fix(security): upgrade cryptography to 50.0.0

[seonghobae]

Summary

Remediate CVE-2026-69247 / GHSA-g6cj-pr64-35w5, a high-severity Bleichenbacher-oracle issue affecting cryptography >=44.0.0,<50.0.0, and synchronize the exact frontend lock with current scanner fixes discovered while validating the same head.

This exact branch now commits the remediation directly:

• pins the backend runtime, project metadata, uv lock, hash-locked pip requirements, and Strix CI surface to cryptography==50.0.0;
• restores the Strix-only protobuf==6.33.6 constraint because google-cloud-aiplatform==1.160.0 requires protobuf <7 while the backend remains on protobuf==7.35.1;
• regenerates both governed Python hash locks with a supported uv Linux target;
• removes the failed self-mutating materializer workflow/helper so the checked commit is the same commit that contains the dependency changes;
• moves PostCSS from the stale locked 8.5.18 to 8.5.24 for CVE-2026-69153;
• moves brace-expansion from 5.0.8 to 5.0.9 for GHSA-rgw5-rvv9-x895, and jsdom / undici to 30.0.1 / 8.9.0 for the newly disclosed Undici advisories;
• adds parsed release-governance contracts that bind all manifest, workspace, lock, and snapshot surfaces to the fixed versions.

Security boundary

No vulnerability suppression, Trivy exception, release-age bypass, gate weakening, or source-data mutation is introduced. Runtime Fernet encryption/decryption and key-rotation behavior remains covered by the existing test suite.

Local verification at dbfa8a94160d500830be39309bb31e853ea7b951

• TDD red: the Python contract failed against cryptography==49.0.0; the frontend contracts failed against the stale PostCSS, jsdom, Undici, and brace-expansion lock state before their fixes.
• uv lock --check: pass.
• Runtime import: cryptography.__version__ == "50.0.0".
• Backend full suite with warnings as errors: 1685 passed, 33 skipped.
• Release governance: 37 passed.
• Fernet/runtime-secret focused tests: 23 passed.
• Backend and Strix uv pip install --dry-run --require-hashes: pass, resolving 105 and 102 packages.
• Frontend: 49 test files / 427 tests pass; ESLint, TypeScript, frozen pnpm install, and Next.js production build pass.
• pnpm audit --audit-level=moderate: zero advisories after the fix; before the fix it reported four Moderate and two High advisories.
• Current Trivy filesystem scan with vulnerability, secret, and misconfiguration scanners at Medium/High/Critical: zero findings.
• Exact GitHub synthetic merge ref db3078af7c624355457601716f28be2df2f294c7 (parents c8ef4164... and dbfa8a94...): current Trivy vulnerability, secret, and misconfiguration scan at Medium/High/Critical returned zero findings.
• Ruff changed-file checks and format check: pass.
• git diff --check: pass.

The exact current head has passed Application CI, Dependency Review, Bandit, Semgrep, Docker-image validation, and the repository Security Scan. The PR is ready for independent review and protected auto-merge.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 323347de-a84d-4fc9-98ab-ce708e302a85

📥 Commits

Reviewing files that changed from the base of the PR and between c8ef416 and dbfa8a9.

⛔ Files ignored due to path filters (2)

• backend/uv.lock is excluded by !**/*.lock
• frontend/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (9)

• CHANGELOG.md
• backend/pyproject.toml
• backend/requirements-hashes.txt
• backend/requirements.txt
• backend/tests/test_release_governance.py
• frontend/package.json
• frontend/pnpm-workspace.yaml
• requirements-strix-ci-hashes.txt
• requirements-strix-ci.txt

---

📝 Walkthrough

Walkthrough

The PR updates Python and frontend security dependency pins, regenerates affected hashes and lockfiles, expands release-governance checks, and records the changes in the security changelog.

Changes

Dependency synchronization

Layer / File(s)	Summary
Python dependency and Strix lock updates backend/pyproject.toml, backend/requirements*.txt, requirements-strix-ci*.txt	Updates cryptography to 50.0.0 and Strix protobuf to 6.33.6. Regenerates hashes and adjusts related locked packages.
Frontend audit dependency overrides frontend/package.json, frontend/pnpm-workspace.yaml	Updates jsdom, brace-expansion, postcss, and undici constraints and overrides.
Governance checks and security changelog backend/tests/test_release_governance.py, CHANGELOG.md	Adds cross-file version checks for Python and frontend dependencies and documents the security updates.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• ContextualWisdomLab/naruon#1173: Updates overlapping frontend dependency overrides, including postcss and brace-expansion.
• ContextualWisdomLab/naruon#1224: Updates jsdom and frontend PostCSS constraints.
• ContextualWisdomLab/naruon#1230: Updates the frontend jsdom dependency to 30.0.1.

Suggested labels: dependencies, python, javascript

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary security change: upgrading cryptography to 50.0.0.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/cryptography-50-bleichenbacher

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR governance metadata gate update for dbfa8a94160d500830be39309bb31e853ea7b951: no current blocking failures remain.

PR governance metadata gate is waiting on current-head requirements; see the latest check for pending reasons.

[seonghobae]

@coderabbitai review

Please review the exact current head dbfa8a94160d500830be39309bb31e853ea7b951 after the completed security and dependency remediation. All repository GitHub Actions checks on this head are green; there are no unresolved review threads.

[coderabbitai]

@seonghobae I will review pull request #1232 at commit dbfa8a94160d500830be39309bb31e853ea7b951.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.