Do not use mutable argument defaults

src/cryptography/hazmat/primitives/serialization/pkcs7.py

@@ -56,12 +56,12 @@ def __init__(
                 PKCS7HashTypes,
                 padding.PSS | padding.PKCS1v15 | None,
             ]
-        ] = [],
-        additional_certs: list[x509.Certificate] = [],
+        ] | None = None,
+        additional_certs: list[x509.Certificate] | None = None,
     ):
         self._data = data
-        self._signers = signers
-        self._additional_certs = additional_certs
+        self._signers = signers or []
+        self._additional_certs = additional_certs or []
 
     def set_data(self, data: bytes) -> PKCS7SignatureBuilder:
         _check_byteslike("data", data)

src/cryptography/hazmat/primitives/serialization/ssh.py

@@ -1180,23 +1180,23 @@ def __init__(
         _serial: int | None = None,
         _type: SSHCertificateType | None = None,
         _key_id: bytes | None = None,
-        _valid_principals: list[bytes] = [],
+        _valid_principals: list[bytes] | None = None,
         _valid_for_all_principals: bool = False,
         _valid_before: int | None = None,
         _valid_after: int | None = None,
-        _critical_options: list[tuple[bytes, bytes]] = [],
-        _extensions: list[tuple[bytes, bytes]] = [],
+        _critical_options: list[tuple[bytes, bytes]] | None = None,
+        _extensions: list[tuple[bytes, bytes]] | None = None,
     ):
         self._public_key = _public_key
         self._serial = _serial
         self._type = _type
         self._key_id = _key_id
-        self._valid_principals = _valid_principals
+        self._valid_principals = _valid_principals or []
         self._valid_for_all_principals = _valid_for_all_principals
         self._valid_before = _valid_before
         self._valid_after = _valid_after
-        self._critical_options = _critical_options
-        self._extensions = _extensions
+        self._critical_options = _critical_options or []
+        self._extensions = _extensions or []
 
     def public_key(
         self, public_key: SSHCertPublicKeyTypes

src/cryptography/x509/base.py

@@ -662,15 +662,16 @@ class CertificateSigningRequestBuilder:
     def __init__(
         self,
         subject_name: Name | None = None,
-        extensions: list[Extension[ExtensionType]] = [],
-        attributes: list[tuple[ObjectIdentifier, bytes, int | None]] = [],
+        extensions: list[Extension[ExtensionType]] | None = None,
+        attributes: list[tuple[ObjectIdentifier, bytes, int | None]]
+        | None = None,
     ):
         """
         Creates an empty X.509 certificate request (v1).
         """
         self._subject_name = subject_name
-        self._extensions = extensions
-        self._attributes = attributes
+        self._extensions = extensions or []
+        self._attributes = attributes or []
 
     def subject_name(self, name: Name) -> CertificateSigningRequestBuilder:
         """
@@ -770,7 +771,7 @@ def __init__(
         serial_number: int | None = None,
         not_valid_before: datetime.datetime | None = None,
         not_valid_after: datetime.datetime | None = None,
-        extensions: list[Extension[ExtensionType]] = [],
+        extensions: list[Extension[ExtensionType]] | None = None,
     ) -> None:
         self._version = Version.v3
         self._issuer_name = issuer_name
@@ -779,7 +780,7 @@ def __init__(
         self._serial_number = serial_number
         self._not_valid_before = not_valid_before
         self._not_valid_after = not_valid_after
-        self._extensions = extensions
+        self._extensions = extensions or []
 
     def issuer_name(self, name: Name) -> CertificateBuilder:
         """
@@ -1013,14 +1014,14 @@ def __init__(
         issuer_name: Name | None = None,
         last_update: datetime.datetime | None = None,
         next_update: datetime.datetime | None = None,
-        extensions: list[Extension[ExtensionType]] = [],
-        revoked_certificates: list[RevokedCertificate] = [],
+        extensions: list[Extension[ExtensionType]] | None = None,
+        revoked_certificates: list[RevokedCertificate] | None = None,
     ):
         self._issuer_name = issuer_name
         self._last_update = last_update
         self._next_update = next_update
-        self._extensions = extensions
-        self._revoked_certificates = revoked_certificates
+        self._extensions = extensions or []
+        self._revoked_certificates = revoked_certificates or []
 
     def issuer_name(
         self, issuer_name: Name
@@ -1154,11 +1155,11 @@ def __init__(
         self,
         serial_number: int | None = None,
         revocation_date: datetime.datetime | None = None,
-        extensions: list[Extension[ExtensionType]] = [],
+        extensions: list[Extension[ExtensionType]] | None = None,
     ):
         self._serial_number = serial_number
         self._revocation_date = revocation_date
-        self._extensions = extensions
+        self._extensions = extensions or []
 
     def serial_number(self, number: int) -> RevokedCertificateBuilder:
         if not isinstance(number, int):

src/cryptography/x509/ocsp.py

@@ -474,11 +474,11 @@ def __init__(
         | None = None,
         request_hash: tuple[bytes, bytes, int, hashes.HashAlgorithm]
         | None = None,
-        extensions: list[x509.Extension[x509.ExtensionType]] = [],
+        extensions: list[x509.Extension[x509.ExtensionType]] | None = None,
     ) -> None:
         self._request = request
         self._request_hash = request_hash
-        self._extensions = extensions
+        self._extensions = extensions or []
 
     def add_certificate(
         self,
@@ -556,12 +556,12 @@ def __init__(
         responder_id: tuple[x509.Certificate, OCSPResponderEncoding]
         | None = None,
         certs: list[x509.Certificate] | None = None,
-        extensions: list[x509.Extension[x509.ExtensionType]] = [],
+        extensions: list[x509.Extension[x509.ExtensionType]] | None = None,
     ):
         self._response = response
         self._responder_id = responder_id
         self._certs = certs
-        self._extensions = extensions
+        self._extensions = extensions or []
 
     def add_response(
         self,