From 6840931d3597758e5ffe0d2d006c73f24e520b92 Mon Sep 17 00:00:00 2001 From: Cristiano Betta Date: Tue, 15 Sep 2026 11:01:12 +0100 Subject: [PATCH] chore(deps): move cryptography to 50.x Follow-up to #315, which widened the constraint to ^49.0.0 as the minimal change that cleared CVE-2026-69249 and CVE-2026-69248. 50.0.1 is the current release and carries no known advisories, so this takes the extra runway rather than sitting one major behind from the day it landed. No security urgency: 49.x is already outside the vulnerable range (>=42.0.0, <=48.0.0) for both CVEs. This is purely about not needing another bump shortly. As in #315 the constraint is set in .speakeasy/gen.yaml under python.additionalDependencies.main, with the generated pyproject.toml kept in step. Generation 2.4.11 landed on top of #315 and preserved the ^49.0.0 value, confirming gen.yaml is the durable place for this. Verified against 50.0.1: resolved the runtime set (cryptography 50.0.1, PyJWT 2.14.0, python-jose 3.5.0) and exercised the ES512 thumbprint, jwt.encode and jwt.decode paths in src/gr4vy/auth.py. cryptography 50 requires Python >=3.9; this SDK requires >=3.10. Co-Authored-By: Claude Opus 5 --- .speakeasy/gen.yaml | 2 +- pyproject.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.speakeasy/gen.yaml b/.speakeasy/gen.yaml index 108cb297..9ca3ee6b 100644 --- a/.speakeasy/gen.yaml +++ b/.speakeasy/gen.yaml @@ -39,7 +39,7 @@ python: types-python-jose: ^3.4.0.20250224 main: PyJWT: ^2.10.1 - cryptography: ^49.0.0 + cryptography: ^50.0.1 python-jose: ^3.4.0 allowedRedefinedBuiltins: - id diff --git a/pyproject.toml b/pyproject.toml index 7802173a..17265e15 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -8,7 +8,7 @@ readme = "README-PYPI.md" requires-python = ">=3.10" dependencies = [ "PyJWT (>=2.10.1,<3.0.0)", - "cryptography (>=49.0.0,<50.0.0)", + "cryptography (>=50.0.1,<51.0.0)", "httpcore >=1.0.9", "httpx >=0.28.1", "jsonpath-python >=1.0.6",