Repository: certbot/certbot (language: python)

Issue:
Repin cryptography before 1.32.0 release for critical OpenSSL vulnerability
If we can, depending on the details of the issue and the timing of the next cryptography release, we should try repin cryptography before releasing Certbot 1.32.0.

https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html

Our snaps are running cryptography 38.0.1 wheels with OpenSSL 3.0.5.


Discussion / hints:

Fix patch:
diff --git a/tools/requirements.txt b/tools/requirements.txt
index 45f8b4a84fb..cbfe6f86516 100644
--- a/tools/requirements.txt
+++ b/tools/requirements.txt
@@ -10,16 +10,16 @@ apacheconfig==0.3.2 ; python_version >= "3.7" and python_version < "4.0"
 appnope==0.1.3 ; python_version >= "3.7" and python_version < "4.0" and sys_platform == "darwin"
 astroid==2.11.7 ; python_version >= "3.7" and python_version < "4.0"
 attrs==22.1.0 ; python_version >= "3.7" and python_version < "4.0"
-awscli==1.25.96 ; python_version >= "3.7" and python_version < "4.0"
+awscli==1.27.0 ; python_version >= "3.7" and python_version < "4.0"
 azure-devops==6.0.0b4 ; python_version >= "3.7" and python_version < "4.0"
-babel==2.10.3 ; python_version >= "3.7" and python_version < "4.0"
+babel==2.11.0 ; python_version >= "3.7" and python_version < "4.0"
 backcall==0.2.0 ; python_version >= "3.7" and python_version < "4.0"
 backports-cached-property==1.0.2 ; python_version >= "3.7" and python_version < "3.8"
 bcrypt==4.0.1 ; python_version >= "3.7" and python_version < "4.0"
 beautifulsoup4==4.11.1 ; python_version >= "3.7" and python_version < "4.0"
 bleach==5.0.1 ; python_version >= "3.7" and python_version < "4.0"
-boto3==1.24.95 ; python_version >= "3.7" and python_version < "4.0"
-botocore==1.27.95 ; python_version >= "3.7" and python_version < "4.0"
+boto3==1.26.0 ; python_version >= "3.7" and python_version < "4.0"
+botocore==1.29.0 ; python_version >= "3.7" and python_version < "4.0"
 cachecontrol==0.12.11 ; python_version >= "3.7" and python_version < "4.0"
 cachetools==5.2.0 ; python_version >= "3.7" and python_version < "4.0"
 cachy==0.3.0 ; python_version >= "3.7" and python_version < "4.0"
@@ -34,26 +34,27 @@ configargparse==1.5.3 ; python_version >= "3.7" and python_version < "4.0"
 configobj==5.0.6 ; python_version >= "3.7" and python_version < "4.0"
 coverage==6.5.0 ; python_version >= "3.7" and python_version < "4.0"
 crashtest==0.3.1 ; python_version >= "3.7" and python_version < "4.0"
-cryptography==38.0.1 ; python_version >= "3.7" and python_version < "4.0"
+cryptography==38.0.3 ; python_version >= "3.7" and python_version < "4.0"
 cython==0.29.32 ; python_version >= "3.7" and python_version < "4.0"
 decorator==5.1.1 ; python_version >= "3.7" and python_version < "4.0"
-dill==0.3.5.1 ; python_version >= "3.7" and python_version < "4.0"
+dill==0.3.6 ; python_version >= "3.7" and python_version < "4.0"
 distlib==0.3.6 ; python_version >= "3.7" and python_version < "4.0"
 distro==1.8.0 ; python_version >= "3.7" and python_version < "4.0"
-dns-lexicon==3.11.6 ; python_version >= "3.7" and python_version < "4.0"
+dns-lexicon==3.11.7 ; python_version >= "3.7" and python_version < "4.0"
