fix(source-github): upgrade cryptography to 46.0.7 (CVE-2026-26007) by devin-ai-integration[bot] · Pull Request #79196 · airbytehq/airbyte

devin-ai-integration · 2026-06-09T02:56:06Z

What

Upgrade cryptography from 44.0.3 to 46.0.7 in source-github to resolve CVE-2026-26007 (CVSS 8.2, EC subgroup attack allowing private key recovery) and PYSEC-2026-35 (DNS name constraint bypass).

Resolves https://github.com/airbytehq/oncall/issues/12817:

https://github.com/airbytehq/oncall/issues/12817

How

Merged master (which already updated lockfile via PR deps(source-github): 🐙 update dependencies [2026-06-09] #79312) and bumped version to 2.1.31
poetry.lock: cryptography 44.0.3 → 46.0.7 (via master merge + poetry update)
airbyte-cdk: 7.21.1 (already widened constraint in CDK PR fix: Widen cryptography dependency to >=44.0.0,<47.0.0 airbyte-python-cdk#975)
Version bump: 2.1.30 → 2.1.31 (patch — pure dependency update)

Review guide

airbyte-integrations/connectors/source-github/metadata.yaml — version bump
airbyte-integrations/connectors/source-github/pyproject.toml — version bump
airbyte-integrations/connectors/source-github/poetry.lock — lockfile update
docs/integrations/sources/github.md — changelog entry

User Impact

No user-facing behavior change. Resolves a security vulnerability in the cryptography dependency.

Can this PR be safely reverted and rolled back?

YES 💚

Link to Devin session: https://app.devin.ai/sessions/d7dad154c15c4923b20123a6a2aff34e

Update poetry.lock to bump cryptography from 44.0.3 to 46.0.7 and airbyte-cdk from 7.21.0 to 7.21.1 (which widened the cryptography constraint to >=44.0.0,<47.0.0). Resolves CVE-2026-26007 (CVSS 8.2, EC subgroup attack) and PYSEC-2026-35 (DNS name constraint bypass). Co-Authored-By: bot_apk <apk@cognition.ai>

devin-ai-integration · 2026-06-09T02:56:08Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment, CI, and merge conflict monitoring

Co-Authored-By: bot_apk <apk@cognition.ai>

github-actions · 2026-06-09T02:56:33Z

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

PR Slash Commands

Airbyte Maintainers (that's you!) can execute the following slash commands on your PR:

🛠️ Quick Fixes
- /format-fix - Fixes most formatting issues.
- /bump-version - Bumps connector versions, scraping changelog description from the PR title.
  - Bump types: patch (default), minor, major, major_rc, rc, promote.
  - The rc type is a smart default: applies minor_rc if stable, or bumps the RC number if already RC.
  - The promote type strips the RC suffix to finalize a release.
  - Example: /bump-version type=rc or /bump-version type=minor
- /bump-progressive-rollout-version - Alias for /bump-version type=rc. Bumps with an RC suffix and enables progressive rollout.
❇️ AI Testing and Review (internal link: AI-SDLC Docs):
- /ai-prove-fix - Runs prerelease readiness checks, including testing against customer connections.
- /ai-canary-prerelease - Rolls out prerelease to 5-10 connections for canary testing.
- /ai-review - AI-powered PR review for connector safety and quality gates.
📝 AI Documentation:
- /ai-docs-review - AI-powered documentation review for PRs with connector changes.
- /ai-create-docs-pr - Creates a documentation PR for connector changes, stacked on the current PR.
🚀 Connector Releases:
- /publish-connectors-prerelease - Publishes pre-release connector builds (tagged as {version}-preview.{git-sha}) for all modified connectors in the PR.
☕️ JVM connectors:
- /update-connector-cdk-version connector=<CONNECTOR_NAME> - Updates the specified connector to the latest CDK version.
  Example: /update-connector-cdk-version connector=destination-bigquery
🐍 Python connectors:
- /poe connector source-example lock - Run the Poe lock task on the source-example connector, committing the results back to the branch.
- /poe source example lock - Alias for /poe connector source-example lock.
- /poe source example use-cdk-branch my/branch - Pin the source-example CDK reference to the branch name specified.
- /poe source example use-cdk-latest - Update the source-example CDK dependency to the latest available version.
⚙️ Admin commands:
- /force-merge reason="<REASON>" - Force merges the PR using admin privileges, bypassing CI checks. Requires a reason.
  Example: /force-merge reason="CI is flaky, tests pass locally"

