From cf446f2c8a8642272a44afad9eae76d60ec9aedc Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 12:31:21 +0900
Subject: [PATCH 1/7] ci: materialize cryptography 50 security remediation

---
 .../security-cryptography-50-materialize.yml  | 247 ++++++++++++++++++
 1 file changed, 247 insertions(+)
 create mode 100644 .github/workflows/security-cryptography-50-materialize.yml

diff --git a/.github/workflows/security-cryptography-50-materialize.yml b/.github/workflows/security-cryptography-50-materialize.yml
new file mode 100644
index 000000000..5aeec6330
--- /dev/null
+++ b/.github/workflows/security-cryptography-50-materialize.yml
@@ -0,0 +1,247 @@
+name: Materialize cryptography 50 security remediation
+
+on:
+  push:
+    branches:
+      - fix/cryptography-50-bleichenbacher
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-cryptography-50-materialize
+  cancel-in-progress: true
+
+jobs:
+  materialize:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: write
+    env:
+      PYTHONWARNINGS: error
+      DISABLE_BACKGROUND_WORKERS: "1"
+      UV_VERSION: "0.11.29"
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout remediation branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: fix/cryptography-50-bleichenbacher
+          fetch-depth: 0
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: ${{ env.UV_VERSION }}
+          enable-cache: true
+          cache-dependency-glob: |
+            backend/uv.lock
+            backend/requirements-hashes.txt
+            requirements-strix-ci-hashes.txt
+
+      - name: Install supported Python runtimes
+        run: uv python install 3.13 3.14
+
+      - name: Add the failing security-contract test first
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          from pathlib import Path
+
+          test_path = Path("backend/tests/test_release_governance.py")
+          text = test_path.read_text(encoding="utf-8")
+          text = text.replace("cryptography==49.0.0", "cryptography==50.0.0")
+          test_name = "test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed"
+          if test_name not in text:
+              text += '''
+
+
+def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
+    """Require every governed Python surface to use the first oracle-safe release."""
+    backend_requirements = read_repo_text("backend/requirements.txt")
+    backend_project = read_repo_text("backend/pyproject.toml")
+    backend_lock = read_repo_text("backend/uv.lock")
+    backend_hashes = read_repo_text("backend/requirements-hashes.txt")
+    strix_requirements = read_repo_text("requirements-strix-ci.txt")
+    strix_hashes = read_repo_text("requirements-strix-ci-hashes.txt")
+
+    governed_text = "\n".join(
+        (
+            backend_requirements,
+            backend_project,
+            backend_lock,
+            backend_hashes,
+            strix_requirements,
+            strix_hashes,
+        )
+    )
+    assert "cryptography==49.0.0" not in governed_text
+    assert "cryptography==50.0.0" in backend_requirements
+    assert '"cryptography==50.0.0"' in backend_project
+    assert "cryptography==50.0.0" in backend_hashes
+    assert "cryptography==50.0.0" in strix_requirements
+    assert "cryptography==50.0.0" in strix_hashes
+    assert re.search(
+        r'(?ms)^\[\[package\]\]\nname = "cryptography"\nversion = "50\\.0\\.0"$',
+        backend_lock,
+    )
+'''
+          test_path.write_text(text, encoding="utf-8")
+          PY
+          set +e
+          uv run --project backend --frozen python -m pytest -q \
+            backend/tests/test_release_governance.py::test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed
+          red_status=$?
+          set -e
+          if [ "$red_status" -eq 0 ]; then
+            echo "::error::The security regression test unexpectedly passed before remediation."
+            exit 1
+          fi
+
+      - name: Update direct security constraints and changelog
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          from pathlib import Path
+
+          governed_paths = (
+              Path("backend/requirements.txt"),
+              Path("backend/pyproject.toml"),
+              Path("requirements-strix-ci.txt"),
+          )
+          for path in governed_paths:
+              text = path.read_text(encoding="utf-8")
+              count = text.count("cryptography==49.0.0")
+              if count != 1:
+                  raise SystemExit(f"expected one cryptography 49 pin in {path}, found {count}")
+              path.write_text(
+                  text.replace("cryptography==49.0.0", "cryptography==50.0.0", 1),
+                  encoding="utf-8",
+              )
+
+          changelog_path = Path("CHANGELOG.md")
+          changelog = changelog_path.read_text(encoding="utf-8")
+          bullet = (
+              "- `cryptography`를 `50.0.0`으로 갱신해 공격자 제공 PKCS#7 "
+              "EnvelopedData 복호화 결과의 오류·타이밍 차이로 발생하는 "
+              "Bleichenbacher oracle(`CVE-2026-69247`, `GHSA-g6cj-pr64-35w5`)을 "
+              "제거하고, backend·uv lock·hash lock·Strix CI 의존성 증거를 같은 "
+              "버전으로 동기화했습니다.\n"
+          )
+          if bullet not in changelog:
+              marker = "### 보안 패치 (CodeQL extended current-head)\n\n"
+              if changelog.count(marker) != 1:
+                  raise SystemExit("Unreleased security changelog marker not found exactly once")
+              changelog = changelog.replace(marker, marker + bullet, 1)
+          changelog_path.write_text(changelog, encoding="utf-8")
+          PY
+
+      - name: Regenerate uv and pip hash locks
+        shell: bash
+        run: |
+          set -euo pipefail
+          (
+            cd backend
+            uv lock --upgrade-package cryptography
+            uv lock --check
+          )
+          uv pip compile \
+            --generate-hashes \
+            --python-version 3.14 \
+            --python-platform x86_64-manylinux_2_28 \
+            --upgrade-package cryptography \
+            --output-file backend/requirements-hashes.txt \
+            backend/requirements.txt
+          uv pip compile \
+            --generate-hashes \
+            --python-version 3.13 \
+            --python-platform x86_64-manylinux_2_28 \
+            --upgrade-package cryptography \
+            --output-file requirements-strix-ci-hashes.txt \
+            requirements-strix-ci.txt
+
+      - name: Verify deterministic locks and focused security contract
+        shell: bash
+        run: |
+          set -euo pipefail
+          ! grep -R -F 'cryptography==49.0.0' \
+            backend/requirements.txt \
+            backend/pyproject.toml \
+            backend/uv.lock \
+            backend/requirements-hashes.txt \
+            requirements-strix-ci.txt \
+            requirements-strix-ci-hashes.txt \
+            backend/tests/test_release_governance.py
+          grep -F 'cryptography==50.0.0' backend/requirements.txt
+          grep -F 'cryptography==50.0.0' backend/requirements-hashes.txt
+          grep -F 'cryptography==50.0.0' requirements-strix-ci.txt
+          grep -F 'cryptography==50.0.0' requirements-strix-ci-hashes.txt
+          grep -A2 -F 'name = "cryptography"' backend/uv.lock | grep -F 'version = "50.0.0"'
+          uv run --project backend --locked ruff check tests/test_release_governance.py
+          uv run --project backend --locked ruff format --check tests/test_release_governance.py
+          uv run --project backend --locked python -m pytest -q tests/test_release_governance.py
+
+      - name: Verify hash-locked runtime installation on Python 3.14
+        shell: bash
+        run: |
+          set -euo pipefail
+          uv venv --python 3.14 .venv-security-backend
+          uv pip install \
+            --python .venv-security-backend/bin/python \
+            --require-hashes \
+            -r backend/requirements-hashes.txt
+          .venv-security-backend/bin/python - <<'PY'
+          import cryptography
+
+          assert cryptography.__version__ == "50.0.0"
+          PY
+
+      - name: Verify hash-locked Strix CI installation on Python 3.13
+        shell: bash
+        run: |
+          set -euo pipefail
+          uv venv --python 3.13 .venv-security-strix
+          uv pip install \
+            --python .venv-security-strix/bin/python \
+            --require-hashes \
+            -r requirements-strix-ci-hashes.txt
+          .venv-security-strix/bin/python - <<'PY'
+          import cryptography
+
+          assert cryptography.__version__ == "50.0.0"
+          PY
+
+      - name: Run the full backend regression suite
+        shell: bash
+        run: |
+          set -euo pipefail
+          uv run --project backend --locked python -m pytest -q
+
+      - name: Commit verified remediation and remove temporary workflow
+        shell: bash
+        run: |
+          set -euo pipefail
+          rm -rf .venv-security-backend .venv-security-strix
+          rm -- .github/workflows/security-cryptography-50-materialize.yml
+          git diff --check
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add \
+            CHANGELOG.md \
+            backend/pyproject.toml \
+            backend/uv.lock \
+            backend/requirements.txt \
+            backend/requirements-hashes.txt \
+            backend/tests/test_release_governance.py \
+            requirements-strix-ci.txt \
+            requirements-strix-ci-hashes.txt \
+            .github/workflows/security-cryptography-50-materialize.yml
+          git commit -m "fix(security): upgrade cryptography to 50.0.0"
+          git push origin HEAD:fix/cryptography-50-bleichenbacher

From 9ed6358cd7008bf79b575c35cd1a1a1b79b61386 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 12:47:17 +0900
Subject: [PATCH 2/7] ci: repair cryptography 50 materialization workflow

---
 .../security-cryptography-50-materialize.yml  | 88 ++++++++++++-------
 1 file changed, 54 insertions(+), 34 deletions(-)

diff --git a/.github/workflows/security-cryptography-50-materialize.yml b/.github/workflows/security-cryptography-50-materialize.yml
index 5aeec6330..a34ea5042 100644
--- a/.github/workflows/security-cryptography-50-materialize.yml
+++ b/.github/workflows/security-cryptography-50-materialize.yml
@@ -21,7 +21,6 @@ jobs:
     env:
       PYTHONWARNINGS: error
       DISABLE_BACKGROUND_WORKERS: "1"
-      UV_VERSION: "0.11.29"
     steps:
       - name: Harden runner
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
@@ -37,17 +36,23 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
-          version: ${{ env.UV_VERSION }}
-          enable-cache: true
-          cache-dependency-glob: |
-            backend/uv.lock
-            backend/requirements-hashes.txt
-            requirements-strix-ci-hashes.txt
+          version: "0.11.29"
 
       - name: Install supported Python runtimes
         run: uv python install 3.13 3.14
 
-      - name: Add the failing security-contract test first
+      - name: Detect whether materialization is required
+        id: state
+        shell: bash
+        run: |
+          if grep -Fq 'cryptography==50.0.0' backend/requirements.txt; then
+            echo 'required=false' >> "$GITHUB_OUTPUT"
+          else
+            echo 'required=true' >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Add and prove the failing security contract
+        if: steps.state.outputs.required == 'true'
         shell: bash
         run: |
           set -euo pipefail
@@ -56,7 +61,8 @@ jobs:
 
           test_path = Path("backend/tests/test_release_governance.py")
           text = test_path.read_text(encoding="utf-8")
-          text = text.replace("cryptography==49.0.0", "cryptography==50.0.0")
+          if "import tomllib\n" not in text:
+              text = text.replace("import sys\n", "import sys\nimport tomllib\n", 1)
           test_name = "test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed"
           if test_name not in text:
               text += '''
@@ -66,7 +72,7 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
     """Require every governed Python surface to use the first oracle-safe release."""
     backend_requirements = read_repo_text("backend/requirements.txt")
     backend_project = read_repo_text("backend/pyproject.toml")
-    backend_lock = read_repo_text("backend/uv.lock")
+    backend_lock = tomllib.loads(read_repo_text("backend/uv.lock"))
     backend_hashes = read_repo_text("backend/requirements-hashes.txt")
     strix_requirements = read_repo_text("requirements-strix-ci.txt")
     strix_hashes = read_repo_text("requirements-strix-ci-hashes.txt")
@@ -75,7 +81,6 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
         (
             backend_requirements,
             backend_project,
-            backend_lock,
             backend_hashes,
             strix_requirements,
             strix_hashes,
@@ -87,16 +92,21 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
     assert "cryptography==50.0.0" in backend_hashes
     assert "cryptography==50.0.0" in strix_requirements
     assert "cryptography==50.0.0" in strix_hashes
-    assert re.search(
-        r'(?ms)^\[\[package\]\]\nname = "cryptography"\nversion = "50\\.0\\.0"$',
-        backend_lock,
-    )
+    cryptography_versions = {
+        package["version"]
+        for package in backend_lock["package"]
+        if package["name"] == "cryptography"
+    }
+    assert cryptography_versions == {"50.0.0"}
 '''
           test_path.write_text(text, encoding="utf-8")
           PY
           set +e
-          uv run --project backend --frozen python -m pytest -q \
-            backend/tests/test_release_governance.py::test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed
+          (
+            cd backend
+            uv run --frozen python -m pytest -q \
+              tests/test_release_governance.py::test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed
+          )
           red_status=$?
           set -e
           if [ "$red_status" -eq 0 ]; then
@@ -104,7 +114,8 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
             exit 1
           fi
 
-      - name: Update direct security constraints and changelog
+      - name: Update governed security constraints and changelog
+        if: steps.state.outputs.required == 'true'
         shell: bash
         run: |
           set -euo pipefail
@@ -115,14 +126,14 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
               Path("backend/requirements.txt"),
               Path("backend/pyproject.toml"),
               Path("requirements-strix-ci.txt"),
+              Path("backend/tests/test_release_governance.py"),
           )
           for path in governed_paths:
               text = path.read_text(encoding="utf-8")
-              count = text.count("cryptography==49.0.0")
-              if count != 1:
-                  raise SystemExit(f"expected one cryptography 49 pin in {path}, found {count}")
+              if "cryptography==49.0.0" not in text:
+                  raise SystemExit(f"cryptography 49 pin is missing from {path}")
               path.write_text(
-                  text.replace("cryptography==49.0.0", "cryptography==50.0.0", 1),
+                  text.replace("cryptography==49.0.0", "cryptography==50.0.0"),
                   encoding="utf-8",
               )
 
@@ -144,6 +155,7 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
           PY
 
       - name: Regenerate uv and pip hash locks
+        if: steps.state.outputs.required == 'true'
         shell: bash
         run: |
           set -euo pipefail
@@ -167,7 +179,8 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
             --output-file requirements-strix-ci-hashes.txt \
             requirements-strix-ci.txt
 
-      - name: Verify deterministic locks and focused security contract
+      - name: Verify deterministic locks and focused governance
+        if: steps.state.outputs.required == 'true'
         shell: bash
         run: |
           set -euo pipefail
@@ -183,12 +196,17 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
           grep -F 'cryptography==50.0.0' backend/requirements-hashes.txt
           grep -F 'cryptography==50.0.0' requirements-strix-ci.txt
           grep -F 'cryptography==50.0.0' requirements-strix-ci-hashes.txt
-          grep -A2 -F 'name = "cryptography"' backend/uv.lock | grep -F 'version = "50.0.0"'
-          uv run --project backend --locked ruff check tests/test_release_governance.py
-          uv run --project backend --locked ruff format --check tests/test_release_governance.py
-          uv run --project backend --locked python -m pytest -q tests/test_release_governance.py
+          (
+            cd backend
+            uv run --locked ruff check --fix tests/test_release_governance.py
+            uv run --locked ruff format tests/test_release_governance.py
+            uv run --locked ruff check tests/test_release_governance.py
+            uv run --locked ruff format --check tests/test_release_governance.py
+            uv run --locked python -m pytest -q tests/test_release_governance.py
+          )
 
-      - name: Verify hash-locked runtime installation on Python 3.14
+      - name: Verify hash-locked backend installation
+        if: steps.state.outputs.required == 'true'
         shell: bash
         run: |
           set -euo pipefail
@@ -203,7 +221,8 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
           assert cryptography.__version__ == "50.0.0"
           PY
 
-      - name: Verify hash-locked Strix CI installation on Python 3.13
+      - name: Verify hash-locked Strix CI installation
+        if: steps.state.outputs.required == 'true'
         shell: bash
         run: |
           set -euo pipefail
@@ -219,17 +238,19 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
           PY
 
       - name: Run the full backend regression suite
+        if: steps.state.outputs.required == 'true'
         shell: bash
         run: |
           set -euo pipefail
-          uv run --project backend --locked python -m pytest -q
+          cd backend
+          uv run --locked python -m pytest -q
 
-      - name: Commit verified remediation and remove temporary workflow
+      - name: Commit verified remediation
+        if: steps.state.outputs.required == 'true'
         shell: bash
         run: |
           set -euo pipefail
           rm -rf .venv-security-backend .venv-security-strix
-          rm -- .github/workflows/security-cryptography-50-materialize.yml
           git diff --check
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
@@ -241,7 +262,6 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
             backend/requirements-hashes.txt \
             backend/tests/test_release_governance.py \
             requirements-strix-ci.txt \
-            requirements-strix-ci-hashes.txt \
-            .github/workflows/security-cryptography-50-materialize.yml
+            requirements-strix-ci-hashes.txt
           git commit -m "fix(security): upgrade cryptography to 50.0.0"
           git push origin HEAD:fix/cryptography-50-bleichenbacher

From 83f9f73b2de6ecac16f49c26a7c8fa2e2b7a181e Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 12:51:14 +0900
Subject: [PATCH 3/7] ci: run cryptography materializer on PR events

---
 .../security-cryptography-50-materialize.yml  | 24 ++++++++++---------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/security-cryptography-50-materialize.yml b/.github/workflows/security-cryptography-50-materialize.yml
index a34ea5042..b332431c1 100644
--- a/.github/workflows/security-cryptography-50-materialize.yml
+++ b/.github/workflows/security-cryptography-50-materialize.yml
@@ -1,19 +1,21 @@
 name: Materialize cryptography 50 security remediation
 
 on:
-  push:
+  pull_request:
     branches:
-      - fix/cryptography-50-bleichenbacher
+      - develop
+    types: [opened, reopened, synchronize]
 
 permissions:
   contents: read
 
 concurrency:
-  group: security-cryptography-50-materialize
+  group: security-cryptography-50-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
 jobs:
   materialize:
+    if: ${{ github.event.pull_request.head.ref == 'fix/cryptography-50-bleichenbacher' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     permissions:
@@ -52,7 +54,7 @@ jobs:
           fi
 
       - name: Add and prove the failing security contract
-        if: steps.state.outputs.required == 'true'
+        if: ${{ steps.state.outputs.required == 'true' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -115,7 +117,7 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
           fi
 
       - name: Update governed security constraints and changelog
-        if: steps.state.outputs.required == 'true'
+        if: ${{ steps.state.outputs.required == 'true' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -155,7 +157,7 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
           PY
 
       - name: Regenerate uv and pip hash locks
-        if: steps.state.outputs.required == 'true'
+        if: ${{ steps.state.outputs.required == 'true' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -180,7 +182,7 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
             requirements-strix-ci.txt
 
       - name: Verify deterministic locks and focused governance
-        if: steps.state.outputs.required == 'true'
+        if: ${{ steps.state.outputs.required == 'true' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -206,7 +208,7 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
           )
 
       - name: Verify hash-locked backend installation
-        if: steps.state.outputs.required == 'true'
+        if: ${{ steps.state.outputs.required == 'true' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -222,7 +224,7 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
           PY
 
       - name: Verify hash-locked Strix CI installation
-        if: steps.state.outputs.required == 'true'
+        if: ${{ steps.state.outputs.required == 'true' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -238,7 +240,7 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
           PY
 
       - name: Run the full backend regression suite
-        if: steps.state.outputs.required == 'true'
+        if: ${{ steps.state.outputs.required == 'true' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -246,7 +248,7 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
           uv run --locked python -m pytest -q
 
       - name: Commit verified remediation
-        if: steps.state.outputs.required == 'true'
+        if: ${{ steps.state.outputs.required == 'true' }}
         shell: bash
         run: |
           set -euo pipefail

From a5b508602764a62b37bf0b69a9f6ca8a6201d275 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 12:55:31 +0900
Subject: [PATCH 4/7] ci: add deterministic cryptography remediation helper