 dnspython==2.2.1 ; python_version >= "3.7" and python_version < "4.0"
 docutils==0.16 ; python_version >= "3.7" and python_version < "4.0"
-dulwich==0.20.46 ; python_version >= "3.7" and python_version < "4.0"
+dulwich==0.20.50 ; python_version >= "3.7" and python_version < "4.0"
+exceptiongroup==1.0.0 ; python_version >= "3.7" and python_version < "3.11"
 execnet==1.9.0 ; python_version >= "3.7" and python_version < "4.0"
 fabric==2.7.1 ; python_version >= "3.7" and python_version < "4.0"
 filelock==3.8.0 ; python_version >= "3.7" and python_version < "4.0"
 google-api-core==2.10.2 ; python_version >= "3.7" and python_version < "4.0"
 google-api-python-client==2.65.0 ; python_version >= "3.7" and python_version < "4.0"
 google-auth-httplib2==0.1.0 ; python_version >= "3.7" and python_version < "4.0"
-google-auth==2.13.0 ; python_version >= "3.7" and python_version < "4.0"
+google-auth==2.14.0 ; python_version >= "3.7" and python_version < "4.0"
 googleapis-common-protos==1.56.4 ; python_version >= "3.7" and python_version < "4.0"
 html5lib==1.1 ; python_version >= "3.7" and python_version < "4.0"
-httplib2==0.20.4 ; python_version >= "3.7" and python_version < "4.0"
+httplib2==0.21.0 ; python_version >= "3.7" and python_version < "4.0"
 idna==3.4 ; python_version >= "3.7" and python_version < "4"
 imagesize==1.4.1 ; python_version >= "3.7" and python_version < "4.0"
 importlib-metadata==4.13.0 ; python_version >= "3.7" and python_version < "4.0"
@@ -72,9 +73,9 @@ jmespath==1.0.1 ; python_version >= "3.7" and python_version < "4.0"
 josepy==1.13.0 ; python_version >= "3.7" and python_version < "4.0"
 jsonlines==3.1.0 ; python_version >= "3.7" and python_version < "4.0"
 jsonpickle==2.2.0 ; python_version >= "3.7" and python_version < "4.0"
-jsonschema==4.16.0 ; python_version >= "3.7" and python_version < "4.0"
+jsonschema==4.17.0 ; python_version >= "3.7" and python_version < "4.0"
 keyring==23.9.3 ; python_version >= "3.7" and python_version < "4.0"
-lazy-object-proxy==1.7.1 ; python_version >= "3.7" and python_version < "4.0"
+lazy-object-proxy==1.8.0 ; python_version >= "3.7" and python_version < "4.0"
 lockfile==0.12.2 ; python_version >= "3.7" and python_version < "4.0"
 markupsafe==2.1.1 ; python_version >= "3.7" and python_version < "4.0"
 matplotlib-inline==0.1.6 ; python_version >= "3.7" and python_version < "4.0"
@@ -104,7 +105,7 @@ poetry-core==1.3.2 ; python_version >= "3.7" and python_version < "4.0"
 poetry-plugin-export==1.1.2 ; python_version >= "3.7" and python_version < "4.0"
 poetry==1.2.2 ; python_version >= "3.7" and python_version < "4.0"
 prompt-toolkit==3.0.31 ; python_version >= "3.7" and python_version < "4.0"
-protobuf==4.21.8 ; python_version >= "3.7" and python_version < "4.0"
+protobuf==4.21.9 ; python_version >= "3.7" and python_version < "4.0"
 ptyprocess==0.7.0 ; python_version >= "3.7" and python_version < "4.0"
 py==1.11.0 ; python_version >= "3.7" and python_version < "4.0"
 pyasn1-modules==0.2.8 ; python_version >= "3.7" and python_version < "4.0"
@@ -118,19 +119,18 @@ pynsist==2.7 ; python_version >= "3.7" and python_version < "4.0"
 pyopenssl==22.1.0 ; python_version >= "3.7" and python_version < "4.0"
