chore(deps): move cryptography to 50.x

[cbetta]

What

Moves cryptography from ^49.0.0 to ^50.0.1.

Follow-up to #315, which took ^49.0.0 as the minimal change that cleared the two open CVEs. 50.0.1 is the current release, so this takes the extra runway rather than sitting one major behind from the day it landed.

No security urgency

49.x is already outside the vulnerable range (>=42.0.0, <=48.0.0) for both CVE-2026-69249 and CVE-2026-69248, and the alerts are closed. 50.0.1 carries no known advisories. This is purely about not needing another bump shortly — merge it whenever suits.

Speakeasy-managed

Same as #315: the constraint is set in .speakeasy/gen.yaml under python.additionalDependencies.main, with the generated pyproject.toml kept in step.

Worth noting as evidence the approach is sound — generation 2.4.11 landed on top of #315 and preserved the ^49.0.0 value, so gen.yaml is confirmed as the durable place for this.

Verification

Resolved the runtime set cleanly (cryptography 50.0.1, PyJWT 2.14.0, python-jose 3.5.0) and exercised the real auth paths from src/gr4vy/auth.py against 50.0.1 — ES512 key load, JWK thumbprint, jwt.encode and jwt.decode all pass.

cryptography 50 requires Python ≥3.9; this SDK requires ≥3.10. The SDK's whole surface here is serialization.load_pem_private_key and hashes.SHA256, both unchanged across 49→50.

🤖 Generated with Claude Code

[github-actions]

🧪 Test coverage

Metric	Value
Endpoints reached (HTTP)	119 / 120 (99.2%)

⚠️ 1 endpoint operation(s) have no E2E test. Newly generated endpoints show up here — consider adding tests for them.

• GET /roles

_{Endpoint reach is measured from HTTP requests actually sent by the suite (see tests/utils/client.py). See TESTING.md.}