fix(deps): allow cryptography 49.x to clear two open CVEs

[cbetta]

What

Widens the cryptography constraint from ^46.0.7 to ^49.0.0, closing two open Dependabot alerts.

CVE	Severity	Summary
CVE-2026-69249	high	Duplicate self-signed intermediates cause exponential certificate path-building
CVE-2026-69248	medium	Verifier accepts wildcard DNS names, allowing escape from permittedSubtrees

Vulnerable range is >=42.0.0, <=48.0.0; both are fixed in 49.0.0.

Why it needs doing by hand

The old pin (>=46.0.7,<47.0.0) sat inside the vulnerable range and three majors below the fix, which made the security update unsatisfiable. Dependabot has therefore failed on this dependency on every run since 2026-06-17 — 10 consecutive failures, always pip in /. for cryptography. It will not self-heal until the constraint is widened.

Speakeasy-managed — where the change belongs

The real source of truth is .speakeasy/gen.yaml under python.additionalDependencies.main; the generator writes pyproject.toml from it. Editing only pyproject.toml would be reverted by the next regen.

Both files are updated here: gen.yaml so the change survives regeneration, and pyproject.toml so the fix is effective immediately rather than waiting for the next generation cycle.

Verification

The SDK's entire use of cryptography is two calls in src/gr4vy/auth.py — serialization.load_pem_private_key and hashes.SHA256 — both unchanged across 47→49.

Resolved the runtime set cleanly (cryptography 49.0.0, PyJWT 2.14.0, python-jose 3.5.0; python-jose requires only cryptography>=3.4.0, no upper cap) and exercised the real auth paths against 49.0.0: ES512 key load, JWK thumbprint, jwt.encode and jwt.decode all pass. cryptography 49 requires Python ≥3.9; this SDK requires ≥3.10.

Risk

Low. Neither CVE is reachable from this SDK in practice — both live in X.509 path building and name constraints, which it never invokes. The reason to fix is that the vulnerable version still ships in the dependency tree and will be flagged by merchants' own scanners.

Note cryptography 50.0.1 is already out and also unaffected. I kept to ^49.0.0 as the minimal change that closes both CVEs and matches the existing caret convention — happy to go to 50.x instead if you'd prefer the extra runway.

🤖 Generated with Claude Code

[github-actions]

🧪 Test coverage

Metric	Value
Endpoints reached (HTTP)	119 / 120 (99.2%)

⚠️ 1 endpoint operation(s) have no E2E test. Newly generated endpoints show up here — consider adding tests for them.

• GET /roles

_{Endpoint reach is measured from HTTP requests actually sent by the suite (see tests/utils/client.py). See TESTING.md.}