---
 .../scripts/materialize_cryptography_50.py    | 122 ++++++++++++++++++
 1 file changed, 122 insertions(+)
 create mode 100644 .github/scripts/materialize_cryptography_50.py

diff --git a/.github/scripts/materialize_cryptography_50.py b/.github/scripts/materialize_cryptography_50.py
new file mode 100644
index 000000000..793db3cfd
--- /dev/null
+++ b/.github/scripts/materialize_cryptography_50.py
@@ -0,0 +1,122 @@
+#!/usr/bin/env python3
+"""Materialize the cryptography 50 security remediation on its isolated branch.
+
+The script keeps source mutation reviewable and deterministic while the
+one-shot GitHub workflow supplies the supported Python runtimes, regenerates
+locks, and executes the complete verification matrix.
+"""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[2]
+RELEASE_GOVERNANCE_TEST = REPOSITORY_ROOT / "backend/tests/test_release_governance.py"
+CRYPTOGRAPHY_OLD_PIN = "cryptography==49.0.0"
+CRYPTOGRAPHY_NEW_PIN = "cryptography==50.0.0"
+TEST_NAME = "test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed"
+TEST_SOURCE = '''
+
+
+def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
+    """Require every governed Python surface to use the first oracle-safe release."""
+    backend_requirements = read_repo_text("backend/requirements.txt")
+    backend_project = read_repo_text("backend/pyproject.toml")
+    backend_lock = tomllib.loads(read_repo_text("backend/uv.lock"))
+    backend_hashes = read_repo_text("backend/requirements-hashes.txt")
+    strix_requirements = read_repo_text("requirements-strix-ci.txt")
+    strix_hashes = read_repo_text("requirements-strix-ci-hashes.txt")
+
+    governed_text = "\\n".join(
+        (
+            backend_requirements,
+            backend_project,
+            backend_hashes,
+            strix_requirements,
+            strix_hashes,
+        )
+    )
+    assert "cryptography==49.0.0" not in governed_text
+    assert "cryptography==50.0.0" in backend_requirements
+    assert '"cryptography==50.0.0"' in backend_project
+    assert "cryptography==50.0.0" in backend_hashes
+    assert "cryptography==50.0.0" in strix_requirements
+    assert "cryptography==50.0.0" in strix_hashes
+    cryptography_versions = {
+        package["version"]
+        for package in backend_lock["package"]
+        if package["name"] == "cryptography"
+    }
+    assert cryptography_versions == {"50.0.0"}
+'''
+CHANGELOG_BULLET = (
+    "- `cryptography`를 `50.0.0`으로 갱신해 공격자 제공 PKCS#7 "
+    "EnvelopedData 복호화 결과의 오류·타이밍 차이로 발생하는 "
+    "Bleichenbacher oracle(`CVE-2026-69247`, `GHSA-g6cj-pr64-35w5`)을 "
+    "제거하고, backend·uv lock·hash lock·Strix CI 의존성 증거를 같은 "
+    "버전으로 동기화했습니다.\n"
+)
+CHANGELOG_MARKER = "### 보안 패치 (CodeQL extended current-head)\n\n"
+
+
+def add_failing_test() -> None:
+    """Add the security regression test without changing vulnerable pins."""
+    text = RELEASE_GOVERNANCE_TEST.read_text(encoding="utf-8")
+    if "import tomllib\n" not in text:
+        import_anchor = "import sys\n"
+        if text.count(import_anchor) != 1:
+            raise RuntimeError("tomllib import anchor was not found exactly once")
+        text = text.replace(import_anchor, import_anchor + "import tomllib\n", 1)
+    if TEST_NAME not in text:
+        text += TEST_SOURCE
+    RELEASE_GOVERNANCE_TEST.write_text(text, encoding="utf-8")
+
+
+def replace_pin(path: Path) -> None:
+    """Replace every governed cryptography 49 pin in one text artifact."""
+    text = path.read_text(encoding="utf-8")
+    if CRYPTOGRAPHY_OLD_PIN not in text:
+        raise RuntimeError(f"cryptography 49 pin is missing from {path}")
+    path.write_text(
+        text.replace(CRYPTOGRAPHY_OLD_PIN, CRYPTOGRAPHY_NEW_PIN),
+        encoding="utf-8",
+    )
+
+
+def apply_remediation() -> None:
+    """Update governed pins, the regression expectation, and CHANGELOG."""
+    for relative_path in (
+        "backend/requirements.txt",
+        "backend/pyproject.toml",
+        "requirements-strix-ci.txt",
+        "backend/tests/test_release_governance.py",
+    ):
+        replace_pin(REPOSITORY_ROOT / relative_path)
+
+    changelog_path = REPOSITORY_ROOT / "CHANGELOG.md"
+    changelog = changelog_path.read_text(encoding="utf-8")
+    if CHANGELOG_BULLET not in changelog:
+        if changelog.count(CHANGELOG_MARKER) != 1:
+            raise RuntimeError("Unreleased security changelog marker was not found once")
+        changelog = changelog.replace(
+            CHANGELOG_MARKER,
+            CHANGELOG_MARKER + CHANGELOG_BULLET,
+            1,
+        )
+    changelog_path.write_text(changelog, encoding="utf-8")
+
+
+def main() -> None:
+    """Dispatch the requested deterministic materialization phase."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("phase", choices=("add-test", "apply"))
+    args = parser.parse_args()
+    if args.phase == "add-test":
+        add_failing_test()
+    else:
+        apply_remediation()
+
+
+if __name__ == "__main__":
+    main()

From 22c18ee0c66562edaffc512b10b560030e3572f8 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 12:57:15 +0900
Subject: [PATCH 5/7] ci: move cryptography materialization logic into helper

---
 .../security-cryptography-50-materialize.yml  | 115 ++----------------
 1 file changed, 7 insertions(+), 108 deletions(-)

diff --git a/.github/workflows/security-cryptography-50-materialize.yml b/.github/workflows/security-cryptography-50-materialize.yml
index b332431c1..7b74fc5ec 100644
--- a/.github/workflows/security-cryptography-50-materialize.yml
+++ b/.github/workflows/security-cryptography-50-materialize.yml
@@ -45,7 +45,6 @@ jobs:
 
       - name: Detect whether materialization is required
         id: state
-        shell: bash
         run: |
           if grep -Fq 'cryptography==50.0.0' backend/requirements.txt; then
             echo 'required=false' >> "$GITHUB_OUTPUT"
@@ -55,54 +54,9 @@ jobs:
 
       - name: Add and prove the failing security contract
         if: ${{ steps.state.outputs.required == 'true' }}
-        shell: bash
         run: |
           set -euo pipefail
-          python3 - <<'PY'
-          from pathlib import Path
-
-          test_path = Path("backend/tests/test_release_governance.py")
-          text = test_path.read_text(encoding="utf-8")
-          if "import tomllib\n" not in text:
-              text = text.replace("import sys\n", "import sys\nimport tomllib\n", 1)
-          test_name = "test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed"
-          if test_name not in text:
-              text += '''
-
-
-def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
-    """Require every governed Python surface to use the first oracle-safe release."""
-    backend_requirements = read_repo_text("backend/requirements.txt")
-    backend_project = read_repo_text("backend/pyproject.toml")
-    backend_lock = tomllib.loads(read_repo_text("backend/uv.lock"))
-    backend_hashes = read_repo_text("backend/requirements-hashes.txt")
-    strix_requirements = read_repo_text("requirements-strix-ci.txt")
-    strix_hashes = read_repo_text("requirements-strix-ci-hashes.txt")
-
-    governed_text = "\n".join(
-        (
-            backend_requirements,
-            backend_project,
-            backend_hashes,
-            strix_requirements,
-            strix_hashes,
-        )
-    )
-    assert "cryptography==49.0.0" not in governed_text
-    assert "cryptography==50.0.0" in backend_requirements
-    assert '"cryptography==50.0.0"' in backend_project
-    assert "cryptography==50.0.0" in backend_hashes
-    assert "cryptography==50.0.0" in strix_requirements
-    assert "cryptography==50.0.0" in strix_hashes
-    cryptography_versions = {
-        package["version"]
-        for package in backend_lock["package"]
-        if package["name"] == "cryptography"
-    }
-    assert cryptography_versions == {"50.0.0"}
-'''
-          test_path.write_text(text, encoding="utf-8")
-          PY
+          python .github/scripts/materialize_cryptography_50.py add-test
           set +e
           (
             cd backend
@@ -118,47 +72,10 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
 
       - name: Update governed security constraints and changelog
         if: ${{ steps.state.outputs.required == 'true' }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          python3 - <<'PY'
-          from pathlib import Path
-
-          governed_paths = (
-              Path("backend/requirements.txt"),
-              Path("backend/pyproject.toml"),
-              Path("requirements-strix-ci.txt"),
-              Path("backend/tests/test_release_governance.py"),
-          )
-          for path in governed_paths:
-              text = path.read_text(encoding="utf-8")
-              if "cryptography==49.0.0" not in text:
-                  raise SystemExit(f"cryptography 49 pin is missing from {path}")
-              path.write_text(
-                  text.replace("cryptography==49.0.0", "cryptography==50.0.0"),
-                  encoding="utf-8",
-              )
-
-          changelog_path = Path("CHANGELOG.md")
-          changelog = changelog_path.read_text(encoding="utf-8")
-          bullet = (
-              "- `cryptography`를 `50.0.0`으로 갱신해 공격자 제공 PKCS#7 "
-              "EnvelopedData 복호화 결과의 오류·타이밍 차이로 발생하는 "
-              "Bleichenbacher oracle(`CVE-2026-69247`, `GHSA-g6cj-pr64-35w5`)을 "
-              "제거하고, backend·uv lock·hash lock·Strix CI 의존성 증거를 같은 "
-              "버전으로 동기화했습니다.\n"
-          )
-          if bullet not in changelog:
-              marker = "### 보안 패치 (CodeQL extended current-head)\n\n"
-              if changelog.count(marker) != 1:
-                  raise SystemExit("Unreleased security changelog marker not found exactly once")
-              changelog = changelog.replace(marker, marker + bullet, 1)
-          changelog_path.write_text(changelog, encoding="utf-8")
-          PY
+        run: python .github/scripts/materialize_cryptography_50.py apply
 
       - name: Regenerate uv and pip hash locks
         if: ${{ steps.state.outputs.required == 'true' }}
-        shell: bash
         run: |
           set -euo pipefail
           (
@@ -183,7 +100,6 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
 
       - name: Verify deterministic locks and focused governance
         if: ${{ steps.state.outputs.required == 'true' }}
-        shell: bash
         run: |
           set -euo pipefail
           ! grep -R -F 'cryptography==49.0.0' \
@@ -194,10 +110,6 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
             requirements-strix-ci.txt \
             requirements-strix-ci-hashes.txt \
             backend/tests/test_release_governance.py
-          grep -F 'cryptography==50.0.0' backend/requirements.txt
-          grep -F 'cryptography==50.0.0' backend/requirements-hashes.txt
-          grep -F 'cryptography==50.0.0' requirements-strix-ci.txt
-          grep -F 'cryptography==50.0.0' requirements-strix-ci-hashes.txt
           (
             cd backend
             uv run --locked ruff check --fix tests/test_release_governance.py
@@ -209,7 +121,6 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
 
       - name: Verify hash-locked backend installation
         if: ${{ steps.state.outputs.required == 'true' }}
-        shell: bash
         run: |
           set -euo pipefail
           uv venv --python 3.14 .venv-security-backend
@@ -217,15 +128,11 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
             --python .venv-security-backend/bin/python \
             --require-hashes \
             -r backend/requirements-hashes.txt
-          .venv-security-backend/bin/python - <<'PY'
-          import cryptography
-
-          assert cryptography.__version__ == "50.0.0"
-          PY
+          .venv-security-backend/bin/python -c \
+            'import cryptography; assert cryptography.__version__ == "50.0.0"'
 
       - name: Verify hash-locked Strix CI installation
         if: ${{ steps.state.outputs.required == 'true' }}
-        shell: bash
         run: |
           set -euo pipefail
           uv venv --python 3.13 .venv-security-strix
@@ -233,23 +140,15 @@ def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
             --python .venv-security-strix/bin/python \
             --require-hashes \
             -r requirements-strix-ci-hashes.txt
-          .venv-security-strix/bin/python - <<'PY'
-          import cryptography
-
-          assert cryptography.__version__ == "50.0.0"
-          PY
+          .venv-security-strix/bin/python -c \
+            'import cryptography; assert cryptography.__version__ == "50.0.0"'
 
       - name: Run the full backend regression suite
         if: ${{ steps.state.outputs.required == 'true' }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          cd backend
-          uv run --locked python -m pytest -q
+        run: cd backend && uv run --locked python -m pytest -q
 
       - name: Commit verified remediation
         if: ${{ steps.state.outputs.required == 'true' }}
-        shell: bash
         run: |
           set -euo pipefail
           rm -rf .venv-security-backend .venv-security-strix

From 17d0af1dec92c543ec0a0f97f9e0e796492fdb35 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 13:24:15 +0900
Subject: [PATCH 6/7] fix(security): materialize cryptography 50 remediation

---
 .../scripts/materialize_cryptography_50.py    | 122 ----
 .../security-cryptography-50-materialize.yml  | 168 ------
 CHANGELOG.md                                  |   1 +
 backend/pyproject.toml                        |   2 +-
 backend/requirements-hashes.txt               |  96 +--
 backend/requirements.txt                      |   2 +-
 backend/tests/test_release_governance.py      |  40 +-
 backend/uv.lock                               |  86 +--
 requirements-strix-ci-hashes.txt              | 562 ++++++++----------
 requirements-strix-ci.txt                     |   4 +-
 10 files changed, 394 insertions(+), 689 deletions(-)
 delete mode 100644 .github/scripts/materialize_cryptography_50.py
 delete mode 100644 .github/workflows/security-cryptography-50-materialize.yml

diff --git a/.github/scripts/materialize_cryptography_50.py b/.github/scripts/materialize_cryptography_50.py
deleted file mode 100644
index 793db3cfd..000000000
--- a/.github/scripts/materialize_cryptography_50.py
+++ /dev/null
@@ -1,122 +0,0 @@
-#!/usr/bin/env python3
-"""Materialize the cryptography 50 security remediation on its isolated branch.
-
-The script keeps source mutation reviewable and deterministic while the
-one-shot GitHub workflow supplies the supported Python runtimes, regenerates
-locks, and executes the complete verification matrix.
-"""
-
-from __future__ import annotations
-
-import argparse
-from pathlib import Path
-
-REPOSITORY_ROOT = Path(__file__).resolve().parents[2]
-RELEASE_GOVERNANCE_TEST = REPOSITORY_ROOT / "backend/tests/test_release_governance.py"
-CRYPTOGRAPHY_OLD_PIN = "cryptography==49.0.0"
-CRYPTOGRAPHY_NEW_PIN = "cryptography==50.0.0"
-TEST_NAME = "test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed"
-TEST_SOURCE = '''
-
-
-def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
-    """Require every governed Python surface to use the first oracle-safe release."""
-    backend_requirements = read_repo_text("backend/requirements.txt")
-    backend_project = read_repo_text("backend/pyproject.toml")
-    backend_lock = tomllib.loads(read_repo_text("backend/uv.lock"))
-    backend_hashes = read_repo_text("backend/requirements-hashes.txt")
-    strix_requirements = read_repo_text("requirements-strix-ci.txt")
-    strix_hashes = read_repo_text("requirements-strix-ci-hashes.txt")
-
-    governed_text = "\\n".join(
-        (
-            backend_requirements,
-            backend_project,
-            backend_hashes,
-            strix_requirements,
-            strix_hashes,
-        )
-    )
-    assert "cryptography==49.0.0" not in governed_text
-    assert "cryptography==50.0.0" in backend_requirements
-    assert '"cryptography==50.0.0"' in backend_project
-    assert "cryptography==50.0.0" in backend_hashes
-    assert "cryptography==50.0.0" in strix_requirements
-    assert "cryptography==50.0.0" in strix_hashes
-    cryptography_versions = {
-        package["version"]
-        for package in backend_lock["package"]
-        if package["name"] == "cryptography"
-    }
-    assert cryptography_versions == {"50.0.0"}
-'''
-CHANGELOG_BULLET = (
-    "- `cryptography`를 `50.0.0`으로 갱신해 공격자 제공 PKCS#7 "
-    "EnvelopedData 복호화 결과의 오류·타이밍 차이로 발생하는 "
-    "Bleichenbacher oracle(`CVE-2026-69247`, `GHSA-g6cj-pr64-35w5`)을 "
-    "제거하고, backend·uv lock·hash lock·Strix CI 의존성 증거를 같은 "
-    "버전으로 동기화했습니다.\n"
-)
-CHANGELOG_MARKER = "### 보안 패치 (CodeQL extended current-head)\n\n"
-
-
-def add_failing_test() -> None:
-    """Add the security regression test without changing vulnerable pins."""
-    text = RELEASE_GOVERNANCE_TEST.read_text(encoding="utf-8")
-    if "import tomllib\n" not in text:
-        import_anchor = "import sys\n"
-        if text.count(import_anchor) != 1:
-            raise RuntimeError("tomllib import anchor was not found exactly once")
-        text = text.replace(import_anchor, import_anchor + "import tomllib\n", 1)
-    if TEST_NAME not in text:
-        text += TEST_SOURCE
-    RELEASE_GOVERNANCE_TEST.write_text(text, encoding="utf-8")
-
-
-def replace_pin(path: Path) -> None:
-    """Replace every governed cryptography 49 pin in one text artifact."""
-    text = path.read_text(encoding="utf-8")
-    if CRYPTOGRAPHY_OLD_PIN not in text:
-        raise RuntimeError(f"cryptography 49 pin is missing from {path}")
-    path.write_text(
-        text.replace(CRYPTOGRAPHY_OLD_PIN, CRYPTOGRAPHY_NEW_PIN),
-        encoding="utf-8",
-    )
-
-
-def apply_remediation() -> None:
-    """Update governed pins, the regression expectation, and CHANGELOG."""
-    for relative_path in (
-        "backend/requirements.txt",
-        "backend/pyproject.toml",
-        "requirements-strix-ci.txt",
-        "backend/tests/test_release_governance.py",
-    ):
-        replace_pin(REPOSITORY_ROOT / relative_path)
-
-    changelog_path = REPOSITORY_ROOT / "CHANGELOG.md"
-    changelog = changelog_path.read_text(encoding="utf-8")
-    if CHANGELOG_BULLET not in changelog:
-        if changelog.count(CHANGELOG_MARKER) != 1:
-            raise RuntimeError("Unreleased security changelog marker was not found once")
-        changelog = changelog.replace(
-            CHANGELOG_MARKER,
-            CHANGELOG_MARKER + CHANGELOG_BULLET,
-            1,
-        )
-    changelog_path.write_text(changelog, encoding="utf-8")
-
-
-def main() -> None:
-    """Dispatch the requested deterministic materialization phase."""
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("phase", choices=("add-test", "apply"))
-    args = parser.parse_args()
-    if args.phase == "add-test":
-        add_failing_test()
-    else:
-        apply_remediation()
-
-
-if __name__ == "__main__":
-    main()
diff --git a/.github/workflows/security-cryptography-50-materialize.yml b/.github/workflows/security-cryptography-50-materialize.yml
deleted file mode 100644
index 7b74fc5ec..000000000
--- a/.github/workflows/security-cryptography-50-materialize.yml
+++ /dev/null
@@ -1,168 +0,0 @@
-name: Materialize cryptography 50 security remediation
-
-on:
-  pull_request:
-    branches:
-      - develop
-    types: [opened, reopened, synchronize]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: security-cryptography-50-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  materialize:
-    if: ${{ github.event.pull_request.head.ref == 'fix/cryptography-50-bleichenbacher' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    permissions:
-      contents: write
-    env:
-      PYTHONWARNINGS: error
-      DISABLE_BACKGROUND_WORKERS: "1"
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout remediation branch
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: fix/cryptography-50-bleichenbacher
-          fetch-depth: 0
-
-      - name: Set up uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
-        with:
-          version: "0.11.29"
-
-      - name: Install supported Python runtimes
-        run: uv python install 3.13 3.14
-
-      - name: Detect whether materialization is required
-        id: state
-        run: |
-          if grep -Fq 'cryptography==50.0.0' backend/requirements.txt; then
-            echo 'required=false' >> "$GITHUB_OUTPUT"
-          else
-            echo 'required=true' >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Add and prove the failing security contract
-        if: ${{ steps.state.outputs.required == 'true' }}
-        run: |
-          set -euo pipefail
-          python .github/scripts/materialize_cryptography_50.py add-test
-          set +e
-          (
-            cd backend
-            uv run --frozen python -m pytest -q \
-              tests/test_release_governance.py::test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed
-          )
-          red_status=$?
-          set -e
-          if [ "$red_status" -eq 0 ]; then
-            echo "::error::The security regression test unexpectedly passed before remediation."
-            exit 1
-          fi
-
-      - name: Update governed security constraints and changelog
-        if: ${{ steps.state.outputs.required == 'true' }}
-        run: python .github/scripts/materialize_cryptography_50.py apply
-
-      - name: Regenerate uv and pip hash locks
-        if: ${{ steps.state.outputs.required == 'true' }}
-        run: |
-          set -euo pipefail
-          (
-            cd backend
-            uv lock --upgrade-package cryptography
-            uv lock --check
-          )
-          uv pip compile \
-            --generate-hashes \
-            --python-version 3.14 \
-            --python-platform x86_64-manylinux_2_28 \
-            --upgrade-package cryptography \
-            --output-file backend/requirements-hashes.txt \
-            backend/requirements.txt
-          uv pip compile \
-            --generate-hashes \
-            --python-version 3.13 \
-            --python-platform x86_64-manylinux_2_28 \
-            --upgrade-package cryptography \
-            --output-file requirements-strix-ci-hashes.txt \
-            requirements-strix-ci.txt
-
-      - name: Verify deterministic locks and focused governance
-        if: ${{ steps.state.outputs.required == 'true' }}
-        run: |
-          set -euo pipefail
-          ! grep -R -F 'cryptography==49.0.0' \
-            backend/requirements.txt \
-            backend/pyproject.toml \
-            backend/uv.lock \
-            backend/requirements-hashes.txt \
-            requirements-strix-ci.txt \
-            requirements-strix-ci-hashes.txt \
-            backend/tests/test_release_governance.py
-          (
-            cd backend
-            uv run --locked ruff check --fix tests/test_release_governance.py
-            uv run --locked ruff format tests/test_release_governance.py
-            uv run --locked ruff check tests/test_release_governance.py
-            uv run --locked ruff format --check tests/test_release_governance.py
-            uv run --locked python -m pytest -q tests/test_release_governance.py
-          )
-
-      - name: Verify hash-locked backend installation
-        if: ${{ steps.state.outputs.required == 'true' }}
-        run: |
-          set -euo pipefail
-          uv venv --python 3.14 .venv-security-backend
-          uv pip install \
-            --python .venv-security-backend/bin/python \
-            --require-hashes \
-            -r backend/requirements-hashes.txt
-          .venv-security-backend/bin/python -c \
-            'import cryptography; assert cryptography.__version__ == "50.0.0"'
-
-      - name: Verify hash-locked Strix CI installation
-        if: ${{ steps.state.outputs.required == 'true' }}
-        run: |
-          set -euo pipefail
-          uv venv --python 3.13 .venv-security-strix
-          uv pip install \
-            --python .venv-security-strix/bin/python \
-            --require-hashes \
-            -r requirements-strix-ci-hashes.txt
-          .venv-security-strix/bin/python -c \
-            'import cryptography; assert cryptography.__version__ == "50.0.0"'
-
-      - name: Run the full backend regression suite
-        if: ${{ steps.state.outputs.required == 'true' }}
-        run: cd backend && uv run --locked python -m pytest -q
-
-      - name: Commit verified remediation
-        if: ${{ steps.state.outputs.required == 'true' }}
-        run: |
-          set -euo pipefail
-          rm -rf .venv-security-backend .venv-security-strix
-          git diff --check
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add \
-            CHANGELOG.md \
-            backend/pyproject.toml \
-            backend/uv.lock \
-            backend/requirements.txt \
-            backend/requirements-hashes.txt \
-            backend/tests/test_release_governance.py \
-            requirements-strix-ci.txt \
-            requirements-strix-ci-hashes.txt
-          git commit -m "fix(security): upgrade cryptography to 50.0.0"
-          git push origin HEAD:fix/cryptography-50-bleichenbacher
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c3c96302f..e3fdf4af8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,7 @@
 ## [Unreleased]
 ### 보안 패치 (CodeQL extended current-head)
 
