sets things up to break if, say, bleach 8 is still a Python version match but changes API.	chipx86	June 22, 2026, 2:55 p.m.

flake8 passed.

JSHint passed.

reviewboard/dependencies.py (Diff revision 1)

The issue has been resolved. Show all issues

This sets things up to break if, say, bleach 8 is still a Python version match but changes API.

chipx86

June 22, 2026, 2:48 p.m.

I know the note in the description about this, but I'd rather not trust that that's the future unconditionally.

Commits:

	Summary	ID
	Update cryptography and bleach dependencies. This change bumps two of our dependencies to account for some pip-audit flags: `cryptography` has been updated to 49.0 (on Python versions that support it), and `pyOpenSSL` updated to match. There's a log warning that the CFB8 cipher was going to be moved in 49.0, but it looks like that didn't actually happen and it's still available in the old import path, so we don't need to handle that move yet. `bleach` has been updated to >=6.1. 6.1 is the last version that supported Python 3.8, and 6.4 is the last release that will ever happen. I've filed a task for us to find a replacement for bleach, since there won't be any python version or security updates in the future. Testing Done: Ran unit tests.	pvxsyzrswpmrpmvtsnuttwyqpnsvszkv
	Update cryptography and bleach dependencies. This change bumps two of our dependencies to account for some pip-audit flags: `cryptography` has been updated to 49.0 (on Python versions that support it), and `pyOpenSSL` updated to match. There's a log warning that the CFB8 cipher was going to be moved in 49.0, but it looks like that didn't actually happen and it's still available in the old import path, so we don't need to handle that move yet. `bleach` has been updated to >=6.1. 6.1 is the last version that supported Python 3.8, and 6.4 is the last release that will ever happen. I've filed a task for us to find a replacement for bleach, since there won't be any python version or security updates in the future. Testing Done: Ran unit tests.	pvxsyzrswpmrpmvtsnuttwyqpnsvszkv

Diff:

Revision 2 (+42 -6)

Show changes

reviewboard/dependencies.py

Checks run (2 succeeded)

flake8 passed.

JSHint passed.

Ship it!

```
Ship It!
```

Status:: Completed
Change Summary:: Pushed to release-7.x (b037d53)