📚 Show Repo Guidance

Helpful Resources

Breaking Changes Guide - Breaking changes, migration guides, and upgrade deadlines
Developing Connectors Locally
Managing Connector Secrets
On-Demand Regression Tests
#connector-ci-issues
#connector-publish-updates
#connector-build-statuses

📝 Edit this welcome message.

github-actions · 2026-06-09T02:59:46Z

`source-github` Connector Test Results

173 tests 169 ✅ 23s ⏱️
3 suites 4 💤
3 files 0 ❌

Results for commit 50e9a89.

♻️ This comment has been updated with latest results.

github-actions · 2026-06-09T03:01:14Z

Deploy preview for airbyte-docs ready!

Project:	`airbyte-docs`
Status:	✅ Deploy successful!
Preview URL:	https://airbyte-docs-pra5gkdcq-airbyte-growth.vercel.app
Latest Commit:	`874697d`

Deployed with vercel-action

octavia-bot · 2026-06-09T11:40:46Z

🔍 AI Prove Fix session starting... Running readiness checks and testing against customer connections. View playbook

🔗 Session URL: https://app.devin.ai/sessions/253d9ec46aa040e4b2529a273c09ad1d

✅ Devin AI session created successfully!

devin-ai-integration · 2026-06-09T11:41:59Z

🧪 Fix Validation Evidence

🟢 Outcome: Fix Proven

Regression tests confirm the lockfile-only dependency bump (cryptography 44.0.3 → 46.0.7) introduces no behavioral regressions. All four regression test commands (SPEC, CHECK, DISCOVER, READ) passed in comparison mode with zero differences between target (v2.1.30) and control (v2.1.29).

Note: This PR has a merge conflict that needs resolution before merge.

🚦 Next Steps

Resolve the merge conflict in this PR.
This PR appears ready for review and merge after conflict resolution.
For broader validation before release, consider running /ai-canary-prerelease to test on additional connections.
The daily_hands_free_triage automation will monitor the release rollout after merge.

📋 Connector & PR Details

Connector: source-github
PR: #79196
Pre-release Version Tested: 2.1.30-preview.a18b702
Detailed Results: https://github.com/airbytehq/oncall/issues/12817#issuecomment-4659471950

📝 Evidence Plan

Testing Hypothesis

Lockfile-only dependency update with zero code changes. Hypothesis: NO visible behavioral difference between target and control.

Proving Criteria

All four steps (SPEC, CHECK, DISCOVER, READ) show ✅ with no differences → MET
Connector operates identically before and after the dependency bump → MET

Disproving Criteria

Any ❌ difference indicating the dependency upgrade caused a regression → NOT TRIGGERED

Testing Strategy: Regression tests only

source-github is a source connector (regression tests supported)
Not in the forced OAuth write-back connector list
No behavioral code change — only confirming no regressions from dependency bump

Cases Attempted

Attempt 1 (GSM, all streams, comparison mode): ✅ All steps passed, no regression detected. Matches hypothesis — no retry needed.

✅ Pre-flight Checks

Viability: Pure lockfile + version bump, CDK constraint already allows >=44.0.0,<47.0.0
Safety: No code modifications — only lockfile/metadata/docs changes
Breaking Change: Not breaking — no schema, field, PK/cursor, spec, stream, or state changes
Pin Exclusion: No live connection pinning performed (regression tests only)
Reversibility: Patch version bump (2.1.29 → 2.1.30), no state/config format changes

📊 Detailed Evidence Log

Regression Test Workflow: https://github.com/airbytehq/airbyte-ops-mcp/actions/runs/27203790451
Duration: ~9 minutes (11:43:21 → 11:52:05 UTC)

Command	Result	`regression_detected`
`SPEC`	✅	`false`
`CHECK`	✅	`false`
`DISCOVER`	✅	`false`
`READ`	✅	`false`

Legend: ✅ = passed (no diff), ❌ = regression detected, ⚠️ = both versions failed

Detailed connection information and logs are recorded in the linked oncall issue.