 pyparsing==3.0.9 ; python_version >= "3.7" and python_version < "4.0"
 pyrfc3339==1.1 ; python_version >= "3.7" and python_version < "4.0"
-pyrsistent==0.18.1 ; python_version >= "3.7" and python_version < "4.0"
+pyrsistent==0.19.1 ; python_version >= "3.7" and python_version < "4.0"
 pytest-cov==4.0.0 ; python_version >= "3.7" and python_version < "4.0"
-pytest-forked==1.4.0 ; python_version >= "3.7" and python_version < "4.0"
-pytest-xdist==2.5.0 ; python_version >= "3.7" and python_version < "4.0"
-pytest==7.1.3 ; python_version >= "3.7" and python_version < "4.0"
+pytest-xdist==3.0.2 ; python_version >= "3.7" and python_version < "4.0"
+pytest==7.2.0 ; python_version >= "3.7" and python_version < "4.0"
 python-augeas==1.1.0 ; python_version >= "3.7" and python_version < "4.0"
 python-dateutil==2.8.2 ; python_version >= "3.7" and python_version < "4.0"
 python-digitalocean==1.17.0 ; python_version >= "3.7" and python_version < "4.0"
-pytz==2022.5 ; python_version >= "3.7" and python_version < "4.0"
+pytz==2022.6 ; python_version >= "3.7" and python_version < "4.0"
 pywin32-ctypes==0.2.0 ; python_version >= "3.7" and python_version < "4.0" and sys_platform == "win32"
 pywin32==304 ; python_version >= "3.7" and python_version < "4.0" and sys_platform == "win32"
 pyyaml==5.4.1 ; python_version >= "3.7" and python_version < "4.0"
-readme-renderer==37.2 ; python_version >= "3.7" and python_version < "4.0"
+readme-renderer==37.3 ; python_version >= "3.7" and python_version < "4.0"
 requests-download==0.1.2 ; python_version >= "3.7" and python_version < "4.0"
 requests-file==1.5.1 ; python_version >= "3.7" and python_version < "4.0"
 requests-oauthlib==1.3.1 ; python_version >= "3.7" and python_version < "4.0"
@@ -148,7 +148,7 @@ shellingham==1.5.0 ; python_version >= "3.7" and python_version < "4.0"
 six==1.16.0 ; python_version >= "3.7" and python_version < "4.0"
 snowballstemmer==2.2.0 ; python_version >= "3.7" and python_version < "4.0"
 soupsieve==2.3.2.post1 ; python_version >= "3.7" and python_version < "4.0"
-sphinx-rtd-theme==1.0.0 ; python_version >= "3.7" and python_version < "4.0"
+sphinx-rtd-theme==1.1.0 ; python_version >= "3.7" and python_version < "4.0"
 sphinx==5.1.1 ; python_version >= "3.7" and python_version < "4.0"
 sphinxcontrib-applehelp==1.0.2 ; python_version >= "3.7" and python_version < "4.0"
 sphinxcontrib-devhelp==1.0.2 ; python_version >= "3.7" and python_version < "4.0"
@@ -158,9 +158,9 @@ sphinxcontrib-qthelp==1.0.3 ; python_version >= "3.7" and python_version < "4.0"
 sphinxcontrib-serializinghtml==1.1.5 ; python_version >= "3.7" and python_version < "4.0"
 tldextract==3.4.0 ; python_version >= "3.7" and python_version < "4.0"
 toml==0.10.2 ; python_version >= "3.7" and python_version < "4.0"
-tomli==2.0.1 ; python_version >= "3.7" and python_version < "4.0"
-tomlkit==0.11.5 ; python_version >= "3.7" and python_version < "4.0"
-tox==3.26.0 ; python_version >= "3.7" and python_version < "4.0"
+tomli==2.0.1 ; python_version >= "3.7" and python_full_version <= "3.11.0a6"
+tomlkit==0.11.6 ; python_version >= "3.7" and python_version < "4.0"
+tox==3.27.0 ; python_version >= "3.7" and python_version < "4.0"
