From 878c1ba12fe414d105ae241040b2ea7b92b39ced Mon Sep 17 00:00:00 2001 From: BasitS-hash Date: Tue, 11 Aug 2026 10:35:41 -0400 Subject: [PATCH] fix(security): bump cryptography 48.0.1 -> 50.0.0 to clear 3 CVEs pip-audit in the Security Scan workflow has been failing on main since the advisories landed: cryptography 48.0.1 PYSEC-2026-3552 fix 50.0.0 cryptography 48.0.1 PYSEC-2026-3553 fix 49.0.0 cryptography 48.0.1 PYSEC-2026-3554 fix 49.0.0 This library performs the AEAD encryption backing the zero-knowledge store, so these are in the most sensitive dependency in the project. 50.0.0 is the lowest version clearing all three (3553 and 3554 are fixed in 49.0.0, but 3552 requires 50.0.0), so a single bump resolves the set. Verified: pip-audit -r requirements.txt --strict reports no known vulnerabilities; full suite passes (59 passed, 12 skipped). --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index f333489..7a1415f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5,5 +5,5 @@ python-dotenv==1.2.2 PyJWT==2.13.0 argon2-cffi==25.1.0 psycopg2-binary==2.9.12 -cryptography==48.0.1 +cryptography==50.0.0 slowapi==0.1.10