+- `cryptography`를 `50.0.0`으로 갱신해 공격자 제공 PKCS#7 EnvelopedData 복호화 결과의 오류·타이밍 차이로 발생하는 Bleichenbacher oracle(`CVE-2026-69247`, `GHSA-g6cj-pr64-35w5`)을 제거하고, backend·uv lock·hash lock·Strix CI 의존성 증거를 같은 버전으로 동기화했습니다. Strix 잠금은 `google-cloud-aiplatform==1.160.0`의 `<7` 제약을 위반하던 `protobuf==7.35.1`을 이미 검증된 `6.33.6`으로 복구해 다시 해석·설치 가능하게 했습니다.
 - CodeQL `extended` 기본 설정이 current `develop`에서 확인한 Critical 8건·High 21건·Medium 1건을 코드 경계에서 제거합니다. 서버 요청은 검증된 loopback/HTTPS origin, 동일 OIDC issuer origin, 허용 API 경로·쿼리만 재구성하고 redirect를 자동 추종하지 않으며, 공개 IPv6 authority를 보존합니다. UI smoke는 고정 Node/Next 실행 파일과 인자, localhost:3001 allowlist, private `mkdtemp` artifact 디렉터리 및 containment 검사만 사용합니다.
 - OIDC token endpoint는 운영 환경에서 서버 전용 `OIDC_ALLOWED_HOSTS` 정확 호스트 allowlist를 필수로 적용합니다. hostname의 모든 DNS 결과가 공인 주소인지 검증한 뒤 해당 주소 집합을 native HTTP(S) 연결의 `lookup`에 고정하고, 원래 issuer hostname은 Host/TLS SNI로 유지해 사설 주소 해석과 DNS rebinding 사이의 TOCTOU를 차단합니다. 실패 로그는 입력 URL·token 대신 고정된 configuration/DNS·transport/response/backend-verification reason code만 남깁니다.
 - Trivy 2026-07-26 DB에서 새로 확인된 Next.js High 4건·Medium 5건(`CVE-2026-64641`–`CVE-2026-64649`)과 PostCSS High 1건(`GHSA-r28c-9q8g-f849`)을 제거하기 위해 Next.js/`eslint-config-next`를 `16.2.11`, PostCSS를 `8.5.18`로 갱신했습니다. 두 버전은 각 취약점의 최초 수정 버전이며 저장소의 release-age 정책을 우회하지 않습니다.
diff --git a/backend/pyproject.toml b/backend/pyproject.toml
index ed662dec7..c156d9776 100644
--- a/backend/pyproject.toml
+++ b/backend/pyproject.toml
@@ -24,7 +24,7 @@ dependencies = [
   "google-auth-httplib2==0.4.0",
   "google-auth-oauthlib==1.4.0",
   "email-validator==2.3.0",
-  "cryptography==49.0.0",
+  "cryptography==50.0.0",
   "python-multipart==0.0.32",
   "prometheus-fastapi-instrumentator==8.0.2",
   "opentelemetry-api==1.43.0",
diff --git a/backend/requirements-hashes.txt b/backend/requirements-hashes.txt
index f29e9b4c0..2d8a9f3e5 100644
--- a/backend/requirements-hashes.txt
+++ b/backend/requirements-hashes.txt
@@ -1,5 +1,5 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile --generate-hashes --python-version 3.14 --python-platform x86_64-manylinux_2_28 --output-file backend/requirements-hashes.txt backend/requirements.txt
+#    uv pip compile --generate-hashes --python-version 3.14 --python-platform x86_64-unknown-linux-gnu --output-file backend/requirements-hashes.txt backend/requirements.txt
 aioimaplib==2.0.1 \
     --hash=sha256:5a494c3b75f220977048f5eb2c7ba9c0570a3148aaf38bee844e37e4d7af8648 \
     --hash=sha256:727e00c35cf25106bd34611dddd6e2ddf91a5f1a7e72d9269f3ce62486b31e14
@@ -299,53 +299,53 @@ click==8.4.2 \
     --hash=sha256:9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c4917a15f6 \
     --hash=sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76
     # via uvicorn
-cryptography==49.0.0 \
-    --hash=sha256:026ac7423e6fa66872d3bf889be5974507da3944f866f704fa200eadacd00001 \
-    --hash=sha256:07cab27cc7b7e0fd28e5e26bb9eeedde5c135c868b46de4a27845abe94af6122 \
-    --hash=sha256:084ef1af862eb07ec46d25f68689f2102a9fc0e05ce7b80f14f5fe51e4eef0f6 \
-    --hash=sha256:0b82e28ee398a386f0807bba7884d30f25218855690f45115831bcce5d90822c \
-    --hash=sha256:0e959b578856a3924bc0cbb710fc12c387b9412a951389f3ca61704a9e25f325 \
-    --hash=sha256:0f21641cf4b30fca7aee061ced0ec7ad7b073518088b7c9969a297c0ae796c69 \
-    --hash=sha256:196ecd6a36e4e9aa10270393bb98d8df88fccee0bf1e5128b91ae4eb4375896d \
-    --hash=sha256:2400ef9c9e2299a25614eb1dea3db54a69b1349efd043bfac9c67630d136df36 \
-    --hash=sha256:28d8b15e6275f12c8a207dc309dfa957903c927d08d0cc937ee3f63f200693cc \
-    --hash=sha256:2afe9051da7ae7bd5905da5a949280c7d2bb75682e188f650a9d0f2756b834c6 \
-    --hash=sha256:2eda353d8a27bcbcaa4cbed18994a74ab4d19a2ca897db188ea269ab9b71419b \
-    --hash=sha256:32703d93296f5c1f4b53349ad3a250c2cae0fdecd3a3dd5d47e616d8d616af27 \
-    --hash=sha256:33cd0565932807baddb67b96dbee92f2c374b5c89dee09fd74079aeb8c8dba61 \
-    --hash=sha256:35b151772baff2c74cba7fa290ceaff4c3b11c0c881eb93eb5dbc05a7cfbba18 \
-    --hash=sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db \
-    --hash=sha256:42b0684e0e40cf26122427802486f6d93aea593612603a94fbf260c7eb1e9c1b \
-    --hash=sha256:4ae387c9cb68ea569ca17e490d66d8142b81c3cc814bf179974b7d146e490bbb \
-    --hash=sha256:53ecee2e23f7169b6117e99fc8a944e5e50f79e69758a83b52a00cb98ab2b2d2 \
-    --hash=sha256:66ec79c3904820572d7e987abdf304281f141d37ad9a489b8e97066e7b9b6459 \
-    --hash=sha256:67e1d20ad9ef3a563c59ef22e7a8a0b8210bd26604369ea4a30a7c66aefe504e \
-    --hash=sha256:6f2debedf9ca60cf1d5bd466475638af5130f89965605cd818484d19987d3a21 \
-    --hash=sha256:6fc361c34fb6aac015ce19435876635e5c6d21db31998b0920f675f131e043b8 \
-    --hash=sha256:73a205dce83953d131a4aa1e0fd917a2fd1c5b1eef251e9d7152efefcbf5caf7 \
-    --hash=sha256:7abcee80084cda3f7691f3eb1ce480d8df49cec637b429aa35986c1de71738aa \
-    --hash=sha256:8c25ceb16df5b9435f3f6a9829204985b0e0cbee3b48aacd432c7d2c850b44d9 \
-    --hash=sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db \
-    --hash=sha256:9e82dcc8e56052715fb18b2429e3bca4823b1629136a2084fc45a9a5cecb9b64 \
-    --hash=sha256:b20133d204d2bb56ba047642199603876c872026ca53e79c35b83772ab2cc505 \
-    --hash=sha256:b39efa323140595abd3ecca8529d321ae50f55f3aa3ba9cc81ea56a6011953d5 \
-    --hash=sha256:b47db11c2c3525083296069b98ac5221907455e989ae0c2e3008bde851921615 \
-    --hash=sha256:b87e65d263b3e5d3bb92a57e2a6638e2f31110fa7aa890c7b2dbba42248d0a3f \
-    --hash=sha256:b970c6da94d5bb18629db453d14f2a1300f6bf59b61e9b82377931ef95504866 \
-    --hash=sha256:be9fcb48a55f023493482827d4f459bd263cc20efde64f204b97c123201850c6 \
-    --hash=sha256:c2bc30226390d60ea19d9f82b19db005fe0452154a23c1c410c12ea801e43561 \
-    --hash=sha256:c83782480a4a9da4d0feb51950131ba32e12e70813848b3343f6e18c28a66838 \
-    --hash=sha256:cbc77da8c523d5abd028635ba850a6966fcee2c82e2bf65a41d1d8afe0f98be9 \
-    --hash=sha256:ccac2bfebc306b862133e3bb71f3f6ee8bb525240089b2d952e4144b3a6d5da7 \
-    --hash=sha256:d0527ce944105f257f605a827d6ebead966c752038b6e8656abb9c5edee6fc68 \
-    --hash=sha256:d8ecde755e2e91bf773fc94e8c9d730cd7f2007004cb492263a794ec3899a1c8 \
-    --hash=sha256:e3fb64c420688e5319ae25113a354015abbd8dffbfbc41781a1ea66fc7622ac3 \
-    --hash=sha256:e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e \
-    --hash=sha256:ec5e529fb80935c94fe7b729f9972b50e351a0e6b50aa294fd5cabb109fcc29a \
-    --hash=sha256:f37d847238971164fdbc68ade6f6574aecc9c0af714190e2083429ff68f4ce9d \
-    --hash=sha256:f78ff2c9ed8dc2d036b0f4d640e22522213d047c1b14e61205a7e55c80a494d4 \
-    --hash=sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493 \
-    --hash=sha256:fc1e275c2f1d97b1a6450b8b0ea3ebfa6e087a611c2b26cb2404d48588abab7b
+cryptography==50.0.0 \
+    --hash=sha256:031e2d5dd4bb9caa3ca9c82e5a197fd8ae680232cee62603d1a813f3f07e3d03 \
+    --hash=sha256:06a32a980526a6ab9a4b9bf8f7385800791e2bb960903cb6b530e4817509a3b7 \
+    --hash=sha256:07479a1cb08219ab719147e742e76090c9c773321959bb94946fffdd397a6437 \
+    --hash=sha256:07949c449a1abcf60d1ee6e88956d89404c7df3c8258f46589e912988e551987 \
+    --hash=sha256:105110f43a471dbd0060b9c9516cb8a6a79233631a04cc2ba16f28323ac6e025 \
+    --hash=sha256:11b74db56cdbe3cdee6e3f6982ecb70334fa10dce99ed58bf7894aaaa3b2a037 \
+    --hash=sha256:12b9c6996425c76ea6c457ace4f3073e715b8c545add07cd1a8f3a4f90691269 \
+    --hash=sha256:1489e263a8048bb8b6a8bac662eb2d402ea5d2b7b4699b72f385f1e2772db105 \
+    --hash=sha256:19736989797678c6af1e55cd49055cdbcb55d8f6b5583ac5335f933aba9101dc \
+    --hash=sha256:1b4a266766514614f8aa60416e71f2fc6e575d36e7bdc90f644fadb2f4b75b95 \
+    --hash=sha256:2a8183b489dc1f7f80f135780fadc1108f14b31b8a40411c7a5b17425f65f28b \
+    --hash=sha256:37fdb0d0111f1e2ff07139dfb79f1b49531f8e213c46f1163dd7642979b58c47 \
+    --hash=sha256:3f5735ffe4996d28b809371756219f5354864902a3b9e7c0b9ee87041209fc9c \
+    --hash=sha256:49e7d93abdbd2990caced757e5fade25302f719c3c8fb6e6fff2dde98999fc41 \
+    --hash=sha256:5e34edd123674534acd70147f0ca331eaa2c74e6325fb2028c886aa26ba0b68c \
+    --hash=sha256:62598a8a57f815db4c6259a4e97d857dab56697e7de8e8ab02352ab74da1995d \
+    --hash=sha256:65c2c3add92b45fd0709db8594536aea39c2a67af0e27ffcf049c498501140b7 \
+    --hash=sha256:6ba6a53445bd3cfa809ef3ef5f1589aa6ba08784a1d962bf47d0940e871dab1c \
+    --hash=sha256:6e7d61120573a7f2cd94cc095f9e81f6967c61ccdf194285aa143ecec8e0b708 \
+    --hash=sha256:7cec5b856506da6defb290f30c9ee687d5f5e8cb0bd3f6459dde43b0b4fa40ef \
+    --hash=sha256:80b63928fa35083b33966ce1efb70e5b9607181e49dcd1c22c8c005e319f667f \
+    --hash=sha256:82148ec5bddac30b51a5b3c1945075f896fa022cb93f8e4a01e9f6ee95292c5f \
+    --hash=sha256:828743d939e9629bc267b8e2d08d8bb67cd4319c771a33d4b18b22dd8fb7440a \
+    --hash=sha256:8d89f3976b10b4ce31118de72329025f70d2c6ead14a8217c5514dd2c6d5a78f \
+    --hash=sha256:8eb5e1172eb569ea8a872796576e6a67c276351728b6455d5beb01242b027c6a \
+    --hash=sha256:900131fafd8aead39ac7dd3a7e833be754c17a95cfd91221636949fe4eb0aa8a \
+    --hash=sha256:910d11e1a385c654bf738bf3e6b8e6ed5de0f5610fcae2be9e5b398d8081d20e \
+    --hash=sha256:910e1d2668e7de9648f2bcee30e180db2a6b15c30f887d7c4c93ddf96e3992e3 \
+    --hash=sha256:9aa87839c383bdbab6ef865787a1fb877af8dd03464c4400322726feaaadfc6d \
+    --hash=sha256:a1b30560f2acc95aa8b2e06e716a13dbfc97314747b80d9707e307f77b40d6b3 \
+    --hash=sha256:a91296cb61e8df6f86d0c19cc4068228da256bf59bf86049fbd821084565327f \
+    --hash=sha256:b42a28c1844fd9de8f3f7d540e36b66f3a9c83fceac7170ebc7a6a19edd9dcae \
+    --hash=sha256:bd1c592e4d5974f0d08d4888e432157adba757c66da0246918e43677fafa2d30 \
+    --hash=sha256:c87f62a3d3b9888ed0fdde100ec06aa61ca9cd44bad9057d1dff9a516b5f5bb9 \
+    --hash=sha256:c99c003e088647b8a5b7c145d6f78c335f6348332b62e142d411c4b63d1460b9 \
+    --hash=sha256:ccdc4a71a4dabae05de219404f9f4abc38e3b58422177ff93d0da05967dafa07 \
+    --hash=sha256:d24fead1d4d076e1bfb006dcec392074a3cd8d7b4fc8a595aa64073b2b7a96ba \
+    --hash=sha256:d58c3db7cd6eed54e6c06744db55456b65ebd7492ddeae9c1e93cfca7aa857d3 \
+    --hash=sha256:d764dcf130c428ef66786f866dd750f53182bc608813489915e9fc106bb0c82f \
+    --hash=sha256:df2a58a472f332225671c35b0a830208b86d004f82baa8530fa3782c85646533 \
+    --hash=sha256:e722f16708d854fe924790e051061f6704a472c3bac347b6fd88033ea8dd0dc5 \
+    --hash=sha256:ecfed7367f965a0328cfbdd70da860f15441f002f613185668c6e6ebf5a0ac11 \
+    --hash=sha256:eeac2acb5a20ed25e0ad6d1df9891a520b78b404266b6d11778f25d5d691a6c9 \
+    --hash=sha256:f59e38625469987d7ef6d495323c55e7db6c212eaf6112267e0d3b565a2e9c9f \
+    --hash=sha256:f89831ef99dd7dd169ab06d63a831adb9e20a87aac6d380266bbda5823349169 \
+    --hash=sha256:fd9192b7b70c573d7f214eb1ae35e00d359f6f5e4b27c7e21e30de1fc6204645
     # via
     #   -r backend/requirements.txt
     #   google-auth
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 364ac33e2..d5514db0d 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -20,7 +20,7 @@ google-api-python-client==2.198.0
 google-auth-httplib2==0.4.0
 google-auth-oauthlib==1.4.0
 email-validator==2.3.0
-cryptography==49.0.0
+cryptography==50.0.0
 python-multipart==0.0.32
 prometheus-fastapi-instrumentator==8.0.2
 opentelemetry-api==1.43.0
diff --git a/backend/tests/test_release_governance.py b/backend/tests/test_release_governance.py
index 0eb430cc2..aa43b338b 100644
--- a/backend/tests/test_release_governance.py
+++ b/backend/tests/test_release_governance.py
@@ -12,6 +12,7 @@
 import re
 import sys
 import importlib.util
+import tomllib
 from pathlib import Path
 
 import pytest
@@ -174,10 +175,47 @@ def test_strix_ci_requirements_use_security_quality_clean_pins() -> None:
     strix_ci_requirements = read_repo_text("requirements-strix-ci.txt")
 
     assert "strix-agent==1.0.4" in strix_ci_requirements
-    assert "cryptography==49.0.0" in strix_ci_requirements
+    assert "google-cloud-aiplatform==1.160.0" in strix_ci_requirements
+    assert "cryptography==50.0.0" in strix_ci_requirements
+    assert "protobuf==6.33.6" in strix_ci_requirements
     assert "python-multipart==0.0.32" in strix_ci_requirements
 
 
+def test_cryptography_runtime_pins_are_bleichenbacher_oracle_fixed() -> None:
+    """Require every governed Python surface to use the first oracle-safe release."""
+    backend_requirements = read_repo_text("backend/requirements.txt")
+    backend_project_text = read_repo_text("backend/pyproject.toml")
+    backend_project = tomllib.loads(backend_project_text)
+    backend_lock = tomllib.loads(read_repo_text("backend/uv.lock"))
+    backend_hashes = read_repo_text("backend/requirements-hashes.txt")
+    strix_requirements = read_repo_text("requirements-strix-ci.txt")
+    strix_hashes = read_repo_text("requirements-strix-ci-hashes.txt")
+
+    def pins(text: str, package: str) -> list[str]:
+        return re.findall(rf"(?m)^{re.escape(package)}==[^\s\\]+", text)
+
+    for governed_text in (
+        backend_requirements,
+        backend_hashes,
+        strix_requirements,
+        strix_hashes,
+    ):
+        assert pins(governed_text, "cryptography") == ["cryptography==50.0.0"]
+    assert [
+        dependency
+        for dependency in backend_project["project"]["dependencies"]
+        if dependency.startswith("cryptography")
+    ] == ["cryptography==50.0.0"]
+    cryptography_versions = {
+        package["version"]
+        for package in backend_lock["package"]
+        if package["name"] == "cryptography"
+    }
+    assert cryptography_versions == {"50.0.0"}
+    assert pins(strix_requirements, "protobuf") == ["protobuf==6.33.6"]
+    assert pins(strix_hashes, "protobuf") == ["protobuf==6.33.6"]
+
+
 def test_changelog_follows_keep_a_changelog_for_initial_korean_release() -> None:
     changelog = read_repo_text("CHANGELOG.md")
 
diff --git a/backend/uv.lock b/backend/uv.lock
index 6a80d8a7c..2f0d04a76 100644
--- a/backend/uv.lock
+++ b/backend/uv.lock
@@ -366,52 +366,52 @@ wheels = [
 
