chore(deps): upgrade cryptography to 50.0.0

[yuneng-berri]

TLDR

Problem this solves:

• Lock sat on cryptography 48.0.1, two majors behind
• mlflow caps cryptography at <50, blocking a plain bump
• A naive bump breaks pip install "litellm[proxy,mlflow]"

How it solves it:

• Publishes >=49.0.0,<51.0 so mlflow stays co-installable
• A uv override holds our own lock at 50.0.0
• Overrides never reach published package metadata

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

No new tests: this changes only pyproject.toml and uv.lock, with no litellm code touched, so a new test would assert nothing the existing suites don't already cover. The relevant existing suites were run green on the new lock and the runtime proof below is a live proxy, not pytest. The two unchecked boxes above are pending CI and Greptile, which only start once this PR is open.

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

All runs captured at commit 2c63a41bc7, against a live proxy booted on the new lock and hitting real provider APIs (real spend, no mocks).

Before: why the override is needed. With the range set to >=50.0.0,<51.0 and no override, resolution is impossible for any consumer that also wants the mlflow extra:

pip install --dry-run "cryptography>=50.0.0,<51.0" "mlflow>=3.11.1,<4.0"

ERROR: Cannot install cryptography<51.0 and >=50.0.0, mlflow==3.11.1, mlflow==3.12.0,
mlflow==3.13.0, mlflow==3.14.0, mlflow==3.15.0 and mlflow==3.15.1 because these package
versions have conflicting dependencies.
ERROR: ResolutionImpossible

After: the published range keeps that combination installable.

pip install --dry-run "cryptography>=49.0.0,<51.0" "mlflow>=3.11.1,<4.0"

RESOLVED: {'mlflow': '3.15.1', 'cryptography': '49.0.0'}

Proxy boots on 50.0.0.

python litellm/proxy/proxy_cli.py --config litellm/proxy/dev_config.yaml --port 4000 --detailed_debug

$ curl -s http://localhost:4000/health/readiness | jq '{db, status}'
{"db": "connected", "status": "healthy"}

$ python -c "import cryptography; print(cryptography.__version__)"
50.0.0

All three LLM endpoints served by that proxy.

curl -sS http://localhost:4000/v1/chat/completions -H 'Authorization: Bearer sk-1234' -H 'Content-Type: application/json' \
  -d '{"model":"anthropic-sonnet-5","messages":[{"role":"user","content":"Reply with exactly: chat ok"}],"max_tokens":20}'

{"id":"chatcmpl-74a2122b-a0af-4ae9-b60a-ed42bdb40f19","model":"anthropic-sonnet-5","object":"chat.completion",
"choices":[{"finish_reason":"stop","index":0,"message":{"content":"chat ok","role":"assistant"}}],
"usage":{"completion_tokens":6,"prompt_tokens":18,"total_tokens":24}}
HTTP 200

curl -sS http://localhost:4000/v1/messages -H 'Authorization: Bearer sk-1234' -H 'Content-Type: application/json' \
  -d '{"model":"anthropic-sonnet-5","max_tokens":20,"messages":[{"role":"user","content":"Reply with exactly: messages ok"}]}'

{"model":"anthropic-sonnet-5","id":"msg_011CdiFsB6Ky9mbgHxLCYSEA","type":"message","role":"assistant",
"content":[{"type":"text","text":"messages ok"}],"stop_reason":"end_turn",
"usage":{"input_tokens":18,"output_tokens":6}}
HTTP 200

curl -sS http://localhost:4000/v1/responses -H 'Authorization: Bearer sk-1234' -H 'Content-Type: application/json' \
  -d '{"model":"gpt-5.5","input":"Reply with exactly: responses ok"}'

{"id":"resp_lkDsF5tMbkhfUIjZ...","model":"gpt-5.5","object":"response","status":"completed",
"output":[{"content":[{"text":"responses ok","type":"output_text"}],"role":"assistant","type":"message"}]}
HTTP 200

litellm's own cryptography code exercised end to end. /model/new AESGCM-encrypts the credential through litellm/proxy/common_utils/encrypt_decrypt_utils.py, and calling that model forces the proxy to decrypt it again to reach the provider. This is the one customer-visible path where a cryptography break would show up first:

curl -sS http://localhost:4000/model/new -H 'Authorization: Bearer sk-1234' -H 'Content-Type: application/json' \
  -d "{\"model_name\":\"crypto50-roundtrip\",\"litellm_params\":{\"model\":\"anthropic/claude-haiku-4-5\",\"api_key\":\"$ANTHROPIC_API_KEY\"}}"