 traitlets==5.5.0 ; python_version >= "3.7" and python_version < "4.0"
 twine==4.0.1 ; python_version >= "3.7" and python_version < "4.0"
 typed-ast==1.5.4 ; python_version >= "3.7" and python_version < "3.8"
@@ -169,22 +169,22 @@ types-mock==4.0.15.2 ; python_version >= "3.7" and python_version < "4.0"
 types-pyopenssl==22.1.0.1 ; python_version >= "3.7" and python_version < "4.0"
 types-pyrfc3339==1.1.1 ; python_version >= "3.7" and python_version < "4.0"
 types-python-dateutil==2.8.19.2 ; python_version >= "3.7" and python_version < "4.0"
-types-pytz==2022.5.0.0 ; python_version >= "3.7" and python_version < "4.0"
+types-pytz==2022.6.0.1 ; python_version >= "3.7" and python_version < "4.0"
 types-requests==2.28.11.2 ; python_version >= "3.7" and python_version < "4.0"
-types-setuptools==65.5.0.1 ; python_version >= "3.7" and python_version < "4.0"
+types-setuptools==65.5.0.2 ; python_version >= "3.7" and python_version < "4.0"
 types-six==1.16.21 ; python_version >= "3.7" and python_version < "4.0"
 types-urllib3==1.26.25.1 ; python_version >= "3.7" and python_version < "4.0"
 typing-extensions==4.4.0 ; python_version >= "3.7" and python_version < "4.0"
 uritemplate==4.1.1 ; python_version >= "3.7" and python_version < "4.0"
 urllib3==1.26.12 ; python_version >= "3.7" and python_version < "4"
-virtualenv==20.16.5 ; python_version >= "3.7" and python_version < "4.0"
+virtualenv==20.16.6 ; python_version >= "3.7" and python_version < "4.0"
 wcwidth==0.2.5 ; python_version >= "3.7" and python_version < "4.0"
 webencodings==0.5.1 ; python_version >= "3.7" and python_version < "4.0"
 wheel==0.37.1 ; python_version >= "3.7" and python_version < "4.0"
 wrapt==1.14.1 ; python_version >= "3.7" and python_version < "4.0"
 xattr==0.9.9 ; python_version >= "3.7" and python_version < "4.0" and sys_platform == "darwin"
 yarg==0.1.9 ; python_version >= "3.7" and python_version < "4.0"
-zipp==3.9.0 ; python_version >= "3.7" and python_version < "4.0"
+zipp==3.10.0 ; python_version >= "3.7" and python_version < "4.0"
 zope-component==5.0.1 ; python_version >= "3.7" and python_version < "4.0"
 zope-event==4.5.0 ; python_version >= "3.7" and python_version < "4.0"
 zope-hookable==5.2 ; python_version >= "3.7" and python_version < "4.0"


Test patch:
diff --git a/pytest.ini b/pytest.ini
index 78710566bd7..84d1d398bcc 100644
--- a/pytest.ini
+++ b/pytest.ini
@@ -27,6 +27,8 @@
 # 7) ACMEv1 deprecations in acme.client which will be resolved by Certbot 2.0.
 # 8) acme.mixins deprecation in acme.client which will be resolved by Certbot 2.0.
 # 9) acme.messages.Authorization.combinations which will be resolved by Certbot 2.0.
+# 10) pytest-cov uses deprecated functionality in pytest-xdist, to be resolved by
+#     https://github.com/pytest-dev/pytest-cov/issues/557.
 filterwarnings =
     error
     ignore:The external mock module:PendingDeprecationWarning
@@ -38,3 +40,4 @@ filterwarnings =
     ignore:.*attribute in acme.client is deprecated:DeprecationWarning
     ignore:.*acme.mixins is deprecated:DeprecationWarning
     ignore:.*Authorization.combinations is deprecated:DeprecationWarning
+    ignore:.*rsyncdir:DeprecationWarning