 [[package]]
 name = "cryptography"
-version = "49.0.0"
+version = "50.0.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/1f/99/d1c90d6041656cc6ee229dc99cd67fd0cd5aec3c5f7d72fffc27cc750054/cryptography-49.0.0.tar.gz", hash = "sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493", size = 854345, upload-time = "2026-06-12T20:02:30.512Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/9b/22/adf66990e63584a68dfb50c24f48a125c07b1699899381c8151e63ed458c/cryptography-49.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db", size = 4032100, upload-time = "2026-06-12T20:02:32.143Z" },
-    { url = "https://files.pythonhosted.org/packages/09/41/3797cfaf69cae04a13ee78ebd83f0678d9c02b4779d21ce24445326f1a69/cryptography-49.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db", size = 4692978, upload-time = "2026-06-12T20:01:21.305Z" },
-    { url = "https://files.pythonhosted.org/packages/e6/8b/43011f7ebe515a8aa20d61f290a326cd890c2e738e16e59eaff8d9c3a412/cryptography-49.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0e959b578856a3924bc0cbb710fc12c387b9412a951389f3ca61704a9e25f325", size = 4716422, upload-time = "2026-06-12T20:01:48.566Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/91/01ce7303a4579e6d3a6abef01bd322848e9ea7a219adcabc5048b9033571/cryptography-49.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:53ecee2e23f7169b6117e99fc8a944e5e50f79e69758a83b52a00cb98ab2b2d2", size = 4700503, upload-time = "2026-06-12T20:02:47.091Z" },
-    { url = "https://files.pythonhosted.org/packages/62/99/a2c95cf8293f07491e9e27c20cc4dcd18176d944e674679adeb1d0173fd6/cryptography-49.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:2eda353d8a27bcbcaa4cbed18994a74ab4d19a2ca897db188ea269ab9b71419b", size = 5309779, upload-time = "2026-06-12T20:02:08.987Z" },
-    { url = "https://files.pythonhosted.org/packages/20/2c/0622f20ff02b2ef32558733443805dc82fd4c275be01b2d19d14676f3a1b/cryptography-49.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:2afe9051da7ae7bd5905da5a949280c7d2bb75682e188f650a9d0f2756b834c6", size = 4749683, upload-time = "2026-06-12T20:02:03.335Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/5b/c5246635d5fd3b64e0d45ae10e99fd32fe9676a79915ccfe5a61ba9af1a5/cryptography-49.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:0b82e28ee398a386f0807bba7884d30f25218855690f45115831bcce5d90822c", size = 4337874, upload-time = "2026-06-12T20:02:54.323Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/88/05563c7fe2e914e87d1a536d06fe83e66b4e1d95cb593e05aea375531da8/cryptography-49.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:ccac2bfebc306b862133e3bb71f3f6ee8bb525240089b2d952e4144b3a6d5da7", size = 4700283, upload-time = "2026-06-12T20:01:34.822Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/b6/d7696e4e890d6ae1469935164c9e5215c557671cb78d6e3f458ccceaa632/cryptography-49.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:d0527ce944105f257f605a827d6ebead966c752038b6e8656abb9c5edee6fc68", size = 5265844, upload-time = "2026-06-12T20:01:24.09Z" },
-    { url = "https://files.pythonhosted.org/packages/a9/3c/f3ad17eecc1a57b0ba236dc01f90e783c51f4a2f35f64777cc4f47a184b2/cryptography-49.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:cbc77da8c523d5abd028635ba850a6966fcee2c82e2bf65a41d1d8afe0f98be9", size = 4749290, upload-time = "2026-06-12T20:01:30.848Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/01/339573cf1023163a400b0b5d16f6d507de413b9f60be6fd1b77feeaf6737/cryptography-49.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:b87e65d263b3e5d3bb92a57e2a6638e2f31110fa7aa890c7b2dbba42248d0a3f", size = 4834612, upload-time = "2026-06-12T20:01:29.246Z" },
-    { url = "https://files.pythonhosted.org/packages/71/fd/577302e213a1be9468f92d1afef66fcf1ef83d516819d9992ca547f592bd/cryptography-49.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:66ec79c3904820572d7e987abdf304281f141d37ad9a489b8e97066e7b9b6459", size = 4980804, upload-time = "2026-06-12T20:01:42.853Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/09/f42b1d190c5ba75f72062a387f8030d1d75f6ab035788f1d9c4b01de6525/cryptography-49.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e", size = 3810026, upload-time = "2026-06-12T20:02:39.262Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/9e/db72b3ae7fc9cfad53e630e56c6ae83b9b6ff0bf3718ffb8012d20b3aabf/cryptography-49.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:73a205dce83953d131a4aa1e0fd917a2fd1c5b1eef251e9d7152efefcbf5caf7", size = 4013892, upload-time = "2026-06-12T20:02:10.735Z" },
-    { url = "https://files.pythonhosted.org/packages/86/12/c48a424f38db03027be9f7ed5c7dc5de9933dbee992865f98b13727a009d/cryptography-49.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:196ecd6a36e4e9aa10270393bb98d8df88fccee0bf1e5128b91ae4eb4375896d", size = 4678835, upload-time = "2026-06-12T20:02:48.743Z" },
-    { url = "https://files.pythonhosted.org/packages/68/28/8a3ad4653662c93fc44dc4e5d8fd374c25c42e07b34bbfbadf49cf57a5a8/cryptography-49.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7abcee80084cda3f7691f3eb1ce480d8df49cec637b429aa35986c1de71738aa", size = 4697239, upload-time = "2026-06-12T20:02:56.03Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/b2/2193fc74f81aee4f9b62733133b73b5176718932ed8f2e4b03fa040480a6/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:4ae387c9cb68ea569ca17e490d66d8142b81c3cc814bf179974b7d146e490bbb", size = 4685593, upload-time = "2026-06-12T20:02:50.666Z" },
-    { url = "https://files.pythonhosted.org/packages/47/f1/1d3eaa243bfc5de4a187b22aa8c048b3e4980bfbe830ac46e6bac2e66947/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:f37d847238971164fdbc68ade6f6574aecc9c0af714190e2083429ff68f4ce9d", size = 5289961, upload-time = "2026-06-12T20:01:46.468Z" },
-    { url = "https://files.pythonhosted.org/packages/58/39/2d51306721330c486495853eda1c567880ff036de15a14c4b74f399934af/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:c2bc30226390d60ea19d9f82b19db005fe0452154a23c1c410c12ea801e43561", size = 4731145, upload-time = "2026-06-12T20:02:16.832Z" },
-    { url = "https://files.pythonhosted.org/packages/17/50/983e838c7fd0d87fd8c969bcdd328edaf5f756e38df5281637424c155873/cryptography-49.0.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:07cab27cc7b7e0fd28e5e26bb9eeedde5c135c868b46de4a27845abe94af6122", size = 4321719, upload-time = "2026-06-12T20:02:52.611Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/f5/8f571d7e27c55bce9f76f026143bcb1e040a4233149ecca0bea5fa5dd5f7/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:b20133d204d2bb56ba047642199603876c872026ca53e79c35b83772ab2cc505", size = 4685209, upload-time = "2026-06-12T20:02:07.282Z" },
-    { url = "https://files.pythonhosted.org/packages/e7/84/0e27016a6fc5a0886f797018b26aa42f40c09a82332bff77822a451deaaa/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:b970c6da94d5bb18629db453d14f2a1300f6bf59b61e9b82377931ef95504866", size = 5246285, upload-time = "2026-06-12T20:01:32.439Z" },
-    { url = "https://files.pythonhosted.org/packages/11/2d/5e1fb307cb5931881516b464c98774b3f2c36b5d4bb9a2830253cf553cad/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:d8ecde755e2e91bf773fc94e8c9d730cd7f2007004cb492263a794ec3899a1c8", size = 4730441, upload-time = "2026-06-12T20:02:01.469Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/c0/bff5a02ee731d207d6a1ed51732549d8c53d2bc8da1d10ec6f2844201d68/cryptography-49.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e3fb64c420688e5319ae25113a354015abbd8dffbfbc41781a1ea66fc7622ac3", size = 4815869, upload-time = "2026-06-12T20:01:36.574Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/26/814681d14248d95d73d5c3eea0c39a94eb8302df966f670a2c60de90974b/cryptography-49.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:32703d93296f5c1f4b53349ad3a250c2cae0fdecd3a3dd5d47e616d8d616af27", size = 4960948, upload-time = "2026-06-12T20:02:18.688Z" },
-    { url = "https://files.pythonhosted.org/packages/4c/fe/93ecac273d3738939d023612ad12cca9a3740a5345d69fda04134c43fd96/cryptography-49.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:33cd0565932807baddb67b96dbee92f2c374b5c89dee09fd74079aeb8c8dba61", size = 3799153, upload-time = "2026-06-12T20:01:39.059Z" },
-    { url = "https://files.pythonhosted.org/packages/19/2a/5bb823f5bedcf80718cea7fbc95ec5515cca3769633c4b01a32be7f30e7c/cryptography-49.0.0-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:ec5e529fb80935c94fe7b729f9972b50e351a0e6b50aa294fd5cabb109fcc29a", size = 4025947, upload-time = "2026-06-12T20:01:25.745Z" },
-    { url = "https://files.pythonhosted.org/packages/3d/df/40577043ca124e17012f408ddddaeb213b856336ac82ddb3bc915f39e29f/cryptography-49.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f78ff2c9ed8dc2d036b0f4d640e22522213d047c1b14e61205a7e55c80a494d4", size = 4692429, upload-time = "2026-06-12T20:01:53.628Z" },
-    { url = "https://files.pythonhosted.org/packages/2c/99/2d13299eb3dd27b02dcfaafcc91d6b5cb3329f7cbd6d8f51921acd566c1a/cryptography-49.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:35b151772baff2c74cba7fa290ceaff4c3b11c0c881eb93eb5dbc05a7cfbba18", size = 4700968, upload-time = "2026-06-12T20:02:45.383Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/4d/9c0cd02f95e2602dd5e563da149ee0830abef3537be8b34dc56281ebe27a/cryptography-49.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:0f21641cf4b30fca7aee061ced0ec7ad7b073518088b7c9969a297c0ae796c69", size = 4697758, upload-time = "2026-06-12T20:01:41.13Z" },
-    { url = "https://files.pythonhosted.org/packages/24/01/186c825898477d77e2324d5360fefe622ff1d8d1963ec0554e2cada8ec77/cryptography-49.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9e82dcc8e56052715fb18b2429e3bca4823b1629136a2084fc45a9a5cecb9b64", size = 5298863, upload-time = "2026-06-12T20:02:24.579Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/7b/62cbbab75d0659865bf0273790031544a0b16c8072d258f9428dcd8190dc/cryptography-49.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:6f2debedf9ca60cf1d5bd466475638af5130f89965605cd818484d19987d3a21", size = 4735983, upload-time = "2026-06-12T20:01:50.14Z" },
-    { url = "https://files.pythonhosted.org/packages/6c/72/3e798c064bc39e471008075d0f9bc9daf77a80879c092e4a8e170c585ed4/cryptography-49.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:8c25ceb16df5b9435f3f6a9829204985b0e0cbee3b48aacd432c7d2c850b44d9", size = 4334173, upload-time = "2026-06-12T20:01:44.743Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/ee/6fca21d1ac73e06f8bef71940abfd4d2f6472b4bca284d770f32bd4086f6/cryptography-49.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:28d8b15e6275f12c8a207dc309dfa957903c927d08d0cc937ee3f63f200693cc", size = 4697298, upload-time = "2026-06-12T20:02:20.918Z" },
-    { url = "https://files.pythonhosted.org/packages/67/d0/a5fcd3515f0bae49a7b6d0413cc1bdccdcc1fc0047037a0d480642cdc5d6/cryptography-49.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:6fc361c34fb6aac015ce19435876635e5c6d21db31998b0920f675f131e043b8", size = 5254338, upload-time = "2026-06-12T20:02:22.737Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/84/84fe36f19caf857d61cb7fc9c63035a47ffabd84ea12d1d393148efa3615/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:2400ef9c9e2299a25614eb1dea3db54a69b1349efd043bfac9c67630d136df36", size = 4735650, upload-time = "2026-06-12T20:02:41.389Z" },
-    { url = "https://files.pythonhosted.org/packages/6c/a0/db537264e234f7273a73ec020873d6d6b39dfd8a53db78b550ca8320440e/cryptography-49.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:67e1d20ad9ef3a563c59ef22e7a8a0b8210bd26604369ea4a30a7c66aefe504e", size = 4834820, upload-time = "2026-06-12T20:01:51.847Z" },
-    { url = "https://files.pythonhosted.org/packages/93/77/8df9eb486495979bccecd1062e2eaf435250e84437040295b57d09048b0b/cryptography-49.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:42b0684e0e40cf26122427802486f6d93aea593612603a94fbf260c7eb1e9c1b", size = 4967968, upload-time = "2026-06-12T20:02:12.524Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/e6/f60198ea8d9dfa15fff9ed4ca02ce362f6eadd9ba757dcc50634c4257b63/cryptography-49.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:026ac7423e6fa66872d3bf889be5974507da3944f866f704fa200eadacd00001", size = 3785547, upload-time = "2026-06-12T20:02:26.847Z" },
+sdist = { url = "https://files.pythonhosted.org/packages/de/41/6cbdcf9142d00fe82836fbb51e503e58088575cf7a0fe1dbff6695bf0840/cryptography-50.0.0.tar.gz", hash = "sha256:eeac2acb5a20ed25e0ad6d1df9891a520b78b404266b6d11778f25d5d691a6c9", size = 880201, upload-time = "2026-07-31T14:25:10.11Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c5/5c/59086b4aac5e879d38ddbcf74e4be7ade89cebc3eb199a55da998c3bb46a/cryptography-50.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:031e2d5dd4bb9caa3ca9c82e5a197fd8ae680232cee62603d1a813f3f07e3d03", size = 4001252, upload-time = "2026-07-31T14:23:33.331Z" },
+    { url = "https://files.pythonhosted.org/packages/57/ef/8f2df13c7216bcad3e1c74e07f6e193d93e998e114f524a53877c9af27ad/cryptography-50.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:fd9192b7b70c573d7f214eb1ae35e00d359f6f5e4b27c7e21e30de1fc6204645", size = 4719554, upload-time = "2026-07-31T14:23:35.611Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/41/029086c34d91052fc3b88bcc8056f709a7c915c7a23b235a54eb800b1c97/cryptography-50.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:06a32a980526a6ab9a4b9bf8f7385800791e2bb960903cb6b530e4817509a3b7", size = 4702130, upload-time = "2026-07-31T14:23:37.635Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/ff/b6ce0954962e7f7b969f850a883744197bb3910bdfd7b6da162eab7d9f68/cryptography-50.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:a1b30560f2acc95aa8b2e06e716a13dbfc97314747b80d9707e307f77b40d6b3", size = 4725244, upload-time = "2026-07-31T14:23:39.471Z" },
+    { url = "https://files.pythonhosted.org/packages/06/1e/63a1027cb7fec360a182208e1b7767d5aa1fe57be3d6aa856e69a321edc0/cryptography-50.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:8d89f3976b10b4ce31118de72329025f70d2c6ead14a8217c5514dd2c6d5a78f", size = 5342265, upload-time = "2026-07-31T14:23:41.286Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/72/a1116d683a6d7ece94590013882515de087edf9ef0e6292aae615a44df73/cryptography-50.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:b42a28c1844fd9de8f3f7d540e36b66f3a9c83fceac7170ebc7a6a19edd9dcae", size = 4734609, upload-time = "2026-07-31T14:23:43.139Z" },
+    { url = "https://files.pythonhosted.org/packages/15/37/36a9c479bbe49acea2636c7fd3360d20f7b7e079c300352011c44850b181/cryptography-50.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:900131fafd8aead39ac7dd3a7e833be754c17a95cfd91221636949fe4eb0aa8a", size = 4356517, upload-time = "2026-07-31T14:23:44.939Z" },
+    { url = "https://files.pythonhosted.org/packages/32/98/8a151d64367204cbc63ec65d37502f1d9c53cf4bfc6ec3c532614dbec60d/cryptography-50.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:07949c449a1abcf60d1ee6e88956d89404c7df3c8258f46589e912988e551987", size = 4724529, upload-time = "2026-07-31T14:23:46.93Z" },
+    { url = "https://files.pythonhosted.org/packages/22/f6/ec13b470172126464a86bf54d2294a46d29837fc51ba3e45d4047946fb5e/cryptography-50.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:f89831ef99dd7dd169ab06d63a831adb9e20a87aac6d380266bbda5823349169", size = 5299852, upload-time = "2026-07-31T14:23:48.851Z" },
+    { url = "https://files.pythonhosted.org/packages/da/3a/f05e32c99d440c9bb891ea0e36c9091891e36be5a9a87ab2ee6ea20729f6/cryptography-50.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:82148ec5bddac30b51a5b3c1945075f896fa022cb93f8e4a01e9f6ee95292c5f", size = 4734462, upload-time = "2026-07-31T14:23:50.861Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/dc/bd72b26be8953f80625f63151efd38eee71c76ca6cf591c08ff34615a79e/cryptography-50.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:1489e263a8048bb8b6a8bac662eb2d402ea5d2b7b4699b72f385f1e2772db105", size = 4852708, upload-time = "2026-07-31T14:23:52.715Z" },
+    { url = "https://files.pythonhosted.org/packages/27/20/c930314a2ab476d15dec966ec87e2e9637bb02b06106b12c0396c57bb603/cryptography-50.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:7cec5b856506da6defb290f30c9ee687d5f5e8cb0bd3f6459dde43b0b4fa40ef", size = 5004179, upload-time = "2026-07-31T14:23:54.887Z" },
+    { url = "https://files.pythonhosted.org/packages/32/2e/c9db68a0c4bfa28e310707527c0ee3a2bd254104d2e02e68f368e197aa4c/cryptography-50.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:bd1c592e4d5974f0d08d4888e432157adba757c66da0246918e43677fafa2d30", size = 3840395, upload-time = "2026-07-31T14:23:56.677Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/fb/951032a3bf22a5697c83183fb6294a4843772947a70e616c57b3ff5f522e/cryptography-50.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:49e7d93abdbd2990caced757e5fade25302f719c3c8fb6e6fff2dde98999fc41", size = 3989258, upload-time = "2026-07-31T14:23:58.881Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/67/91eb047e69c5e845f2f14b8a2e4a1aab0f283cb885531e9e22c8adb176bc/cryptography-50.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:19736989797678c6af1e55cd49055cdbcb55d8f6b5583ac5335f933aba9101dc", size = 4700648, upload-time = "2026-07-31T14:24:00.702Z" },
+    { url = "https://files.pythonhosted.org/packages/30/82/85f0f7425c856b9f96459411eb12e74ef72df9caf6f8f15bf23a33ff131f/cryptography-50.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:80b63928fa35083b33966ce1efb70e5b9607181e49dcd1c22c8c005e319f667f", size = 4682442, upload-time = "2026-07-31T14:24:02.538Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/28/b555a365adff1cca2fbe7b9e487d68a40de6bc67ff2cb587473eb43de0e7/cryptography-50.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:d58c3db7cd6eed54e6c06744db55456b65ebd7492ddeae9c1e93cfca7aa857d3", size = 4707596, upload-time = "2026-07-31T14:24:04.394Z" },
+    { url = "https://files.pythonhosted.org/packages/72/d8/f52538140cc719df62a01cf87d1c7142318d235817109d6f4054d7c352d6/cryptography-50.0.0-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:df2a58a472f332225671c35b0a830208b86d004f82baa8530fa3782c85646533", size = 5314552, upload-time = "2026-07-31T14:24:06.31Z" },
+    { url = "https://files.pythonhosted.org/packages/38/14/6120e5bd7c5aa022ad15424ba4d5c5269d0d9448ed4d55e492ea91e3c1c4/cryptography-50.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:11b74db56cdbe3cdee6e3f6982ecb70334fa10dce99ed58bf7894aaaa3b2a037", size = 4717113, upload-time = "2026-07-31T14:24:08.349Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/71/190bf38c3ee2e0f8efc9860ae100c9df4169742eef274b91e7aa1cb133b9/cryptography-50.0.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:f59e38625469987d7ef6d495323c55e7db6c212eaf6112267e0d3b565a2e9c9f", size = 4338580, upload-time = "2026-07-31T14:24:10.227Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/63/504ccfbbe61fd8aa983f7f146399cdf034c72c2fc55f5b2dfdcdcdb20c99/cryptography-50.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:ecfed7367f965a0328cfbdd70da860f15441f002f613185668c6e6ebf5a0ac11", size = 4707038, upload-time = "2026-07-31T14:24:12.169Z" },
+    { url = "https://files.pythonhosted.org/packages/01/77/2cf79bbfc4d12ca106437a6e170d6aaa01a373e93093118aaaef0e801bd4/cryptography-50.0.0-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:9aa87839c383bdbab6ef865787a1fb877af8dd03464c4400322726feaaadfc6d", size = 5273110, upload-time = "2026-07-31T14:24:14.38Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/45/8aae2972c520145377ea3559a605a899bebe227bf070b33cdb445929a9b9/cryptography-50.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:6ba6a53445bd3cfa809ef3ef5f1589aa6ba08784a1d962bf47d0940e871dab1c", size = 4716439, upload-time = "2026-07-31T14:24:16.415Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/20/4fe50b619a48c2525cc46e2dbc1ac490708d704be5d467bdaac6dc955682/cryptography-50.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:3f5735ffe4996d28b809371756219f5354864902a3b9e7c0b9ee87041209fc9c", size = 4837383, upload-time = "2026-07-31T14:24:18.553Z" },
+    { url = "https://files.pythonhosted.org/packages/92/91/3a31366e183343d3703f8995c095f5734676bd6938118047e50fcf279eb4/cryptography-50.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:1b4a266766514614f8aa60416e71f2fc6e575d36e7bdc90f644fadb2f4b75b95", size = 4985772, upload-time = "2026-07-31T14:24:20.385Z" },
+    { url = "https://files.pythonhosted.org/packages/74/9a/02ffe35b2853d121689871eb5dce862092562b3a1ed5cc98f1aaed441506/cryptography-50.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:12b9c6996425c76ea6c457ace4f3073e715b8c545add07cd1a8f3a4f90691269", size = 3816291, upload-time = "2026-07-31T14:24:22.125Z" },
+    { url = "https://files.pythonhosted.org/packages/03/37/73d005be173aff344af30e9fd2a576575cb2391a7101d9cd3842e1fa8cce/cryptography-50.0.0-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:ccdc4a71a4dabae05de219404f9f4abc38e3b58422177ff93d0da05967dafa07", size = 4036009, upload-time = "2026-07-31T14:24:24.122Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/c6/7a6202a534e32103a285b7834a120869557fe198d51d7cfe59754c8bda9c/cryptography-50.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:910e1d2668e7de9648f2bcee30e180db2a6b15c30f887d7c4c93ddf96e3992e3", size = 4745252, upload-time = "2026-07-31T14:24:26.118Z" },
+    { url = "https://files.pythonhosted.org/packages/85/4f/0fa8c2f4428198f15d9ff8d63400e27afbf94ce833f6108da1eb3753f945/cryptography-50.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:a91296cb61e8df6f86d0c19cc4068228da256bf59bf86049fbd821084565327f", size = 4728939, upload-time = "2026-07-31T14:24:27.994Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/63/54dd723490ba2dc09b299682c10b38db38f159728bcaae8c591b8af2f22d/cryptography-50.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:e722f16708d854fe924790e051061f6704a472c3bac347b6fd88033ea8dd0dc5", size = 4748483, upload-time = "2026-07-31T14:24:30.254Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/dd/7c77d26285cc7f6991efce64a0f5b4f9383bfa5dd8c5033003eaf7db4cdb/cryptography-50.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:d764dcf130c428ef66786f866dd750f53182bc608813489915e9fc106bb0c82f", size = 5367599, upload-time = "2026-07-31T14:24:32.457Z" },
+    { url = "https://files.pythonhosted.org/packages/46/c9/f60aed34c013f317f92817b6c171c2d22a78270fa41109bd4b08af26b194/cryptography-50.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:105110f43a471dbd0060b9c9516cb8a6a79233631a04cc2ba16f28323ac6e025", size = 4762647, upload-time = "2026-07-31T14:24:34.599Z" },
+    { url = "https://files.pythonhosted.org/packages/be/f3/f9a0173b139372c3a48ed98154b45cc6b9de17c789d5ab552e621c293609/cryptography-50.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:828743d939e9629bc267b8e2d08d8bb67cd4319c771a33d4b18b22dd8fb7440a", size = 4385197, upload-time = "2026-07-31T14:24:36.647Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/36/83bb81f6e569bc38e1e4a7bc80f29b46bb9601920bc455fc8e888f5d5742/cryptography-50.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:2a8183b489dc1f7f80f135780fadc1108f14b31b8a40411c7a5b17425f65f28b", size = 4748095, upload-time = "2026-07-31T14:24:39.493Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/16/d3008eff98c764979865834c3d386d4fd041b5f52e7f34fc29ac1a5eb515/cryptography-50.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:6e7d61120573a7f2cd94cc095f9e81f6967c61ccdf194285aa143ecec8e0b708", size = 5325948, upload-time = "2026-07-31T14:24:41.556Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/f8/d97f9603efda3888187bfdb893f26c41be4735c10631d05d284ee6b047c4/cryptography-50.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:37fdb0d0111f1e2ff07139dfb79f1b49531f8e213c46f1163dd7642979b58c47", size = 4762400, upload-time = "2026-07-31T14:24:43.636Z" },
+    { url = "https://files.pythonhosted.org/packages/64/a2/4615c8f7d81a00b1d6e6afe19f694e1543582349fb5f4076f6cb5dc36485/cryptography-50.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:c87f62a3d3b9888ed0fdde100ec06aa61ca9cd44bad9057d1dff9a516b5f5bb9", size = 4878208, upload-time = "2026-07-31T14:24:45.522Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/1a/efcfb02f91407149a0dacffffab791f7e19bf6385f63b3666dc8b5e5c9c8/cryptography-50.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:65c2c3add92b45fd0709db8594536aea39c2a67af0e27ffcf049c498501140b7", size = 5037050, upload-time = "2026-07-31T14:24:47.697Z" },
+    { url = "https://files.pythonhosted.org/packages/57/30/4a22984d4f1bdfb8c054f07a92bc176b97a3134cc1d6c4b3bffb1f3688b4/cryptography-50.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:d24fead1d4d076e1bfb006dcec392074a3cd8d7b4fc8a595aa64073b2b7a96ba", size = 3874135, upload-time = "2026-07-31T14:24:50.085Z" },
 ]
 