{"model_id":"bd55b533-06eb-4434-9be9-252847c93745","model_name":"crypto50-roundtrip",
"litellm_params":{"model":"<AESGCM ciphertext, elided>","api_key":"<AESGCM ciphertext, elided>"}}
HTTP 200

curl -sS http://localhost:4000/v1/chat/completions -H 'Authorization: Bearer sk-1234' -H 'Content-Type: application/json' \
  -d '{"model":"crypto50-roundtrip","messages":[{"role":"user","content":"Reply with exactly: encrypted credential ok"}],"max_tokens":20}'

{"id":"chatcmpl-d23d16d7-30b4-4bdc-8548-2b193ca5b0d1","model":"crypto50-roundtrip","object":"chat.completion",
"choices":[{"finish_reason":"stop","index":0,"message":{"content":"encrypted credential ok","role":"assistant"}}],
"usage":{"completion_tokens":6,"prompt_tokens":14,"total_tokens":20}}
HTTP 200

The stored api_key comes back as ciphertext and the follow-up call still reaches Anthropic, so the AESGCM encrypt, store, decrypt, call round trip works on 50.0.0. The test model was deleted afterwards.

Existing suites were also run green on the new lock: test_handle_jwt.py, test_litellm_license.py, test_mcp_jwt_signer.py, the MCP outbound-credentials pair, test_saml_sso.py, tests/test_litellm/llms/oci/ and test_mlflow.py, for 676 passed.

Type

🚄 Infrastructure

Changes

The proxy extra moves from cryptography>=48.0.1,<49.0 to >=49.0.0,<51.0, and a cryptography>=50.0.0,<51.0 entry joins the existing override-dependencies list next to the packaging/lunary one already there.

The two-part shape is what mlflow forces. mlflow caps cryptography at <50 even in 3.15.1, so publishing a hard >=50 range would leave anyone installing litellm[proxy,mlflow] unable to resolve at all. Publishing >=49.0.0,<51.0 keeps that combination working (it lands on 49.0.0), while override-dependencies is a uv workspace setting that never appears in published metadata, so it holds our own lock and Docker images on 50.0.0 without leaking the constraint downstream.

Overriding mlflow's ceiling is safe rather than merely convenient. mlflow imports only PBKDF2HMAC, AESGCM, Fernet and InvalidTag from cryptography, across two files, and none of those are touched by anything in the 49 or 50 changelogs; that surface was exercised directly on 50.0.0 and test_mlflow.py passes.

Lock delta is five packages: cryptography 48.0.1 -> 50.0.0, the mlflow trio 3.14.0 -> 3.15.0, and msal 1.36.0 -> 1.37.0. msal moves because 1.36.0 carried its own cryptography<49 ceiling, which 1.37.0 lifts to <51

One thing reviewers should know: cryptography 49 dropped its x86_64 macOS and 32-bit Windows wheels. Linux CI and the Docker images are unaffected, but anyone developing on an Intel Mac will build from source on their next uv sync

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[greptile-apps]

Greptile Summary

The PR broadens the published proxy dependency to cryptography 49–50 while using a uv-only override to lock repository builds to cryptography 50.0.0.

• Updates the proxy extra’s published cryptography range to preserve compatibility with the mlflow extra.
• Adds a workspace override that resolves cryptography 50.0.0 for CI, development, and Docker lock-based builds.
• Refreshes the lockfile, including compatible mlflow and msal upgrades required or selected during resolution.

Confidence Score: 5/5

The PR appears safe to merge because the published dependency range remains co-installable with mlflow while repository-managed environments consistently resolve cryptography 50.0.0.

The dependency metadata and lock override implement the intentional split between downstream compatibility and internal version selection, and the available evidence establishes no blocking installation or runtime failure.

Important Files Changed

Filename	Overview
pyproject.toml	Publishes a cryptography range compatible with mlflow while adding a uv-only floor for repository-managed environments; no actionable defect was found.
uv.lock	Resolves cryptography 50.0.0 and refreshes mlflow and msal within their declared ranges; no concrete compatibility failure was established.

_{Reviews (1): Last reviewed commit: "chore(deps): upgrade cryptography to 50...." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_/cryptography-50-upgrade-a69eb2 (2c63a41) with litellm_internal_staging (355ae99)}