Devin session: https://app.devin.ai/sessions/253d9ec46aa040e4b2529a273c09ad1d

github-actions · 2026-06-09T11:44:56Z

Pre-release Connector Publish Started

Publishing pre-release build for connector source-github.
PR: #79196

Pre-release versions will be tagged as {version}-preview.a18b702
and are available for version pinning via the scoped_configuration API.

View workflow run
⚠️ Pre-release Publish CANCELLED for source-github.

octavia-bot · 2026-06-09T12:21:07Z

AI PR Review starting...

Reviewing PR for connector safety and quality.
View playbook

🔗 Session URL: https://app.devin.ai/sessions/c83dc8dae13845e7abe1f05137c0f8e4

✅ Devin AI session created successfully!

devin-ai-integration · 2026-06-09T12:23:48Z

🛡️ AI PR Review Report

🟢 Review Action: APPROVED

All 12 gates passed.

🟦 Risk Level: 1/5

Lockfile-only dependency bump (cryptography 44.0.3→46.0.7, airbyte-cdk 7.21.0→7.21.1) in source-github with no source code changes.

📋 PR Details

Connector(s): source-github
PR: #79196
HEAD SHA: a18b702e4e44d38bf7bd28eda55d56c9f2903615
Session: https://app.devin.ai/sessions/c83dc8dae13845e7abe1f05137c0f8e4

🔍 Gate Evaluation Details

Gate-by-Gate Analysis

Gate	Status	Enforced?	Details
PR Hygiene	PASS	Yes	Description present (>50 chars visible content), changelog updated, no unresolved human feedback
Code Hygiene	PASS	WARNING	No source code modified — dependency-only change is exempt from coverage requirement
Test Coverage	PASS	Yes	Exempt: dependency-only changes (pyproject.toml, poetry.lock without source changes)
Code Security	PASS	Yes	No security-sensitive file patterns matched; metadata.yaml diff contains only `dockerImageTag` bump
Per-Record Performance	PASS	WARNING	No source code or manifest changes — no per-record code paths affected
Breaking Dependencies	PASS	WARNING	cryptography 44.0.3→46.0.7 (CVE fix); CDK constraint already widened in airbyte-python-cdk#975; regression tests confirm no behavioral change
Backwards Compatibility	PASS	Warning (elevates Risk Level)	No spec, stream, schema, or breaking metadata changes — only `dockerImageTag` bump in metadata.yaml
Forwards Compatibility	PASS	Warning (elevates Risk Level)	No state/cursor/pagination/transformation keywords in diff hunks
Behavioral Changes	PASS	Warning (elevates Risk Level)	No operational keywords (rate_limit, retry, backoff, timeout, error_handler) in diff hunks
Out-of-Scope Changes	PASS	Skip	All 4 changed files are within connector scope (`airbyte-integrations/connectors/source-github/`) or docs (`docs/integrations/sources/github.md`)
CI Checks	PASS	Yes	All core checks green: Lint ✅, Test ✅ (173 tests, 169 passed, 4 skipped, 0 failed), Connector CI Summary ✅, Format ✅
Live / E2E Tests	PASS	Yes	Dependency-only change matches "not required" pattern; additionally, `/ai-prove-fix` regression tests (SPEC, CHECK, DISCOVER, READ) all passed on pre-release `2.1.30-preview.a18b702` with zero differences vs control

PR Hygiene Details

PR Body Length (raw): ~1,400 chars
PR Body Length (after stripping): ~1,300 chars
PR Body Length (visible content): ~900 chars
PR Body Preview: ## What\n\nResolves https://github.com/airbytehq/oncall/issues/12817:\n- https://github.com/airbytehq/oncall/issues/1281...
Docs Changelog: docs/integrations/sources/github.md updated with v2.1.30 entry
Peer Feedback: 8 comments, all from bot accounts (devin-ai-integration[bot], github-actions[bot], octavia-bot[bot]) — no human reviewer feedback to address