 [[package]]
@@ -1030,7 +1030,7 @@ requires-dist = [
     { name = "aiosmtplib", specifier = "==5.1.2" },
     { name = "alembic", specifier = "==1.18.5" },
     { name = "asyncpg", specifier = "==0.31.0" },
-    { name = "cryptography", specifier = "==49.0.0" },
+    { name = "cryptography", specifier = "==50.0.0" },
     { name = "defusedxml", specifier = "==0.7.1" },
     { name = "email-validator", specifier = "==2.3.0" },
     { name = "fastapi", specifier = "==0.139.0" },
diff --git a/requirements-strix-ci-hashes.txt b/requirements-strix-ci-hashes.txt
index 61f368fbe..eaa2ad04f 100644
--- a/requirements-strix-ci-hashes.txt
+++ b/requirements-strix-ci-hashes.txt
@@ -1,5 +1,5 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile --generate-hashes --python-version 3.13 --python-platform x86_64-manylinux_2_28 --output-file requirements-strix-ci-hashes.txt requirements-strix-ci.txt
+#    uv pip compile --generate-hashes --python-version 3.13 --python-platform x86_64-unknown-linux-gnu --output-file requirements-strix-ci-hashes.txt requirements-strix-ci.txt
 aiohappyeyeballs==2.7.1 \
     --hash=sha256:065665c041c42a5938ed220bdcd7230f22527fbec085e1853d2402c8a3615d9d \
     --hash=sha256:9243213661e29250eb41368e5daa826fc017156c3b8a11440826b2e3ed376472
@@ -131,10 +131,6 @@ aiosignal==1.4.0 \
     --hash=sha256:053243f8b92b990551949e63930a839ff0cf0b0ebbe0597b0f3fb19e1a0fe82e \
     --hash=sha256:f47eecd9468083c2029cc99945502cb7708b082c232f9aca65da147157b251c7
     # via aiohttp
-annotated-doc==0.0.4 \
-    --hash=sha256:571ac1dc6991c450b25a9c2d84a3705e2ae7a53467b5d111c24fa8baabbed320 \
-    --hash=sha256:fbcda96e87e9c92ad167c2e53839e57503ecfda18804ea28102353485033faa4
-    # via typer
 annotated-types==0.7.0 \
     --hash=sha256:1f02e8b43a8fbbc3f3e0d4f0f4bfc8131bcb4eebe8849b8e5c773f3a1c582a53 \
     --hash=sha256:aff07c09a53a08bc8cfccb9c85b05f1aa9a2a6f23728d790723543408344ce89
@@ -380,60 +376,58 @@ click==8.4.2 \
     # via
     #   huggingface-hub
     #   litellm
-    #   typer
     #   uvicorn
-cryptography==49.0.0 \
-    --hash=sha256:026ac7423e6fa66872d3bf889be5974507da3944f866f704fa200eadacd00001 \
-    --hash=sha256:07cab27cc7b7e0fd28e5e26bb9eeedde5c135c868b46de4a27845abe94af6122 \
-    --hash=sha256:084ef1af862eb07ec46d25f68689f2102a9fc0e05ce7b80f14f5fe51e4eef0f6 \
-    --hash=sha256:0b82e28ee398a386f0807bba7884d30f25218855690f45115831bcce5d90822c \
-    --hash=sha256:0e959b578856a3924bc0cbb710fc12c387b9412a951389f3ca61704a9e25f325 \
-    --hash=sha256:0f21641cf4b30fca7aee061ced0ec7ad7b073518088b7c9969a297c0ae796c69 \
-    --hash=sha256:196ecd6a36e4e9aa10270393bb98d8df88fccee0bf1e5128b91ae4eb4375896d \
-    --hash=sha256:2400ef9c9e2299a25614eb1dea3db54a69b1349efd043bfac9c67630d136df36 \
-    --hash=sha256:28d8b15e6275f12c8a207dc309dfa957903c927d08d0cc937ee3f63f200693cc \
-    --hash=sha256:2afe9051da7ae7bd5905da5a949280c7d2bb75682e188f650a9d0f2756b834c6 \
-    --hash=sha256:2eda353d8a27bcbcaa4cbed18994a74ab4d19a2ca897db188ea269ab9b71419b \
-    --hash=sha256:32703d93296f5c1f4b53349ad3a250c2cae0fdecd3a3dd5d47e616d8d616af27 \
-    --hash=sha256:33cd0565932807baddb67b96dbee92f2c374b5c89dee09fd74079aeb8c8dba61 \
-    --hash=sha256:35b151772baff2c74cba7fa290ceaff4c3b11c0c881eb93eb5dbc05a7cfbba18 \
-    --hash=sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db \
-    --hash=sha256:42b0684e0e40cf26122427802486f6d93aea593612603a94fbf260c7eb1e9c1b \
-    --hash=sha256:4ae387c9cb68ea569ca17e490d66d8142b81c3cc814bf179974b7d146e490bbb \
-    --hash=sha256:53ecee2e23f7169b6117e99fc8a944e5e50f79e69758a83b52a00cb98ab2b2d2 \
-    --hash=sha256:66ec79c3904820572d7e987abdf304281f141d37ad9a489b8e97066e7b9b6459 \
-    --hash=sha256:67e1d20ad9ef3a563c59ef22e7a8a0b8210bd26604369ea4a30a7c66aefe504e \
-    --hash=sha256:6f2debedf9ca60cf1d5bd466475638af5130f89965605cd818484d19987d3a21 \
-    --hash=sha256:6fc361c34fb6aac015ce19435876635e5c6d21db31998b0920f675f131e043b8 \
-    --hash=sha256:73a205dce83953d131a4aa1e0fd917a2fd1c5b1eef251e9d7152efefcbf5caf7 \
-    --hash=sha256:7abcee80084cda3f7691f3eb1ce480d8df49cec637b429aa35986c1de71738aa \
-    --hash=sha256:8c25ceb16df5b9435f3f6a9829204985b0e0cbee3b48aacd432c7d2c850b44d9 \
-    --hash=sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db \
-    --hash=sha256:9e82dcc8e56052715fb18b2429e3bca4823b1629136a2084fc45a9a5cecb9b64 \
-    --hash=sha256:b20133d204d2bb56ba047642199603876c872026ca53e79c35b83772ab2cc505 \
-    --hash=sha256:b39efa323140595abd3ecca8529d321ae50f55f3aa3ba9cc81ea56a6011953d5 \
-    --hash=sha256:b47db11c2c3525083296069b98ac5221907455e989ae0c2e3008bde851921615 \
-    --hash=sha256:b87e65d263b3e5d3bb92a57e2a6638e2f31110fa7aa890c7b2dbba42248d0a3f \
-    --hash=sha256:b970c6da94d5bb18629db453d14f2a1300f6bf59b61e9b82377931ef95504866 \
-    --hash=sha256:be9fcb48a55f023493482827d4f459bd263cc20efde64f204b97c123201850c6 \
-    --hash=sha256:c2bc30226390d60ea19d9f82b19db005fe0452154a23c1c410c12ea801e43561 \
-    --hash=sha256:c83782480a4a9da4d0feb51950131ba32e12e70813848b3343f6e18c28a66838 \
-    --hash=sha256:cbc77da8c523d5abd028635ba850a6966fcee2c82e2bf65a41d1d8afe0f98be9 \
-    --hash=sha256:ccac2bfebc306b862133e3bb71f3f6ee8bb525240089b2d952e4144b3a6d5da7 \
-    --hash=sha256:d0527ce944105f257f605a827d6ebead966c752038b6e8656abb9c5edee6fc68 \
-    --hash=sha256:d8ecde755e2e91bf773fc94e8c9d730cd7f2007004cb492263a794ec3899a1c8 \
-    --hash=sha256:e3fb64c420688e5319ae25113a354015abbd8dffbfbc41781a1ea66fc7622ac3 \
-    --hash=sha256:e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e \
-    --hash=sha256:ec5e529fb80935c94fe7b729f9972b50e351a0e6b50aa294fd5cabb109fcc29a \
-    --hash=sha256:f37d847238971164fdbc68ade6f6574aecc9c0af714190e2083429ff68f4ce9d \
-    --hash=sha256:f78ff2c9ed8dc2d036b0f4d640e22522213d047c1b14e61205a7e55c80a494d4 \
-    --hash=sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493 \
-    --hash=sha256:fc1e275c2f1d97b1a6450b8b0ea3ebfa6e087a611c2b26cb2404d48588abab7b
+cryptography==50.0.0 \
+    --hash=sha256:031e2d5dd4bb9caa3ca9c82e5a197fd8ae680232cee62603d1a813f3f07e3d03 \
+    --hash=sha256:06a32a980526a6ab9a4b9bf8f7385800791e2bb960903cb6b530e4817509a3b7 \
+    --hash=sha256:07479a1cb08219ab719147e742e76090c9c773321959bb94946fffdd397a6437 \
+    --hash=sha256:07949c449a1abcf60d1ee6e88956d89404c7df3c8258f46589e912988e551987 \
+    --hash=sha256:105110f43a471dbd0060b9c9516cb8a6a79233631a04cc2ba16f28323ac6e025 \
+    --hash=sha256:11b74db56cdbe3cdee6e3f6982ecb70334fa10dce99ed58bf7894aaaa3b2a037 \
+    --hash=sha256:12b9c6996425c76ea6c457ace4f3073e715b8c545add07cd1a8f3a4f90691269 \
+    --hash=sha256:1489e263a8048bb8b6a8bac662eb2d402ea5d2b7b4699b72f385f1e2772db105 \
+    --hash=sha256:19736989797678c6af1e55cd49055cdbcb55d8f6b5583ac5335f933aba9101dc \
+    --hash=sha256:1b4a266766514614f8aa60416e71f2fc6e575d36e7bdc90f644fadb2f4b75b95 \
+    --hash=sha256:2a8183b489dc1f7f80f135780fadc1108f14b31b8a40411c7a5b17425f65f28b \
+    --hash=sha256:37fdb0d0111f1e2ff07139dfb79f1b49531f8e213c46f1163dd7642979b58c47 \
+    --hash=sha256:3f5735ffe4996d28b809371756219f5354864902a3b9e7c0b9ee87041209fc9c \
+    --hash=sha256:49e7d93abdbd2990caced757e5fade25302f719c3c8fb6e6fff2dde98999fc41 \
+    --hash=sha256:5e34edd123674534acd70147f0ca331eaa2c74e6325fb2028c886aa26ba0b68c \
+    --hash=sha256:62598a8a57f815db4c6259a4e97d857dab56697e7de8e8ab02352ab74da1995d \
+    --hash=sha256:65c2c3add92b45fd0709db8594536aea39c2a67af0e27ffcf049c498501140b7 \
+    --hash=sha256:6ba6a53445bd3cfa809ef3ef5f1589aa6ba08784a1d962bf47d0940e871dab1c \
+    --hash=sha256:6e7d61120573a7f2cd94cc095f9e81f6967c61ccdf194285aa143ecec8e0b708 \
+    --hash=sha256:7cec5b856506da6defb290f30c9ee687d5f5e8cb0bd3f6459dde43b0b4fa40ef \
+    --hash=sha256:80b63928fa35083b33966ce1efb70e5b9607181e49dcd1c22c8c005e319f667f \
+    --hash=sha256:82148ec5bddac30b51a5b3c1945075f896fa022cb93f8e4a01e9f6ee95292c5f \
+    --hash=sha256:828743d939e9629bc267b8e2d08d8bb67cd4319c771a33d4b18b22dd8fb7440a \
+    --hash=sha256:8d89f3976b10b4ce31118de72329025f70d2c6ead14a8217c5514dd2c6d5a78f \
+    --hash=sha256:8eb5e1172eb569ea8a872796576e6a67c276351728b6455d5beb01242b027c6a \
+    --hash=sha256:900131fafd8aead39ac7dd3a7e833be754c17a95cfd91221636949fe4eb0aa8a \
+    --hash=sha256:910d11e1a385c654bf738bf3e6b8e6ed5de0f5610fcae2be9e5b398d8081d20e \
+    --hash=sha256:910e1d2668e7de9648f2bcee30e180db2a6b15c30f887d7c4c93ddf96e3992e3 \
+    --hash=sha256:9aa87839c383bdbab6ef865787a1fb877af8dd03464c4400322726feaaadfc6d \
+    --hash=sha256:a1b30560f2acc95aa8b2e06e716a13dbfc97314747b80d9707e307f77b40d6b3 \
+    --hash=sha256:a91296cb61e8df6f86d0c19cc4068228da256bf59bf86049fbd821084565327f \
+    --hash=sha256:b42a28c1844fd9de8f3f7d540e36b66f3a9c83fceac7170ebc7a6a19edd9dcae \
+    --hash=sha256:bd1c592e4d5974f0d08d4888e432157adba757c66da0246918e43677fafa2d30 \
+    --hash=sha256:c87f62a3d3b9888ed0fdde100ec06aa61ca9cd44bad9057d1dff9a516b5f5bb9 \
+    --hash=sha256:c99c003e088647b8a5b7c145d6f78c335f6348332b62e142d411c4b63d1460b9 \
+    --hash=sha256:ccdc4a71a4dabae05de219404f9f4abc38e3b58422177ff93d0da05967dafa07 \
+    --hash=sha256:d24fead1d4d076e1bfb006dcec392074a3cd8d7b4fc8a595aa64073b2b7a96ba \
+    --hash=sha256:d58c3db7cd6eed54e6c06744db55456b65ebd7492ddeae9c1e93cfca7aa857d3 \
+    --hash=sha256:d764dcf130c428ef66786f866dd750f53182bc608813489915e9fc106bb0c82f \
+    --hash=sha256:df2a58a472f332225671c35b0a830208b86d004f82baa8530fa3782c85646533 \
+    --hash=sha256:e722f16708d854fe924790e051061f6704a472c3bac347b6fd88033ea8dd0dc5 \
+    --hash=sha256:ecfed7367f965a0328cfbdd70da860f15441f002f613185668c6e6ebf5a0ac11 \
+    --hash=sha256:eeac2acb5a20ed25e0ad6d1df9891a520b78b404266b6d11778f25d5d691a6c9 \
+    --hash=sha256:f59e38625469987d7ef6d495323c55e7db6c212eaf6112267e0d3b565a2e9c9f \
+    --hash=sha256:f89831ef99dd7dd169ab06d63a831adb9e20a87aac6d380266bbda5823349169 \
+    --hash=sha256:fd9192b7b70c573d7f214eb1ae35e00d359f6f5e4b27c7e21e30de1fc6204645
     # via
     #   -r requirements-strix-ci.txt
     #   google-auth
     #   pyjwt
-    #   pyopenssl
 cvss==3.6 \
     --hash=sha256:e342c6ad9c7eb69d2aebbbc2768a03cabd57eb947c806e145de5b936219833ea \
     --hash=sha256:f21d18224efcd3c01b44ff1b37dec2e3208d29a6d0ce6c87a599c73c21ee1a99
@@ -846,9 +840,9 @@ grpcio==1.82.1 \
     #   googleapis-common-protos
     #   grpc-google-iam-v1
     #   grpcio-status
-grpcio-status==1.82.1 \
-    --hash=sha256:71c7f2bea725c0027fa396b77a55d4e9d90591bab90de4c1c03d4df9a56552f0 \
-    --hash=sha256:d9de8ac34763cd468130fdd2923294af7c3d28d09426f6c45221d27c25931130
+grpcio-status==1.81.1 \
+    --hash=sha256:08072fa9995f4a95c647fc6f4f85e2411573d00087bcabdf30f260114338f232 \
+    --hash=sha256:9389a03e746017b10f0630c064289201458f3ce01f5d7ef4b0bebc1ef6cf82ad
     # via google-api-core
 h11==0.16.0 \
     --hash=sha256:4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208ee5ff1 \
@@ -912,9 +906,9 @@ idna==3.18 \
     #   httpx
     #   requests
     #   yarl
-importlib-metadata==9.0.0 \
-    --hash=sha256:2d21d1cc5a017bd0559e36150c21c830ab1dc304dedd1b7ea85d20f45ef3edd7 \
-    --hash=sha256:a4f57ab599e6a2e3016d7595cfd72eb4661a5106e787a95bcc90c7105b831efc
+importlib-metadata==8.9.0 \
+    --hash=sha256:58850626cef4bd2df100378b0f2aea9724a7b92f10770d547725b047078f99ee \
+    --hash=sha256:e0f761b6ea91ced3b0844c14c9d955224d538105921f8e6754c00f6ca79fba7f
     # via litellm
 jinja2==3.1.6 \
     --hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \
@@ -1311,9 +1305,9 @@ openai==2.45.0 \
     # via
     #   litellm
     #   openai-agents
-openai-agents==0.18.2 \
-    --hash=sha256:9f418bb563eddff1e01f245ae8a4964b7649396f444b569b4113d105e41ca1d3 \
-    --hash=sha256:c7aea341b256a90b87b17b7e444bab29a12655864a2f0094f65561223d867185
+openai-agents==0.14.6 \
+    --hash=sha256:e9d16b835f73be4c5e3798694f90d7a62efcade931e59416bc7462c850e15705 \
+    --hash=sha256:fdd3fb459892c8af5d0b522908b544e96f6217c7254ba55e966424493b43c1ed
     # via strix-agent
 packaging==26.2 \
     --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e \
@@ -1458,15 +1452,17 @@ proto-plus==1.28.1 \
     #   google-api-core
     #   google-cloud-aiplatform
     #   google-cloud-resource-manager
-protobuf==7.35.1 \
-    --hash=sha256:11d6b0ec246892d85215b0a13ca6e0233cf5284b68f0ac02646427f4ff88a799 \
-    --hash=sha256:230a75ddfc2de4806e56696ce9640c1cdfdb6543b7cfce98d42a4c0a0e7bdb87 \
-    --hash=sha256:24f857477359a85c0c235261b8ba905fd51b2562f4a64ca1df5473f29850cbf6 \
-    --hash=sha256:353652e4efd0bca5b5fc2656abf8307ef351f0cf938c9eba09f0e09c20a25c30 \
-    --hash=sha256:4bc97768d8fe4ad6743c8a19403e314511ed9f6d13205b687e52421c023ac1b9 \
-    --hash=sha256:74758715c53d7158fb76caf4f0cfdacc5329a4b1bb994f865d6cf302d413a1c4 \
-    --hash=sha256:b73f9489a4b8b1c9cb1f8ed951c736392592edb24b9d6819f36d2e10b171d5b4 \
-    --hash=sha256:ce115a26fe0c39a2c29973d914d327e516a6455464489fe3cd1e51a1b354f81a
+protobuf==6.33.6 \
+    --hash=sha256:0cd27b587afca21b7cfa59a74dcbd48a50f0a6400cfb59391340ad729d91d326 \
+    --hash=sha256:77179e006c476e69bf8e8ce866640091ec42e1beb80b213c3900006ecfba6901 \
+    --hash=sha256:7d29d9b65f8afef196f8334e80d6bc1d5d4adedb449971fefd3723824e6e77d3 \
+    --hash=sha256:9720e6961b251bde64edfdab7d500725a2af5280f3f4c87e57c0208376aa8c3a \
+    --hash=sha256:a6768d25248312c297558af96a9f9c929e8c4cee0659cb07e780731095f38135 \
+    --hash=sha256:bd56799fb262994b2c2faa1799693c95cc2e22c62f56fb43af311cae45d26f0e \
+    --hash=sha256:c96c37eec15086b79762ed265d59ab204dabc53056e3443e702d2681f4b39ce3 \
+    --hash=sha256:e2afbae9b8e1825e3529f88d514754e094278bb95eadc0e199751cdd9a2e82a2 \
+    --hash=sha256:e9db7e292e0ab79dd108d7f1a94fe31601ce1ee3f7b79e0692043423020b0593 \
+    --hash=sha256:f443a394af5ed23672bc6c486be138628fbe5c651ccbc536873d7da23d1868cf
     # via
     #   -r requirements-strix-ci.txt
     #   google-api-core
@@ -1501,114 +1497,127 @@ pydantic==2.13.4 \
     #   openai-agents
     #   pydantic-settings
     #   strix-agent
-pydantic-core==2.47.0 \
-    --hash=sha256:021220e0a03b66112737ee1fc49759340ce8fafb8d9ade1b7fb366b06033fa45 \
-    --hash=sha256:04ee7ba7172cb4484af51b2890f19069d35773698abc8c6ebb651f52fbf41134 \
-    --hash=sha256:05da6647bdfd3888936ac10aa39b239d659f3c93dff281af0fc5943eb55629dd \
-    --hash=sha256:0744954b81a77cfd381760d8b1bf92ba4db57d2da235e695d6fd3c94f741d24d \
-    --hash=sha256:0ae0096729c64aa6155cef74e75d1945017b01cfb82f313a18d843fafc497476 \
-    --hash=sha256:0b5f46412c8226d0c8f1f423c324c75afe342e4b854836933579fb484f68598c \
-    --hash=sha256:0d2907ee6d15cf26787bfbeb4c42e18e52f358086eab91baea961a0d909248d6 \
-    --hash=sha256:13990d357a50078e382b15fa3ce3f08043223b4be3eaeb340b184f54c1a2397a \
-    --hash=sha256:152bcbfe9f087716d185f6003be549f2cc6ee3cd4ca67909118e31626afc209b \
-    --hash=sha256:18c9c7c3a18e9bdbf1215d913f6bd00e17595dc92949817935cb87a3cf5f1697 \
-    --hash=sha256:195f9c4ac43a7b2a044a7b86631c3352abdb820bed2823ea29f98f779255f459 \
-    --hash=sha256:1a2f7ceb58013d167d8c96f10ec9b3a137018c819ba356f68ff1cb74302fd22e \
-    --hash=sha256:1e859dd5e06e9807080e14995db131649a77c61131cc464a7fe492a69ce82488 \
-    --hash=sha256:1f0a9659a2eb161573418e3138f616101ba21bbd2ff04916dca7b6712155e015 \
-    --hash=sha256:234ecade0e358caa1ea516c218b3f61e61e30532cad1a8bb12f2487325838548 \
-    --hash=sha256:24017fd3befd4d7cc4a8c71f4a1e9a44d29fdc91723c5446b0e795ab808adee7 \
-    --hash=sha256:2433b8524785cc117e602233bc574879bc8d87f09523edeec51665d5c46cf42d \
-    --hash=sha256:25cac08c9735e61e5c0b9f7a85c438661fc0e9da226afdfa984c3da6c5942a5a \
-    --hash=sha256:25f8aa59fd3f85651387c37b289cd8f0bbc8f632e7dad13c6b837759e78be88d \
-    --hash=sha256:263560ece98bffbbc0a8047ce60b8a278c859db6a2a4e30d9454b02891045eca \
-    --hash=sha256:264361b7236d4374fef6342908f87d084a0d58a2f8d0811e99f714309cb0ba7e \
-    --hash=sha256:2995074b99242aa28991e0120a3c881babc139e08750a05b7ea7d140644e091d \
-    --hash=sha256:2a7acb3e120ddba94372b8146e62ea3a0bce203180e34641c817c87f995c91e0 \
-    --hash=sha256:2bb527ac6e5a9721023b24615e1a55c01f47c60007f08b7d2afb89ff9c7a0e22 \
-    --hash=sha256:2c5e11bb1be2de2707c9367f364e73091ef30d34be54b3a4564d7421ac1a16bd \
-    --hash=sha256:2f72a382886ca85bb1247303b9134cf9978c9d454de62e710a1ebcd9d2131927 \
-    --hash=sha256:3292813ac8ed17671a5b1ac8256b6e98b96c29c1c6d061c35899e2f6e0444cac \
-    --hash=sha256:33c1e025c83b3987784191ec5aa78cfb94686f1ba73d98ae4d520c09cdecda8d \
-    --hash=sha256:34336a9cdd8b54e0cbc9d3c36b7be7dd828fa10e4209a7e4b0ca4583aa3e696d \
-    --hash=sha256:38a8b5371b7938e4f6c31060dbd51d3b3229aef7c43eaac2eb8b153e43c3f189 \
-    --hash=sha256:3aaabbdbbbb8dff33fa053ffb2c980f39dec745fc03592f50e1e010449129841 \
-    --hash=sha256:3af9600c680bec4b8d23c32ddaf7a5d91ed39a2cf758c082e34e860140cdcd87 \
-    --hash=sha256:3eb92447d3a079b945b61b8cbd6c3ec2954de3655c4efa0ebd35b069e472c2a9 \
-    --hash=sha256:422c1797a7864b2a9a996435aba92fe571fb80190f67a31edbc1ac040c7b51fe \
-    --hash=sha256:45882c24324f123037982c65eb8d60da778447e6bc87c82241f81d6c6d2c307e \
-    --hash=sha256:473b9a2b2a1f0dd55cbb32d2b902f93babe7f141a0bb48fb4d3d4d2b3e93e9a0 \
-    --hash=sha256:482667e5b7a3e97b0836f33a716199c4ec6ba9c896ca4db6eae799ec527c1e64 \
