Releasing a new version to avoid vulnerable cryptography dependency

[mg-kialo]

Hi!

First of all many thanks for creating and maintaining this awesome piece of software.

I wanted to ask whether it would be possible to release a new version of mitmproxy?

The current latest release (9.0.1) pins the cryptography dependency to version 38.0. There is a dependabot security alert for that version: CVE-2023-0286 Vulnerable OpenSSL included in cryptography wheels

I saw that cryptography is already updated to a newer version on your main branch to version that's not vulnerable anymore.

Is there currently a plan to prepare a new release? That would allow us to upgrade to a non-vulnerable version of cryptography.

Thanks a lot!
Marius

[mhils]

See #5966. :)

I would typically just ship a quick patch release, but our build infrastructure has some changes that would require non-trivial backports. mitmproxy 10 isn't far out though. :)

[mg-kialo]

Ah damn, I did search in the issues but only in the open ones 🙈

I see, thank you for the quick answer!