From e33a0eb5b46a6f86a780b62de869203534d299bd Mon Sep 17 00:00:00 2001 From: monoxgas Date: Tue, 29 Sep 2026 10:32:16 -0600 Subject: [PATCH] fix(attack-surface-management): stop downgrading cryptography and dnspython The capability pinned pyOpenSSL~=25.3.0, which requires cryptography<47, and dnspython<2.8. The runtime installs capability pins beside the SDK without constraints, so binding this capability downgraded the SDK's cryptography 50.0.1 to 46.0.7 and dnspython 2.8.0 to 2.7.0. pyOpenSSL 25.3.0 and cryptography 46.0.7 both carry known advisories. bbot 3.0.2 needs only dnspython>=2.7.0,<2.9.0 and does not pin pyOpenSSL. Allow pyOpenSSL 26.x and dnspython 2.8.x. Bump to 2.0.2. Co-Authored-By: Claude Opus 5.5 (1M context) --- capabilities/attack-surface-management/capability.yaml | 6 +++--- capabilities/attack-surface-management/pyproject.toml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/capabilities/attack-surface-management/capability.yaml b/capabilities/attack-surface-management/capability.yaml index 9a9a02a..d25eda8 100644 --- a/capabilities/attack-surface-management/capability.yaml +++ b/capabilities/attack-surface-management/capability.yaml @@ -1,6 +1,6 @@ schema: 1 name: attack-surface-management -version: "2.0.1" +version: "2.0.2" description: > External attack surface management with BBOT reconnaissance scanning, Neo4j graph database analysis, Shodan internet intelligence, and @@ -56,14 +56,14 @@ dependencies: - "aiosqlite>=0.21.0" - "extractous~=0.3.0" - "asyncpg>=0.31.0" - - "dnspython>=2.7.0,<2.8.0" + - "dnspython>=2.7.0,<2.9.0" - "fastmcp>=2.0" - "neo4j>=5.28.1" - "shodan>=1.31.0" - "aiodocker>=0.24.0" - "tldextract>=5.3.1,<6.0.0" - "pillow>=11.3.0" - - "pyOpenSSL~=25.3.0" + - "pyOpenSSL>=25.3.0,<27" - "loguru>=0.7.0" checks: diff --git a/capabilities/attack-surface-management/pyproject.toml b/capabilities/attack-surface-management/pyproject.toml index 9736e5a..8e91962 100644 --- a/capabilities/attack-surface-management/pyproject.toml +++ b/capabilities/attack-surface-management/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "attack-surface-management" -version = "2.0.1" +version = "2.0.2" requires-python = ">=3.10" dependencies = [ "badsecrets~=0.13.47", @@ -9,14 +9,14 @@ dependencies = [ "aiosqlite>=0.21.0", "extractous~=0.3.0", "asyncpg>=0.31.0", - "dnspython>=2.7.0,<2.8.0", + "dnspython>=2.7.0,<2.9.0", "fastmcp>=2.0", "neo4j>=5.28.1", "shodan>=1.31.0", "aiodocker>=0.24.0", "tldextract>=5.3.1,<6.0.0", "pillow>=11.3.0", - "pyOpenSSL~=25.3.0", + "pyOpenSSL>=25.3.0,<27", "loguru>=0.7.0", ]