-    --hash=sha256:482b097637fec5037eb13fe9f9d5fe47e568a5b451d686bc2b854076cc0b50ca \
-    --hash=sha256:497f91a0499fa4ce7ae982756f8a237af19f145d944258c0c991cfb78aee13b0 \
-    --hash=sha256:4ded2d8dc3beb086623ab3256b81a0b51fc026c94eb363f480aec09b204a1cbd \
-    --hash=sha256:52afdd8640d59890539060e91c8a494cf96b463e63b2ba499cc5c23abcb5e96b \
-    --hash=sha256:52d40e074da44e42b2425aedebd513e405a31807036ef597175117a9b01743a6 \
-    --hash=sha256:53368beaf693f6302a6e33bdefe950857534a04d282811421bd20176d0fb5636 \
-    --hash=sha256:55156ee2f6f561ea4e25ab55f84bd70b9c9ed2546a834cb2b038fe10225aaa37 \
-    --hash=sha256:57ff41672a615f38af528ee904602be51c653248354e5db8e9252668abe91e68 \
-    --hash=sha256:58158d0111e86893bc35aacabe509f951ed303cddf8cdba43533190bde317914 \
-    --hash=sha256:5b494566e8e7e1a3992a550900902d6c0051538e53f5957e24003e7775638a24 \
-    --hash=sha256:5c4a885fb50c05903bc703a00830616e680304fdcdd90fc9535a52e72debe712 \
-    --hash=sha256:5d2177b44ba7d9d86850f865f362feeaac6a2ed8517a9b505b97ff0b7fdbd7dd \
-    --hash=sha256:6143463422e3851187657ff677af0cb04c5e1a2c51c028438ce5f20fbb5cb50d \
-    --hash=sha256:67c3f4b57a1cda846a9b6258e0ef70f99b0757d0b6a55f7e3e5b100620937d2c \
-    --hash=sha256:6b02b17e44bcb066b9f3a1d31c0be01a59f81d0b94b5066fdded1a8ccc8f819e \
-    --hash=sha256:6c1cd10d39ef1ff8bcd68b6865bee9c434631ac0608d402fe86e678851c2e2a5 \
-    --hash=sha256:6e37a6974fbd8fa7cae12285a76970d50b3689ffd6ed7c7fdd176ba81dd22d0e \
-    --hash=sha256:70a7aeba54854f5d97da65cb1a61f000f53df3704cab41cd81d65ab127ddd031 \
-    --hash=sha256:7b107cbd764bf68f12a57c7aa5846d868bc7463490a1ac2d0f19bffef624c5a9 \
-    --hash=sha256:7cbe66352fe2b39511d49150e5b52159429cd21f5633a3e801dd2c43829dcdca \
-    --hash=sha256:7eedc31996e9eba3bdfbbc380805ac6d765c889b7e93b17cd00ecb0200fd6dca \
-    --hash=sha256:81de54576de2e20baec76cc5afae2820f9049e6fdc4f357bac3391da02d0ba97 \
-    --hash=sha256:859ca679f00e5feb11b58b616eb7bc0efbb13654be21f5c898e510e27671c900 \
-    --hash=sha256:8623f4e598c9cee799075d0f1ab5174f9f2e7c42b3c5c7d859a97b3c726c84f8 \
-    --hash=sha256:8ad7522d6e0cf28192b30f4c9db62e9b7a13ef10652bf8310de27bcb4a6c1c40 \
-    --hash=sha256:90cbf7e35d597503cbdb5cd85409cbb75f377290bc7e8e37cc5dfe4f5cc66cf8 \
-    --hash=sha256:983e39b39547772543f3518557d0a86dbb3b7bb58bf8e82faba1e0cfa3e816d9 \
-    --hash=sha256:9cefe43d17a5a273d71697c084d3787defa7f578cd5fab4cef4c66d13c9e44b2 \
-    --hash=sha256:9d6098342d4510a9034a500a53b1d737daf9cfc18a47cd21047d02d7d1587557 \
-    --hash=sha256:9fc3193ff0b7e2e168f84c6185e70475738c191f3154e0af8f897cd0f8f9a489 \
-    --hash=sha256:a0078c5695322050ccedbc86eafaf3e2548439782c51d99e575de0e31b9fe4f4 \
-    --hash=sha256:a0f7343305387bb5884f24d384b7978ad099a277b27529e592c041a502a37c32 \
-    --hash=sha256:a1d507f331756f7066cde7c9f35ed78fa78223a54369dbc8a34d6da7a5074fa1 \
-    --hash=sha256:a3c450c65dfd14eee570756f61c823f8a7a36a3f4f4d46a3945d6225dc8a47d8 \
-    --hash=sha256:a7fdaff39a66bf66e9037da482575513d2f20bfb02ea9d9222b5cb3b902fc695 \
-    --hash=sha256:a8c7f5fad73eb404f4b84c75f3d9d3865b748ded248b7366341db6e516fc502b \
-    --hash=sha256:b3abf7fd5e6abe483a63413f9cd26b7c93c20780e19c8556434c7279f6b2f10c \
-    --hash=sha256:b3e6c8ee5ce8c270bfae09763ae4bbbccfe81090c97d670a621fb86cb1ef6042 \
-    --hash=sha256:b87e95e644df2a36bd631dd0d6e097aa73d19a55adf7b1724ebdeece3d9c76b7 \
-    --hash=sha256:c0e97329e38228f57fe1f2d91ba0ef39cc75cc1a84fe6ef58942d2fc6cb406bf \
-    --hash=sha256:c413761260967f4dbb51135e1b49f30a1c29e15bf371fbb39754ed6475739545 \
-    --hash=sha256:c547cac87585ab8a6e9495fd3be22ae8ccaabb3c909f6ae589a180677c105cc8 \
-    --hash=sha256:c5b224dc04c3ff9b08c24419464eb7f6ad7a1049e12284a00bf80df82bd15fdb \
-    --hash=sha256:c6cd3cde901878cce06787608a50c4456b8ad49c2128440c24b96b5624d26937 \
-    --hash=sha256:c96f745745fe778a92e74f40675c57b80dd46fc98186c9020e5ba4514a0470bd \
-    --hash=sha256:c9a891c20be5110deb1904f639f3615ec5022b3495995850d1abe7b8fa1550b5 \
-    --hash=sha256:cdf4dc2cdd0eacad1bd81c4d25422b4c25b206acae095d2d64e5d5cb7facc6b3 \
-    --hash=sha256:cf3cfcea028f41a9b42a47f4a53d72ca4274d04e3ee525bd58ca89ea8c5e1910 \
-    --hash=sha256:d4c7148fc6c0bb727139010e15aab198be6c5d00276f83246b417ce69831f9d6 \
-    --hash=sha256:d57d46021c20d4efc28f69b4ca4670dffbb7bdafa51d1967b747849726ec643b \
-    --hash=sha256:d648515c65f8871ceca6a0446be32fb1a0aae414db3907ec0df6cc2380dd0c04 \
-    --hash=sha256:d93c02ae8bd33f73624319d85cba47e754155c5bf104c0c5ca96fcd1f3094939 \
-    --hash=sha256:dbe50ffd50c7e1b8e3bedafafd10fabe8a7cf51916f995fd57316eb1293f2439 \
-    --hash=sha256:dbfb8f8ac48a8fd5a9f83cdbba0a23796f3ff5f9421c735808ed134d3318046f \
-    --hash=sha256:df82086e6efb002a8e4f8f787dd2ddf9db46403fe8697b7620111663799b62b8 \
-    --hash=sha256:dfa0820888cc4549fcce7e6bd8affa7d75198d885ccd0bb0760def4bb8461862 \
-    --hash=sha256:e1b52aa981e034896712460c899ee30707c8c6a385e79bb7648aac76c748a3da \
-    --hash=sha256:e1c8ea447dcfaa7f7d815d07bddb131383275682601878b5711f59fac68045a2 \
-    --hash=sha256:e35192a1d53e55d510d8bb1023c988c7cdae6d94539074971741b2a7656e49a1 \
-    --hash=sha256:e38cdae682cfec4b3816722dccf6376ca59049726d57dca83c2fe7cc13665589 \
-    --hash=sha256:e42feab6c93fa3264708502f5062147073c7e57bc56bc1c44ed00efa53bc1859 \
-    --hash=sha256:eba39fca6e1fc7c58a5e6b5c320c6eec86014f7075dfa0fb1a79076e00304b3a \
-    --hash=sha256:f13b18e7dec056336f29ee77dea3cc5db0271d6215cac7249cc5c61b0a49d293 \
-    --hash=sha256:f343c39928097175acf2f7d0cba5c00b0f62265d88a173a4ce264266ac849bd9 \
-    --hash=sha256:f50abe60347bf8afe2b2f58db86cf3ac6e418eec7ffa01d9dc90ba29fc64f243 \
-    --hash=sha256:f8f9f2be064c8bf1189f46f7062fd42765d94f59cfb7db7ef8db19563192110a \
-    --hash=sha256:faf83e50714837af72f13e9369c50377552a4a74049d4477bed51c7e5822d94b \
-    --hash=sha256:fb57a6b538ec7a01b937986bc093aec530fb056135b6bc9cfdd0bf8460c25bc2 \
-    --hash=sha256:fe87ccbc39a103709d0a5afa75240c15a94611af129261e9484bef0bc97960b2 \
-    --hash=sha256:ff201e8b93cd6a3849ec3fecb1d642d0391ca4a387f1162adaadddfd1986598c
+pydantic-core==2.46.4 \
+    --hash=sha256:00c603d540afdd6b80eb39f078f33ebd46211f02f33e34a32d9f053bba711de0 \
+    --hash=sha256:0186750b482eefa11d7f435892b09c5c606193ef3375bcf94aa00ae6bfb66262 \
+    --hash=sha256:041bde0a48fd37cf71cab1c9d56d3e8625a3793fef1f7dd232b3ff37e978ecda \
+    --hash=sha256:0c563b08bca408dc7f65f700633d8442fffb2421fc47b8101377e9fd65051ff0 \
+    --hash=sha256:0cbe8b01f948de4286c74cdd6c667aceb38f5c1e26f0693b3983d9d74887c65e \
+    --hash=sha256:0ce40cd7b21210e99342afafbd4d0f76d784eb5b1d60f3bdc566be4983c6c73b \
+    --hash=sha256:0e96592440881c74a213e5ad528e2b24d3d4f940de2766bed9010ab1d9e51594 \
+    --hash=sha256:10e17cbb10a330363733efc4d7c4d0dd827ac0909b8f6a6542298fed1ea62f29 \
+    --hash=sha256:133878133d271ade3d41d1bfb2a45ec38dbdbda40bc065921c6b04e4630127e2 \
+    --hash=sha256:14d4edf427bdcf950a8a02d7cb44a08614388dd6e1bdcbf4f67504fa7887da9c \
+    --hash=sha256:14f4c5d6db102bd796a627bbb3a17b4cf4574b9ae861d8b7c9a9661c6dd3362d \
+    --hash=sha256:17299feefe090f2caa5b8e37222bb5f663e4935a8bfa6931d4102e5df1a9f398 \
+    --hash=sha256:184c081504d17f1c1066e430e117142b2c77d9448a97f7b65c6ac9fd9aee238d \
+    --hash=sha256:18e5ceec2ab67e6d5f1a9085e5a24c9c4e2ac4545730bfe668680bca05e555f3 \
+    --hash=sha256:19e51f073cd3df251856a8a4189fbdf1de4012c3ebacfb1884f94f1eb406079f \
+    --hash=sha256:1a7dd0b3ee80d90150e3495a3a13ac34dbcbfd4f012996a6a1d8900e91b5c0fb \
+    --hash=sha256:1d8ba486450b14f3b1d63bc521d410ec7565e52f887b9fb671791886436a42f7 \
+    --hash=sha256:2108ba5c1c1eca18030634489dc544844144ee36357f2f9f780b93e7ddbb44b5 \
+    --hash=sha256:228ee9bae8bef5b1e97ec58302f80357c37199e0d0a99174e138d28e6957b9d9 \
+    --hash=sha256:23ace664830ee0bfe014a0c7bc248b1f7f25ed7ad103852c317624a1083af462 \
+    --hash=sha256:2412e734dcb48da14d4e4006b82b46b74f2518b8a26ee7e58c6844a6cd6d03c4 \
+    --hash=sha256:29c61fc04a3d840155ff08e475a04809278972fe6aef51e2720554e96367e34b \
+    --hash=sha256:2f84c03c8607173d16b5a854ec68a2f9079ae03237a54fb506d13af47e1d018d \
+    --hash=sha256:3009f12e4e90b7f88b4f9adb1b0c4a3d58fe7820f3238c190047209d148026df \
+    --hash=sha256:3245406455a5d98187ec35530fd772b1d799b26667980872c8d4614991e2c4a2 \
+    --hash=sha256:3447661d99f75a3683a4cf5c87da72f2161964611864dbbeac7fbb118bb4bfc0 \
+    --hash=sha256:372429a130e469c9cd698925ce5fc50940b7a1336b0d82038e63d5bbc4edc519 \
+    --hash=sha256:395aebd9183f9d112f569aeb5b2214d1a10a33bec8456447f7fbdfa51d38d4cd \
+    --hash=sha256:3a233125ac121aa3ffba9a2b59edfc4a985a76092dc8279586ab4b71390875e7 \
+    --hash=sha256:3be77f45df024d789a672ae34f8b06fb346c4f9f46ea714956660ea4862e89ac \
+    --hash=sha256:3bf92c5d0e00fefaab325a4d27828fe6b6e2a21848686b5b60d2d9eeb09d76c6 \
+    --hash=sha256:3ecbc122d18468d06ca279dc26a8c2e2d5acb10943bb35e36ae92096dc3b5565 \
+    --hash=sha256:3fb702cd90b0446a3a1c5e470bfa0dd23c0233b676a9099ddcc964fa6ca13898 \
+    --hash=sha256:428e04521a40150c85216fc8b85e8d39fece235a9cf5e383761238c7fa9b96fb \
+    --hash=sha256:432c179df7874eeb73307aad2df0755e1ae0efa61ff0ea89b93e194411ae3928 \
+    --hash=sha256:4a05d69cba51d852c5c3e92758653245a50c0b646ced0cf05bd793ed592839d6 \
+    --hash=sha256:4c63ebc82684aa89d9a3bcbd13d515b3be44250dc68dd3bd81526c1cb31286c3 \
+    --hash=sha256:4fc73cb559bdb54b1134a706a2802a4cddd27a0633f5abb7e53056268751ac6a \
+    --hash=sha256:4fcbe087dbc2068af7eda3aa87634eba216dbda64d1ae73c8684b621d33f6596 \
+    --hash=sha256:56cb4851bcaf3d117eddcef4fe66afd750a50274b0da8e22be256d10e5611987 \
+    --hash=sha256:5855698a4856556d86e8e6cd8434bc3ac0314ee8e12089ae0e143f64c6256e4e \
+    --hash=sha256:5a4330cdbc57162e4b3aa303f588ba752257694c9c9be3e7ebb11b4aca659b5d \
+    --hash=sha256:5b712b53160b79a5850310b912a5ef8e57e56947c8ad690c227f5c9d7e561712 \
+    --hash=sha256:5d5902252db0d3cedf8d4a1bc68f70eeb430f7e4c7104c8c476753519b423008 \
+    --hash=sha256:617d7e2ca7dcb8c5cf6bcb8c59b8832c94b36196bbf1cbd1bfb56ed341905edd \
+    --hash=sha256:62f875393d7f270851f20523dd2e29f082bcc82292d66db2b64ea71f64b6e1c1 \
+    --hash=sha256:633147d34cf4550417f12e2b1a0383973bdf5cdfde212cb09e9a581cf10820be \
+    --hash=sha256:66ce7632c22d837c95301830e111ad0128a32b8207533b60896a96c4915192ea \
+    --hash=sha256:6b3ace8194b0e5204818c92802dcdca7fc6d88aabbb799d7c795540d9cd6d292 \
+    --hash=sha256:6f2eeda33a839975441c86a4119e1383c50b47faf0cbb5176985565c6bb02c33 \
+    --hash=sha256:7027560ee92211647d0d34e3f7cd6f50da56399d26a9c8ad0da286d3869a53f3 \
+    --hash=sha256:7283d57845ecf5a163403eb0702dfc220cc4fbdd18919cb5ccea4f95ee1cdab4 \
+    --hash=sha256:7a5f930472650a82629163023e630d160863fce524c616f4e5186e5de9d9a49b \
+    --hash=sha256:7bfb192b3f4b9e8a89b6277b6ce787564f62cfd272055f6e685726b111dc7826 \
+    --hash=sha256:811ff8e9c313ab425368bcbb36e5c4ebd7108c2bbf4e4089cfbb0b01eff63fac \
+    --hash=sha256:8233f2947cf85404441fd7e0085f53b10c93e0ee78611099b5c7237e36aacbf7 \
+    --hash=sha256:82cf5301172168103724d49a1444d3378cb20cdee30b116a1bd6031236298a5d \
+    --hash=sha256:8358a950c8909158e3df31538a7e4edc2d7265a7c54b47f0864d9e5bae9dcebf \
+    --hash=sha256:85bb3611ff1802f3ee7fdd7dbff26b56f343fb432d57a4728fdd49b6ef35e2f4 \
+    --hash=sha256:86e1a4418c6cd97d60c95c71164158eaf7324fae7b0923264016baa993eba6fc \
+    --hash=sha256:8b9bab013d1c7a79d3501ff86d0bc9c31bf587db4551677b96bec07df78c6b15 \
+    --hash=sha256:8c5dac79fa1614d1e06ca695109c6105923bd9c7d1d6c918d4e637b7e6b32fd3 \
+    --hash=sha256:8d0820e8192167f80d88d64038e609c31452eeca865b4e1d9950a27a4609b00b \
+    --hash=sha256:8daafc69c93ee8a0204506a3b6b30f586ef54028f52aeeeb5c4cfc5184fd5914 \
+    --hash=sha256:9037063db01f09b09e237c282b6792bd4da634b5402c4e7f0c61effed7701a04 \
+    --hash=sha256:905a0ed8ea6f2d61c1738835f99b699348d7857379083e5fc497fa0c967a407c \
+    --hash=sha256:90884113d8b48f760e9587002789ddd741e76ab9f89518cd1e43b1f1a52ec44b \
+    --hash=sha256:91a06d2e259ecfbd8c901d70c3c507900458498142b3026a296b7de4d1322cc9 \
+    --hash=sha256:926c9541b14b12b1681dca8a0b75feb510b06c6341b70a8e500c2fdcff837cce \
+    --hash=sha256:9401557acd873c3a7f3eb9383edef8ac4968f9510e340f4808d427e75667e7b4 \
+    --hash=sha256:9551187363ffc0de2a00b2e47c25aeaeb1020b69b668762966df15fc5659dd5a \
+    --hash=sha256:962ccbab7b642487b1d8b7df90ef677e03134cf1fd8880bf698649b22a69371f \
+    --hash=sha256:97e7cf2be5c77b7d1a9713a05605d49460d02c6078d38d8bef3cbe323c548424 \
+    --hash=sha256:9aa768456404a8bf48a4406685ac2bec8e72b62c69313734fa3b73cf33b3a894 \
+    --hash=sha256:9bc519fbf2b7578398853d815009ae5e4d4603d12f4e3f91da8c06852d3da3e9 \
+    --hash=sha256:9d56801be94b86a9da183e5f3766e6310752b99ff647e38b09a9500d88e46e76 \
+    --hash=sha256:9f444c499b3eefd3a92e348059471ea0c3a6e303d9c1cec09fa748fd9f895201 \
+    --hash=sha256:9fa8ae11da9e2b3126c6426f147e0fba88d96d65921799bb30c6abd1cb2c97fb \
+    --hash=sha256:a0f62d0a58f4e7da165457e995725421e0064f2255d8eccebc49f41bbc23b109 \
+    --hash=sha256:a396dcc17e5a0b164dbe026896245a4fa9ff402edca1dff0be3d53a517f74de4 \
+    --hash=sha256:aaa2a54443eff1950ba5ddc6b6ccda0d9c84a364276a62f969bdf2a390650848 \
+    --hash=sha256:ad785e92e6dc634c21555edc8bd6b64957ab844541bcb96a1366c202951ae526 \
+    --hash=sha256:af8244b2bef6aaad6d92cda81372de7f8c8d36c9f0c3ea36e827c60e7d9467a0 \
+    --hash=sha256:b078afbc25f3a1436c7a1d2cd3e322497ee99615ba97c563566fdf46aff1ee01 \
+    --hash=sha256:b2f69dec1725e79a012d920df1707de5caf7ed5e08f3be4435e25803efc47458 \
+    --hash=sha256:b8458003118a712e66286df6a707db01c52c0f52f7db8e4a38f0da1d3b94fc4e \
+    --hash=sha256:bb63e0198ca18aad131c089b9204c23079c3afa95487e561f4c522d519e55aba \
+    --hash=sha256:bfec22eab3c8cc2ceec0248aec886624116dc079afa027ecc8ad4a7e62010f8a \
+    --hash=sha256:c1747f85cee84c26985853c6f3d9bd3e75da5212912443fa111c113b9c246f39 \
+    --hash=sha256:c1b3f518abeca3aa13c712fd202306e145abf59a18b094a6bafb2d2bbf59192c \
+    --hash=sha256:c50f2528cf200c5eed56faf3f4e22fcd5f38c157a8b78576e6ba3168ec35f000 \
+    --hash=sha256:c68fcd102d71ea85c5b2dfac3f4f8476eff42a9e078fd5faefff6d145063536b \
+    --hash=sha256:c7a7bd4e39e8e4c12c39cd480356842b6a8a06e41b23a55a5e3e191718838ddf \
+    --hash=sha256:c94f0688e7b8d0a67abf40e57a7eaaecd17cc9586706a31b76c031f63df052b4 \
+    --hash=sha256:cbaf13819775b7f769bf4a1f066cb6df7a28d4480081a589828ef190226881cd \
+    --hash=sha256:cd2213145bcc2ba85884d0ac63d222fece9209678f77b9b4d76f054c561adb28 \
+    --hash=sha256:ce5c1d2a8b27468f433ca974829c44060b8097eedc39933e3c206a90ee49c4a9 \
+    --hash=sha256:d396ec2b979760aaf3218e76c24e65bd0aca24983298653b3a9d7a45f9e47b30 \
+    --hash=sha256:d51026d73fcfd93610abc7b27789c26b313920fcfb20e27462d74a7f8b06e983 \
+    --hash=sha256:d80ee3d731373b24cebbc10d689ca4ee1875caf0d5703a245db18efd4dd37fc1 \
+    --hash=sha256:d995260fdf4e1db774581b4900e0f832abe3c7c84996726bbc161b19c8f29e76 \
+    --hash=sha256:da4b951fe36dc7c3a1ccb4e3cd1747c3542b8c9ceede8fc86cae054e764485f5 \
+    --hash=sha256:daa27d92c36f24388fe3ad306b174781c747627f134452e4f128ea00ce1fe8c4 \
+    --hash=sha256:db06ffe51636ffe9ca531fe9023dd64bdd794be8754cb5df57c5498ae5b518a7 \
+    --hash=sha256:e0d65b8c354be7fb5f720c3caa8bc940bc2d20ce749c8e06135f07f8ed95dd7c \
+    --hash=sha256:e68b7a074f65a2fd746c52a7ce6142ab7006074ac269ace0c25cd8ba171f8066 \
+    --hash=sha256:e739fee756ba1010f8bcccb534252e85a35fe45ae92c295a06059ce58b74ccd3 \
+    --hash=sha256:e846ae7835bf0703ae43f534ab79a867146dadd59dc9ca5c8b53d5c8f7c9ef02 \
+    --hash=sha256:e9c26f834c65f5752f3f06cb08cb86a913ceb7274d0db6e267808a708b46bc89 \
+    --hash=sha256:ea793e075b70290d89d8142074262885d3f7da19634845135751bd6344f73b50 \
+    --hash=sha256:f027324c56cd5406ca49c124b0db10e56c69064fec039acc571c29020cc87c76 \
+    --hash=sha256:f13a646d65d09fbf1bc6b3a9635d30095c8e7e5cc419ff35ecc563c5fd04cd49 \
+    --hash=sha256:f47286a97f0bc9b8859519809077b91b2cefe4ae47fcbf5e466a009c1c5d742b \
+    --hash=sha256:f747929cf940cddb5b3668a390056ddd5ba2e5010615ea2dcf4f9c4f3ab8791d \
+    --hash=sha256:f99626688942fb746e545232e7726926f3be91b5975f8b55327665fafda991c7 \
+    --hash=sha256:f9fa868638bf362d3d138ea55829cefb3d5f4b0d7f142234382a15e2485dbec4 \
+    --hash=sha256:fbdb89b3e1c94a30cc5edfce477c6e6a5dc4d8f84665b455c27582f211a1c72c \
+    --hash=sha256:fc010ab034c8c7452522748bf937df58020d256ccae0874463d1f4d01758af8e \
+    --hash=sha256:fc3e9034a63de20e15e8ade85358bc6efc614008cab72898b4b4952bea0509ff \
+    --hash=sha256:fd8b3d9fd264be37976686c7f65cd52a83f5e84f4bfd2adf9c1d469676bbb6ae
     # via pydantic
 pydantic-settings==2.14.2 \
     --hash=sha256:a20c97b37910b6550d5ea50fbcc2d4187defe58cd57070b73863d069419c9440 \
@@ -1626,10 +1635,6 @@ pyjwt==2.13.0 \
     --hash=sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423 \
     --hash=sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728
     # via mcp
-pyopenssl==26.3.0 \
-    --hash=sha256:46367f8f66b92271e6d218da9c87607e1ef5a0bc5c8dea5bb3db82f395c385a3 \
-    --hash=sha256:589de7fae1c9ea670d18422ed00fc04da787bbde8e1454aea872aa57b49ad341
-    # via google-auth
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
     --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427
@@ -1862,7 +1867,6 @@ rich==15.0.0 \
     # via
     #   strix-agent
     #   textual
