Repository navigation
Release Python Oracle KMS Storage v1.1.0 - #965
Merged
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
stas-schaller
changed the title
stas-schaller
force-pushed
the
release/storage/python/oracle-kms/v1.1.0
branch
from
March 10, 2026 15:15
81b1e69 to
4599784
Compare
stas-schaller
force-pushed
the
release/storage/python/oracle-kms/v1.1.0
branch
from
March 27, 2026 18:31
4599784 to
060c76a
Compare
stas-schaller
force-pushed
the
release/storage/python/oracle-kms/v1.1.0
branch
from
April 9, 2026 19:39
060c76a to
fe4556f
Compare
stas-schaller
force-pushed
the
release/storage/python/oracle-kms/v1.1.0
branch
from
May 12, 2026 16:14
fe4556f to
0e862c1
Compare
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
An organization admin can view or raise the cap at claude.ai/admin-settings/claude-code. The cap resets at the start of the next billing period.
Once the cap resets or is raised, push a new commit or reopen this pull request to trigger a review.
There was a problem hiding this comment.
An organization admin can view or raise the cap at claude.ai/admin-settings/claude-code. The cap resets at the start of the next billing period.
Once the cap resets or is raised, push a new commit or reopen this pull request to trigger a review.
…ge-oracle-kms v1.1.0
- Raise Python floor to 3.9.2; Core SDK dependency to >=17.2.1
- Fix AES-GCM nonce from 128-bit to 96-bit per NIST SP 800-38D (KSM-954)
- Replace MD5 with SHA-256 for config change detection (KSM-954)
- Fix plaintext {} written before encryption at init (KSM-950)
- Fix encrypt/decrypt silently returning empty on KMS error (KSM-951)
- Fix delete_all() leaving credential file on disk when KMS unavailable (KSM-952)
- Fix set() silently diverging on read-only config files (KSM-953)
- Fix read_storage() returning live reference; correct autosave default (KSM-955)
- Add thread-safety lock to OracleKeyValueStorage (KSM-956)
- Fix load_config() leaving self.config = None on empty bootstrap (KSM-957)
- Fix requires-python floor to >=3.9.2 (KSM-958)
- Upgrade cryptography to >=46.0.5; fixes CVE-2026-26007 (KSM-834)
- Upgrade urllib3 to 2.6.3, requests to 2.32.4
- Port 23-test suite from GCP patterns; all pass on Python 3.9-3.13
- Rewrite publish workflow with GCP v1.1.0 parity hardening
stas-schaller
force-pushed
the
release/storage/python/oracle-kms/v1.1.0
branch
from
May 20, 2026 19:29
8ec2a4b to
2608edf
Compare
idimov-keeper
approved these changes
May 27, 2026
idimov-keeper
approved these changes
Jun 26, 2026
maksimu
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release branch for v1.1.0: security hardening (CVE-2026-26007, AES-GCM nonce correction), eight correctness fixes from a GCP-parity audit, and a Python floor raise to 3.9.
Changes
Bug Fixes
cryptographyfloor raised to>=46.0.5— ECDH subgroup attack on SECT curves (CVSS 8.2)__init__no longer writes{}to disk before encryption succeeds; KMS failures during initialget_key/encrypt_buffernow propagateencrypt_buffer()anddecrypt_buffer()now raise on KMS error instead of returning empty bytes/stringdelete_all()left file on disk (KSM-952): now callsos.remove()instead of re-encrypting an empty configset()silently diverged on read-only file (KSM-953):PermissionErrornow propagates; in-memory and disk state stay consistentread_storage()(KSM-955): returns a defensive copy;decrypt_config()default changed fromautosave=Truetoautosave=FalseOracleKeyValueStoragenow uses an internalthreading.RLockforset(),delete(),change_key(), anddecrypt_config()self.config = Noneafter empty bootstrap (KSM-957):load_config()no longer leaves config asNoneafter parsing a plaintext{}init file; subsequentget/set/deleteno longer crash withTypeErrorrequires-pythontightened to>=3.9.2;cryptography>=46.0.5excludes 3.9.0 and 3.9.1 via PyPI markers — pip now rejects those versions with a clear error instead of an opaque resolver failureMaintenance
keeper-secrets-manager-corefloor raised from>=16.6.6to>=17.2.1ocifloor updated with version markers:>=2.167.3,<2.168.2on Python 3.9,>=2.174.0on 3.10+; required to unlockcryptography>=46.0.5(olderocicappedcryptography<46.0.0)pycryptodomefloor raised to>=3.21.0;requeststo>=2.32.0(CVE-2026-47081);urllib3to>=2.6.3publishtoggle, SBOM generationBreaking Changes
keeper-secrets-manager-storage-oracle-kms<1.1.0to remain on a supported version.decrypt_config()default changed:autosavenow defaults toFalse(wasTrue). Passautosave=Trueexplicitly to preserve the previous behavior (KSM-955).Related Issues
KSM-834, KSM-949, KSM-950, KSM-951, KSM-952, KSM-953, KSM-954, KSM-955, KSM-956, KSM-957, KSM-958