chore(deps): bump cryptography 49.0.0 → 50.0.0 (GHSA-g6cj-pr64-35w5)

[eric-wang-1990]

What

Bump cryptography 49.0.0 → 50.0.0 in poetry.lock.

Why

The Security Scan check (OSV-Scanner) fails on every open PR with one blocking finding:

[8.2] cryptography@49.0.0 — GHSA-g6cj-pr64-35w5 / CVE-2026-69247 / PYSEC-2026-3552
PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing.

Dependabot alert #42: vulnerable range >=44.0.0,<50.0.0, first patched in 50.0.0. The finding is present on main, so it blocks Security Scan on every PR (not just this one) until the pin moves.

How

cryptography is a transitive, optional dependency (pulled by pyspnego / requests-kerberos — the kerberos extra) with no upper bound declared in pyproject.toml. So this is a lock-only change — no pyproject.toml edit needed. Regenerated with Poetry 2.2.1 via the internal PyPI proxy; the only diff is the cryptography package block (version + wheel/sdist hashes). Its [package.dependencies] (cffi, typing-extensions), extras, and the lock content-hash are unchanged, and poetry check --lock is consistent.

Testing

• poetry check --lock — consistent (content-hash unchanged; no pyproject drift).
• Diff is a single 47/47 hunk entirely within the cryptography block.
• OSV/Dependabot: 50.0.0 is outside the vulnerable range, clearing the blocking finding.

This pull request and its description were written by Isaac.

---

This PR was created with GitHub MCP.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[peco-review-bot]

✅ No issues identified by the review bot.