-    #   typer
 rpds-py==2026.6.3 \
     --hash=sha256:0be972be84cfcaf46c8c6edf690ca0f154ac17babf1f6a955a51579b34ad2dc5 \
     --hash=sha256:127565fead0a10943b282957bd5447804ff3160ad79f2ad2635e6d249e380680 \
@@ -1983,10 +1987,6 @@ rpds-py==2026.6.3 \
     # via
     #   jsonschema
     #   referencing
-shellingham==1.5.4 \
-    --hash=sha256:7ecfff8f2fd72616f7481040475a65b2bf8af90a56c89140852d1120324e8686 \
-    --hash=sha256:8dbca0739d487e5bd35ab3ca4b36e11c4078f3a234bfce294b0a0291363404de
-    # via typer
 six==1.17.0 \
     --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
     --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81
@@ -2103,10 +2103,6 @@ tqdm==4.68.4 \
     # via
     #   huggingface-hub
     #   openai
-typer==0.26.8 \
-    --hash=sha256:3512ca79ac5c11113414b36e80281b872884477722440691c89d1112e321a49c \
-    --hash=sha256:c244a6bd558886fe3f8780efb6bdd28bb9aff005a94eedebaa5cb32926fe2f7e
-    # via huggingface-hub
 types-requests==2.33.0.20260712 \
     --hash=sha256:2141b67ab534a5c5cd2dac5034f2a35f42e699c5bf185eee608c5246a069d7fb \
     --hash=sha256:de027e28c171d3da529689cbfa023b0b4eab188c8dfa22fd834eebd2cee6e7bb
@@ -2148,116 +2144,76 @@ uvicorn==0.51.0 \
     --hash=sha256:5d38af6cd620f2ae3849fb44fd4879e0890aa1febe8d47eb355fb45d93fe6a5b \
     --hash=sha256:f6f4b69b657c312f516dd2d268ab9ae6f254b11e4bac504f37b2ab58b24dd0b0
     # via mcp
-websockets==16.1 \
-    --hash=sha256:00d50c0a27098fcb7ab47b3d99a1b1159b534dbcd959fbf05113ebc37e5f927b \
-    --hash=sha256:0352f5b38b40e857b6428d468fa21dbb4dd4a567d933c26d9831b4efe1b92f43 \
-    --hash=sha256:0704df094b2d5fa7f6f410925a594c2a5c9a09167731a76292e5410934208209 \
-    --hash=sha256:0b8d13ceabc5c60995f201b5211d76876e17e68706ebf5d3bc666b32eefff1a6 \
-    --hash=sha256:0c64c024ddf7a35331b21fcddb562a039c275d2c82e8c2d12939e7da23997270 \
-    --hash=sha256:115fc4695b94bb855995b23fb1abcb66099a5995575d3d5bc5605a616c58d0eb \
-    --hash=sha256:187323204c3b2fc465e8fc2609e60437c521790cb9c1acb49c4c452a33e57f37 \
-    --hash=sha256:1a9f08a0728b0835f1c6abe1d9b746ab3de49b7336a0e1919cf96be1e76273eb \
-    --hash=sha256:1acb698bff1da1782b31aebd8d7a24d7d05453964abcd7d03dbf6e25893908e8 \
-    --hash=sha256:1ae4a686a662964a6671069f84f7f908cc3475e782227726b0c622c715962105 \
-    --hash=sha256:1facd189d8190af30487a55b4c3688484dd50801628a3b5b2ccd26db08e67057 \
-    --hash=sha256:2237081454846fb40403a80ba86d82e2038b9c45865ab96af0abe7d002a91045 \
-    --hash=sha256:23e545ea8ae4263e37cdfd4e22a217f519e48e432728bc461185bbf585f38a83 \
-    --hash=sha256:299468cbe42e2b9981134c7c51d99387d8a7bf562b00183b3eec53f882846dad \
-    --hash=sha256:2bd3e12cd9afbe2baedae0b1eeade8ba64329b60fe2f9abdc966bd10fd2c2ef5 \
-    --hash=sha256:2c0e0857c30bbbc2bb5c30687508f0b7ec19aa026cd9f2ff8424d0fee42dcc07 \
-    --hash=sha256:2c1c85f61bc9d5eac57ce705d848dc2d2ce3680638300bf4e1da7d749e2cf4ce \
-    --hash=sha256:2ed64e5a97b0b97a0b66e18bfe281317a75fbbd5afe692f939ea8d14a4292f2c \
-    --hash=sha256:30c379d5b207d3a7f0ba4c2e4602a895b0bcc63fb5f5371a4ae7fbddb03b672b \
-    --hash=sha256:353f3bc6e058ac1ccab4b3588e8598837a8c04cfc8351233e6d523be675d844c \
-    --hash=sha256:35f41979c8623df9bd30d949d82010a8fda5c56ff12cd8508a5b7272b6d4b53a \
-    --hash=sha256:36069b74671e7e667f48a7484249f84c45a825a134c8b1bdc01875d0daa10d79 \
-    --hash=sha256:37b0e4d726ffea3776670092d3d13e1cb605076f036a695fd1259de0d9b9fe02 \
-    --hash=sha256:39c7e7730be33b8f0cd6f0aa8e8c82f9cdd1813f159765e073b2ece65f4824b5 \
-    --hash=sha256:39e947b1f5fdab045174306e3916785bf3ed537648acc1549827c08c33b10953 \
-    --hash=sha256:3c3d2cbd1602593bad49bd86fa3fbb25407d87a3b4bf8857c0ac5ac4914e1901 \
-    --hash=sha256:3fd3e6a7af2c8fcdcf4ffbeaf7f54a567b91a83267204187797f31faaa2a4efa \
-    --hash=sha256:45c5ea55446171949eb99fd34b771ceddd511ca21958d40d0197ced33159e5ee \
-    --hash=sha256:4a6db7972d52bc1b66cefe2246902e256cbaebc9ba8a45eac09343d7eb6671b2 \
-    --hash=sha256:4e969170c3b08e1d8dabd990fef1fa702c4233aeaabec33f871806e444f6a0e4 \
-    --hash=sha256:520b0fd0395f075febb283c76755af724ab9fd19dffa4f3bfd18cb4e622790a3 \
-    --hash=sha256:587f83c2ce8a5d628e166384d77fa7f0ac69b9007d515ab442123e6615aa8da3 \
-    --hash=sha256:589f8842521c8307684ce0b40ce4ad70c5e0aa46484c6f1225a94ef4b8970341 \
-    --hash=sha256:5dd0e666b5931c0509cf65714686a1c5126771e663a79ac5d40da4f58b1f9502 \
-    --hash=sha256:5f5218de1ed047385ca53744caba9435d65f75d008364970a3fae95a05812cf9 \
-    --hash=sha256:63339bc8c63c86a463177775cb7c677691f5bcfac7b3b2f01b286d42acd41600 \
-    --hash=sha256:638cf57c48b4ad8ac1ff1e453f4f97db2426b690ddc111e6da96b27b4a340bc3 \
-    --hash=sha256:67b56828712f5fa7852de4c0265c28827311a657a4d275b7312ed0d1a918bee4 \
-    --hash=sha256:6852c9f653966c16109d3b6f31181fd734f7914927e3f0fa1117af7a18c9aa21 \
-    --hash=sha256:6c1eb7df4170d5068892a8834fb5c07b9552353deb0dbeb0bff3820481ae4792 \
-    --hash=sha256:6eb604a4167f0a0d53c2243dfc667a29f0b43c3436057184e070bb82a1000fa2 \
-    --hash=sha256:70bd789afab579602968c39f21cb925466505f3edff22f0ae852bca54978a4f9 \
-    --hash=sha256:7143aa09a67e1c013be44e81a88dfe90fc6244198ab86c7edd064152cf619805 \
-    --hash=sha256:7289d899c79e763e6221c8dcb8959361cb43274418538d7c7ad16a43b01d12f9 \
-    --hash=sha256:7358ff21632b5d062707f73e859c824f1c3807e73d8ca25e71caca7c4cdcf145 \
-    --hash=sha256:75c98e3920039d0edff03b74478ada504b7ce3a1bc406db2cabfca84320f7baf \
-    --hash=sha256:7acb811fad08e611755800d1560e395c67e11a6bd563598ea6abb319afb86938 \
-    --hash=sha256:81495f9c0085361c582efbc3207fb877174cfe03370f17d9cd70624404aa526f \
-    --hash=sha256:82d1c2cab3c133e9d059b3a5420bed9376bd30e21c185c63dda4ddadf6ddda47 \
-    --hash=sha256:83bdabafef431247e6b11a9aab8a0893fd8e82e1ed95b32e0373625b03ffce4a \
-    --hash=sha256:84c170c6869633536921e4474b1cce7254c0c9b0053ef5725f966cee47e718e4 \
-    --hash=sha256:856bdd638f8277f86465057bfdd4da097c73058fb0f9d2bd5baea29e2bf2d367 \
-    --hash=sha256:8613129a2533f08de24505e69a3e403cedaadae49abdb043c4d170ca71b7e4bd \
-    --hash=sha256:8e9c4e369fc181b2d41a99e01477215cecdc8546a39f7d41a59cc0a7065a0b09 \
-    --hash=sha256:8fdf0b00d0d1f30d1f06a92cab46fe542eec3eb302a7aee7163f142d0780f216 \
-    --hash=sha256:9003a1fde1c21a322a3ca3fa0c4bda8c639da81dbc925162766086643b05ba87 \
-    --hash=sha256:97f15b6d9ea9c2eaf6ccab964a082b09bfa6634a495bb0c2e9e7ee6943f58976 \
-    --hash=sha256:98ab58a4faa72b46da0127ccc1931dcbfc0985b0778892300a092185910c4cbe \
-    --hash=sha256:9a3f125e44c3e34d61d111652e608e0f5b85ce08c225c8d56ad0eb822fa40030 \
-    --hash=sha256:9b3b021d0ed4bc16eea9775f62c9fa71acdacba0fc790b38581754dedf29ca60 \
-    --hash=sha256:9c1cf6f9a936b030b5bed0e800c5ee32069338129084546baf5ff5014dc62fa9 \
-    --hash=sha256:9cb074d150e4ad2a77aa8a332c2be85f3f64f2681519d2570c1225c12c9821ff \
-    --hash=sha256:9dba74233c8c3ce368850818c98354dad2570f57231b3fd3bd00d7aa57628881 \
-    --hash=sha256:a0285df7925657ad65a65fb8dc330808bce082827538fd50ef45fa12d1fc5bca \
-    --hash=sha256:a089979d6173b27af18026c8d8b0077f83669a9169174482c4651e9f5739a5b6 \
-    --hash=sha256:a24d1f35aef07d794a16c853c688e74956c50239bec37b4f2de080056046419b \
-    --hash=sha256:a3c18dba232ec2b92a68579c9fed8ff5a18f853d1e09fc0b6ca3159e94f689fe \
-    --hash=sha256:a3cd6c9b798218798f4bb7b2e71c38f0e744bb94ca537b13376f88019d46384d \
-    --hash=sha256:a58532c49a851bcb481e58c1be23b315c17fe2fbbed509d75aeea12f543d2c15 \
-    --hash=sha256:a5bf9c23f197b4ec88290fd5463f33db67362a1bb10f85fc2e8e7627f0ddab97 \
-    --hash=sha256:a71b73d143991714144e159f767b698f03c4a70b8a65ae1733b650cff488045b \
-    --hash=sha256:a9b1d7a63cba8e6b9b77e499a81eab29d31100298d090ad4507d1048c0b9cae0 \
-    --hash=sha256:ad9411eded8988b879be6038206698bf7106c85a78f642c004485bcb95be17eb \
-    --hash=sha256:b0232ed141cec3df2af5a3959a071c51f40036336b0d37e17faf9ef52fc73e47 \
-    --hash=sha256:b22b1f4950f6ab7126623329c3b47b3b90a14c05db517f2db2a026ad6c928352 \
-    --hash=sha256:b43fcfb521ac2f34ba80b7b8ea16303e4ad82dd8af667bf40839ad3a5d37b164 \
-    --hash=sha256:b6aa3f7ad345cf3862c21f4fbf2ef5e14d911348476c2845e137c091fe3a3f0b \
-    --hash=sha256:b8ef8b1c8d6bd029a475ac432e730fba2dfd456715d26c473e2a82291024b99c \
-    --hash=sha256:b9f5d83f80f4d7c4bba6d97f3755ac05850c784dce0fd2ab371c4e41172f53ff \
-    --hash=sha256:bedbc5efeb96621aa2921d2d92608246691399418cac22acba427eb11877ea1f \
-    --hash=sha256:bef52d327d70fa75dad93ee61ea2cb1d1489aca9f35c188833563f5a3b4df0a5 \
-    --hash=sha256:c14b6634af01541e4efe2954fd8f263386f7aa6d37c01e55dd8109fd17661452 \
-    --hash=sha256:c39907f1eaf11f6277def65aa02d68f30576b693d0c1ca332aafa3caa723ac6d \
-    --hash=sha256:c3e99757f5baafe20fc598e202ea6f5b0b265186ad38d0a17bd8beca16296955 \
-    --hash=sha256:c5149dfe490ec7e5ee5dbf624c642fb725f93a5575c7f00ab594ca9eddb8dd81 \
-    --hash=sha256:c522bd48e625b6d557aa228967258d6d3da031c4cc21d3352fb302479aa9ba0a \
-    --hash=sha256:c54fe94fb2f11e11b48920c5f971e298cec73ac35db56efe57a49db63dfc95d4 \
-    --hash=sha256:c5cf88e3faa2f7931bc6baeee7599c97656a3f6ac7f831f4fccba233e141783a \
-    --hash=sha256:cc0c6a6eef613c7da32d4fb068f82ef834b58134f6a16b54e6c1e5bf9529ab3d \
-    --hash=sha256:cce36c80b3f2fede7942f1756d3d885fa6fa086766c8c1bcf00695ab80f0d51a \
-    --hash=sha256:cd68f0914f3b64694895bc5e9b14e8b447e41d7bf5ffaf989bb8dcb5e2dfdce7 \
-    --hash=sha256:d0f38f4c3e9b359e257c339c2cc1967ccaeedb102e57c1c986bdce4bf4f32268 \
-    --hash=sha256:d0fb4b46f121eccd539353baebd1083a8767a9a351109453d1d1caecd1ba40c2 \
-    --hash=sha256:d106396927a7f00b0f3a69215c3357f87bf0bca6844247121f7e8291e826a3b1 \
-    --hash=sha256:d19c9067e1fe9490f974bffbc0e443b80a7674c5efb4980c429cc00771f07c5a \
-    --hash=sha256:d440ff0c6c7469ad59c0a412c383c235935b43635e89425e3f6a0c36de90c31b \
-    --hash=sha256:d71bed12909b8039955536e192867d02d76cd3797cedfd0facf822e7668636c3 \
-    --hash=sha256:dc2c453f3b5f99c56b16e233aad5299860558487d26adb2ed27a00c14ca24b8c \
-    --hash=sha256:dddd27175bf640acae5561fa79b77e8ec71fc445816200523e5c19b6a556fb72 \
-    --hash=sha256:de72a9c611178b15557d98eabd3101c9663c4d68938510478a6d162f99afd213 \
-    --hash=sha256:e22e9e3719f5131bd62da4db63c8da63eb8c91cc99e16c1cbd122f130e1ae07a \
-    --hash=sha256:e2fb33ccb16ee40a95cc676d7b0ff451a9a2632f11a0dbc2e666326892b2e1de \
-    --hash=sha256:e7d6014888a0632e1ed7a4095248bb3095232999447f2d83bfb1900987dd9ed9 \
-    --hash=sha256:eeab6d27f51c7e579023c971f5e6dff200deadf01faf6831beaecd32052dfaef \
-    --hash=sha256:f881fca0a45dd6789939bd6637cd98169b92f1c3fdc78262f2cb9ec2cb1f324e \
-    --hash=sha256:f9f4fb9ae8b802e55609685db98382d48fd3feb1397804e1e774968dea0f28c7 \
-    --hash=sha256:fd847ab82133015afe65d778e7966ab42dba16bd7ad2e5b8a7918db6539f3f94 \
-    --hash=sha256:fef2debfe7f7ebdda12176f26166f95b7af17af05ba06150fcf889032e0213e9 \
-    --hash=sha256:ff9b000064b88787ba9f7a3cb2af2b68a658ca5aad76458a46469e7124b678a0
+websockets==15.0.1 \
+    --hash=sha256:0701bc3cfcb9164d04a14b149fd74be7347a530ad3bbf15ab2c678a2cd3dd9a2 \
+    --hash=sha256:0a34631031a8f05657e8e90903e656959234f3a04552259458aac0b0f9ae6fd9 \
+    --hash=sha256:0af68c55afbd5f07986df82831c7bff04846928ea8d1fd7f30052638788bc9b5 \
+    --hash=sha256:0c9e74d766f2818bb95f84c25be4dea09841ac0f734d1966f415e4edfc4ef1c3 \
+    --hash=sha256:0f3c1e2ab208db911594ae5b4f79addeb3501604a165019dd221c0bdcabe4db8 \
+    --hash=sha256:0fdfe3e2a29e4db3659dbd5bbf04560cea53dd9610273917799f1cde46aa725e \
+    --hash=sha256:1009ee0c7739c08a0cd59de430d6de452a55e42d6b522de7aa15e6f67db0b8e1 \
+    --hash=sha256:1234d4ef35db82f5446dca8e35a7da7964d02c127b095e172e54397fb6a6c256 \
+    --hash=sha256:16b6c1b3e57799b9d38427dda63edcbe4926352c47cf88588c0be4ace18dac85 \
+    --hash=sha256:2034693ad3097d5355bfdacfffcbd3ef5694f9718ab7f29c29689a9eae841880 \
+    --hash=sha256:21c1fa28a6a7e3cbdc171c694398b6df4744613ce9b36b1a498e816787e28123 \
+    --hash=sha256:229cf1d3ca6c1804400b0a9790dc66528e08a6a1feec0d5040e8b9eb14422375 \
+    --hash=sha256:27ccee0071a0e75d22cb35849b1db43f2ecd3e161041ac1ee9d2352ddf72f065 \
+    --hash=sha256:363c6f671b761efcb30608d24925a382497c12c506b51661883c3e22337265ed \
+    --hash=sha256:39c1fec2c11dc8d89bba6b2bf1556af381611a173ac2b511cf7231622058af41 \
+    --hash=sha256:3b1ac0d3e594bf121308112697cf4b32be538fb1444468fb0a6ae4feebc83411 \
+    --hash=sha256:3be571a8b5afed347da347bfcf27ba12b069d9d7f42cb8c7028b5e98bbb12597 \
+    --hash=sha256:3c714d2fc58b5ca3e285461a4cc0c9a66bd0e24c5da9911e30158286c9b5be7f \
+    --hash=sha256:3d00075aa65772e7ce9e990cab3ff1de702aa09be3940d1dc88d5abf1ab8a09c \
+    --hash=sha256:3e90baa811a5d73f3ca0bcbf32064d663ed81318ab225ee4f427ad4e26e5aff3 \
+    --hash=sha256:47819cea040f31d670cc8d324bb6435c6f133b8c7a19ec3d61634e62f8d8f9eb \
+    --hash=sha256:47b099e1f4fbc95b701b6e85768e1fcdaf1630f3cbe4765fa216596f12310e2e \
+    --hash=sha256:4a9fac8e469d04ce6c25bb2610dc535235bd4aa14996b4e6dbebf5e007eba5ee \
+    --hash=sha256:4b826973a4a2ae47ba357e4e82fa44a463b8f168e1ca775ac64521442b19e87f \
+    --hash=sha256:4c2529b320eb9e35af0fa3016c187dffb84a3ecc572bcee7c3ce302bfeba52bf \
+    --hash=sha256:54479983bd5fb469c38f2f5c7e3a24f9a4e70594cd68cd1fa6b9340dadaff7cf \
+    --hash=sha256:558d023b3df0bffe50a04e710bc87742de35060580a293c2a984299ed83bc4e4 \
+    --hash=sha256:5756779642579d902eed757b21b0164cd6fe338506a8083eb58af5c372e39d9a \
+    --hash=sha256:592f1a9fe869c778694f0aa806ba0374e97648ab57936f092fd9d87f8bc03665 \
+    --hash=sha256:595b6c3969023ecf9041b2936ac3827e4623bfa3ccf007575f04c5a6aa318c22 \
+    --hash=sha256:5a939de6b7b4e18ca683218320fc67ea886038265fd1ed30173f5ce3f8e85675 \
+    --hash=sha256:5d54b09eba2bada6011aea5375542a157637b91029687eb4fdb2dab11059c1b4 \
+    --hash=sha256:5df592cd503496351d6dc14f7cdad49f268d8e618f80dce0cd5a36b93c3fc08d \
+    --hash=sha256:5f4c04ead5aed67c8a1a20491d54cdfba5884507a48dd798ecaf13c74c4489f5 \
+    --hash=sha256:64dee438fed052b52e4f98f76c5790513235efaa1ef7f3f2192c392cd7c91b65 \
+    --hash=sha256:66dd88c918e3287efc22409d426c8f729688d89a0c587c88971a0faa2c2f3792 \
+    --hash=sha256:678999709e68425ae2593acf2e3ebcbcf2e69885a5ee78f9eb80e6e371f1bf57 \
+    --hash=sha256:67f2b6de947f8c757db2db9c71527933ad0019737ec374a8a6be9a956786aaf9 \
+    --hash=sha256:693f0192126df6c2327cce3baa7c06f2a117575e32ab2308f7f8216c29d9e2e3 \
+    --hash=sha256:746ee8dba912cd6fc889a8147168991d50ed70447bf18bcda7039f7d2e3d9151 \
+    --hash=sha256:756c56e867a90fb00177d530dca4b097dd753cde348448a1012ed6c5131f8b7d \
+    --hash=sha256:76d1f20b1c7a2fa82367e04982e708723ba0e7b8d43aa643d3dcd404d74f1475 \
+    --hash=sha256:7f493881579c90fc262d9cdbaa05a6b54b3811c2f300766748db79f098db9940 \
+    --hash=sha256:823c248b690b2fd9303ba00c4f66cd5e2d8c3ba4aa968b2779be9532a4dad431 \
+    --hash=sha256:82544de02076bafba038ce055ee6412d68da13ab47f0c60cab827346de828dee \
+    --hash=sha256:8dd8327c795b3e3f219760fa603dcae1dcc148172290a8ab15158cf85a953413 \
+    --hash=sha256:8fdc51055e6ff4adeb88d58a11042ec9a5eae317a0a53d12c062c8a8865909e8 \
+    --hash=sha256:a625e06551975f4b7ea7102bc43895b90742746797e2e14b70ed61c43a90f09b \
+    --hash=sha256:abdc0c6c8c648b4805c5eacd131910d2a7f6455dfd3becab248ef108e89ab16a \
+    --hash=sha256:ac017dd64572e5c3bd01939121e4d16cf30e5d7e110a119399cf3133b63ad054 \
+    --hash=sha256:ac1e5c9054fe23226fb11e05a6e630837f074174c4c2f0fe442996112a6de4fb \
+    --hash=sha256:ac60e3b188ec7574cb761b08d50fcedf9d77f1530352db4eef1707fe9dee7205 \
+    --hash=sha256:b359ed09954d7c18bbc1680f380c7301f92c60bf924171629c5db97febb12f04 \
+    --hash=sha256:b7643a03db5c95c799b89b31c036d5f27eeb4d259c798e878d6937d71832b1e4 \
+    --hash=sha256:ba9e56e8ceeeedb2e080147ba85ffcd5cd0711b89576b83784d8605a7df455fa \
+    --hash=sha256:c338ffa0520bdb12fbc527265235639fb76e7bc7faafbb93f6ba80d9c06578a9 \
+    --hash=sha256:cad21560da69f4ce7658ca2cb83138fb4cf695a2ba3e475e0559e05991aa8122 \
+    --hash=sha256:d08eb4c2b7d6c41da6ca0600c077e93f5adcfd979cd777d747e9ee624556da4b \
+    --hash=sha256:d50fd1ee42388dcfb2b3676132c78116490976f1300da28eb629272d5d93e905 \
+    --hash=sha256:d591f8de75824cbb7acad4e05d2d710484f15f29d4a915092675ad3456f11770 \
+    --hash=sha256:d5f6b181bb38171a8ad1d6aa58a67a6aa9d4b38d0f8c5f496b9e42561dfc62fe \
+    --hash=sha256:d63efaa0cd96cf0c5fe4d581521d9fa87744540d4bc999ae6e08595a1014b45b \
+    --hash=sha256:d99e5546bf73dbad5bf3547174cd6cb8ba7273062a23808ffea025ecb1cf8562 \
+    --hash=sha256:e09473f095a819042ecb2ab9465aee615bd9c2028e4ef7d933600a8401c79561 \
+    --hash=sha256:e8b56bdcdb4505c8078cb6c7157d9811a85790f2f2b3632c7d1462ab5783d215 \
+    --hash=sha256:ee443ef070bb3b6ed74514f5efaa37a252af57c90eb33b956d35c8e9c10a1931 \
+    --hash=sha256:f29d80eb9a9263b8d109135351caf568cc3f80b9928bccde535c235de55c22d9 \
+    --hash=sha256:f7a866fbc1e97b5c617ee4116daaa09b722101d4a3c170c787450ba409f9736f \
+    --hash=sha256:fcd5cf9e305d7b8338754470cf69cf81f420459dbae8a3b40cee57417f4614a7
     # via
     #   google-genai
     #   gql
diff --git a/requirements-strix-ci.txt b/requirements-strix-ci.txt
index 0f14cca9e..a1faaf6a4 100644
--- a/requirements-strix-ci.txt
+++ b/requirements-strix-ci.txt
@@ -1,5 +1,5 @@
 strix-agent==1.0.4
 google-cloud-aiplatform==1.160.0
-cryptography==49.0.0
-protobuf==7.35.1
+cryptography==50.0.0
+protobuf==6.33.6
 python-multipart==0.0.32