Test Coverage Details

Behavioral Change Detected: No (exempt)
Indicators Found: PR title contains "fix", linked to oncall issue — BUT change type is dependency-only (exempt)
Test Files Modified: None
New Test Content Found: Exempt
Exemption Reason: Dependency-only changes (pyproject.toml version bump, poetry.lock update) without source code modifications

Code Security Details

File path patterns matched: None
metadata.yaml diff hunks scanned: Only dockerImageTag: 2.1.29 → 2.1.30 — no allowedHosts, connectorBuildOptions, or dockerRepository keywords

Backwards Compatibility Details

Spec file modified: No (spec.json/spec.yaml not in changed files)
Streams modified: No
metadata.yaml changes: Only dockerImageTag bump — no releases.breakingChanges needed

Live / E2E Tests Details

Validation required?: No — all changed files match "not required" patterns (minor dependency bumps in pyproject.toml/poetry.lock + docs)
Supplementary evidence: /ai-prove-fix regression tests on pre-release 2.1.30-preview.a18b702 confirm zero behavioral differences (SPEC ✅, CHECK ✅, DISCOVER ✅, READ ✅)
MCP verification: Unavailable (Cloud SQL Proxy not running) — fell back to CI/label evidence

📚 Evidence Consulted

Evidence

Changed files: 4 files
- airbyte-integrations/connectors/source-github/metadata.yaml (dockerImageTag 2.1.29→2.1.30)
- airbyte-integrations/connectors/source-github/pyproject.toml (version 2.1.29→2.1.30)
- airbyte-integrations/connectors/source-github/poetry.lock (cryptography 44.0.3→46.0.7, airbyte-cdk 7.21.0→7.21.1)
- docs/integrations/sources/github.md (changelog entry for v2.1.30)
CI checks: 35 passed, 0 failed, 9 skipped — all core checks green (Lint, Test, Format, Connector CI Summary)
PR labels: connectors/source/github, hyd-fix, hyd-prove, hyd-review
PR description: Present with detailed What/How/Test Coverage/Review Guide/User Impact sections
Existing bot reviews: None for current HEAD SHA
Validation evidence: /ai-prove-fix regression tests passed (Comment 6) — pre-release 2.1.30-preview.a18b702 tested

Devin session

Co-Authored-By: bot_apk <apk@cognition.ai>

devin-ai-integration · 2026-06-12T11:45:09Z

↪️ Triggering /ai-ready per Hands-Free AI Triage Project triage next step.

Reason: /ai-review approved this PR. Advancing to ready stage.

Devin session

octavia-bot-hoard · 2026-06-12T11:45:09Z

Auto-merge evaluation: PASS

Preconditions (all must pass)

Status	Check	Reasoning
✅	No Breaking Changes	Patch version bump (2.1.30 → 2.1.31) for a pure dependency update (cryptography 44.0.3 → 46.0.7). No APIs removed/renamed, no schema changes, no configuration changes, no functional code modifications. Regression tests confirmed zero behavioral differences.
✅	Ai Review Passed	Comment 9 by devin-ai-integration[bot] contains the exact marker ''. All 12 gates passed with risk level 1/5.

Change scope (at least one must pass)

Status	Scope	Reasoning
✅	Dependency Version Bump	All 4 changed files fall within allowed dependency bump categories: pyproject.toml (dependency manifest, version field), poetry.lock (lockfile), metadata.yaml (dockerImageTag version field), docs/integrations/sources/github.md (changelog entry). No source code or test files modified.

Devin session | Workflow run

octavia-bot-admin

Auto-approved by AI-gated auto-merge evaluation.

chore: update changelog with PR number

a18b702

Co-Authored-By: bot_apk <apk@cognition.ai>

devin-ai-integration Bot added the hyd-fix Hydra: ai-fix stage has run label Jun 9, 2026

Octavia Squidington III (octavia-squidington-iii) added the connectors/source/github label Jun 9, 2026

devin-ai-integration Bot added the hyd-prove Hydra: ai-prove-fix stage has run label Jun 9, 2026

octavia-bot Bot marked this pull request as ready for review June 9, 2026 12:21

devin-ai-integration Bot added the hyd-review label Jun 9, 2026

octavia-bot Bot added the hyd-ready Hydra: ready for human review or merge label Jun 9, 2026

Merge origin/master into devin/1780973679-fix-source-github-cryptography

50e9a89

Co-Authored-By: bot_apk <apk@cognition.ai>

Pedro S. Lopez (pedroslopez) mentioned this pull request Jun 9, 2026

ci: fix dependency_version_bump scope in auto-merge evaluation #79623

Merged

1 task done

devin-ai-integration Bot mentioned this pull request Jun 10, 2026

ci(hydra): add error_classification_change and error_handler_fail_or_retry automerge scopes #79660

Open

1 task done

Airbyte (airbytehq) deleted a comment from octavia-bot-hoard Bot Jun 11, 2026

Pedro S. Lopez (pedroslopez) removed the hyd-ready Hydra: ready for human review or merge label Jun 11, 2026

octavia-bot Bot added the hyd-ready Hydra: ready for human review or merge label Jun 12, 2026

octavia-bot-admin Bot approved these changes Jun 12, 2026

View reviewed changes

octavia-bot-hoard Bot merged commit 9a9efdb into master Jun 12, 2026
48 of 54 checks passed

octavia-bot-hoard Bot deleted the devin/1780973679-fix-source-github-cryptography branch June 12, 2026 11:47

devin-ai-integration Bot mentioned this pull request Aug 27, 2026

docs(source-github): document workflow_run_attempts permissions (2.8.0) and stargazers access restriction (2.7.8); fix changelog dates #77713

Draft

1 of 2 tasks

Conversation

devin-ai-integration Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

How

Review guide

User Impact

Can this PR be safely reverted and rolled back?

Uh oh!

devin-ai-integration Bot commented Jun 9, 2026

🤖 Devin AI Engineer

Uh oh!

github-actions Bot commented Jun 9, 2026

👋 Greetings, Airbyte Team Member!

PR Slash Commands

Helpful Resources

Uh oh!

github-actions Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

source-github Connector Test Results

Uh oh!

github-actions Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

octavia-bot Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧪 Fix Validation Evidence

🟢 Outcome: Fix Proven

Testing Hypothesis

Proving Criteria

Disproving Criteria

Testing Strategy: Regression tests only

Cases Attempted

Uh oh!

github-actions Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

octavia-bot Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration Bot commented Jun 9, 2026 • edited by pedroslopez Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛡️ AI PR Review Report

🟢 Review Action: APPROVED

🟦 Risk Level: 1/5

Gate-by-Gate Analysis

PR Hygiene Details

Test Coverage Details

Code Security Details

Backwards Compatibility Details

Live / E2E Tests Details

Evidence

Uh oh!

devin-ai-integration Bot commented Jun 12, 2026

Uh oh!

octavia-bot-hoard Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Auto-merge evaluation: PASS

Preconditions (all must pass)

Change scope (at least one must pass)

Uh oh!

octavia-bot-admin Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

devin-ai-integration Bot commented Jun 9, 2026 •

edited

Loading

github-actions Bot commented Jun 9, 2026 •

edited

Loading

`source-github` Connector Test Results

github-actions Bot commented Jun 9, 2026 •

edited

Loading

octavia-bot Bot commented Jun 9, 2026 •

edited

Loading

devin-ai-integration Bot commented Jun 9, 2026 •

edited

Loading

github-actions Bot commented Jun 9, 2026 •

edited

Loading

octavia-bot Bot commented Jun 9, 2026 •

edited

Loading

devin-ai-integration Bot commented Jun 9, 2026 •

edited by pedroslopez

Loading

octavia-bot-hoard Bot commented Jun 12, 2026 •

edited

Loading