From dbfa8a94160d500830be39309bb31e853ea7b951 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 13:56:33 +0900
Subject: [PATCH 7/7] fix(security): synchronize patched frontend locks

---
 CHANGELOG.md                             |  4 +-
 backend/tests/test_release_governance.py | 54 ++++++++++++++++++
 frontend/package.json                    | 10 ++--
 frontend/pnpm-lock.yaml                  | 70 ++++++++++++------------
 frontend/pnpm-workspace.yaml             |  6 +-
 5 files changed, 99 insertions(+), 45 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e3fdf4af8..a06003d8f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,8 +4,8 @@
 - `cryptography`를 `50.0.0`으로 갱신해 공격자 제공 PKCS#7 EnvelopedData 복호화 결과의 오류·타이밍 차이로 발생하는 Bleichenbacher oracle(`CVE-2026-69247`, `GHSA-g6cj-pr64-35w5`)을 제거하고, backend·uv lock·hash lock·Strix CI 의존성 증거를 같은 버전으로 동기화했습니다. Strix 잠금은 `google-cloud-aiplatform==1.160.0`의 `<7` 제약을 위반하던 `protobuf==7.35.1`을 이미 검증된 `6.33.6`으로 복구해 다시 해석·설치 가능하게 했습니다.
 - CodeQL `extended` 기본 설정이 current `develop`에서 확인한 Critical 8건·High 21건·Medium 1건을 코드 경계에서 제거합니다. 서버 요청은 검증된 loopback/HTTPS origin, 동일 OIDC issuer origin, 허용 API 경로·쿼리만 재구성하고 redirect를 자동 추종하지 않으며, 공개 IPv6 authority를 보존합니다. UI smoke는 고정 Node/Next 실행 파일과 인자, localhost:3001 allowlist, private `mkdtemp` artifact 디렉터리 및 containment 검사만 사용합니다.
 - OIDC token endpoint는 운영 환경에서 서버 전용 `OIDC_ALLOWED_HOSTS` 정확 호스트 allowlist를 필수로 적용합니다. hostname의 모든 DNS 결과가 공인 주소인지 검증한 뒤 해당 주소 집합을 native HTTP(S) 연결의 `lookup`에 고정하고, 원래 issuer hostname은 Host/TLS SNI로 유지해 사설 주소 해석과 DNS rebinding 사이의 TOCTOU를 차단합니다. 실패 로그는 입력 URL·token 대신 고정된 configuration/DNS·transport/response/backend-verification reason code만 남깁니다.
-- Trivy 2026-07-26 DB에서 새로 확인된 Next.js High 4건·Medium 5건(`CVE-2026-64641`–`CVE-2026-64649`)과 PostCSS High 1건(`GHSA-r28c-9q8g-f849`)을 제거하기 위해 Next.js/`eslint-config-next`를 `16.2.11`, PostCSS를 `8.5.18`로 갱신했습니다. 두 버전은 각 취약점의 최초 수정 버전이며 저장소의 release-age 정책을 우회하지 않습니다.
-- `pnpm audit`가 개발 도구 체인에서 추가 탐지한 `brace-expansion <=5.0.7` High DoS(`GHSA-mh99-v99m-4gvg`)는 `5.0.8` 전역 override로 제거했습니다. CommonJS default export를 기대하는 legacy `minimatch 3.1.5`에는 `expand` named export도 수용하는 최소 pnpm 패치를 적용해 ESLint/glob 동작을 보존합니다.
+- Trivy 2026-07-26 DB에서 새로 확인된 Next.js High 4건·Medium 5건(`CVE-2026-64641`–`CVE-2026-64649`)과 PostCSS High 1건(`GHSA-r28c-9q8g-f849`)을 제거하기 위해 Next.js/`eslint-config-next`를 `16.2.11`, PostCSS를 `8.5.18`로 갱신했습니다. 이후 2026-08-04 DB가 `8.5.18`에서 추가 탐지한 PostCSS Medium(`CVE-2026-69153`, 최초 수정 `8.5.23`)도 제거하도록 manifest·workspace override·lock을 `8.5.24`로 동기화했으며 저장소의 release-age 정책을 우회하지 않습니다.
+- `pnpm audit`가 개발 도구 체인에서 추가 탐지한 `brace-expansion <=5.0.7` High DoS(`GHSA-mh99-v99m-4gvg`)와 이후 `5.0.8`까지 영향을 주는 우회형 High DoS(`GHSA-rgw5-rvv9-x895`)는 `5.0.9` 전역 override로 제거했습니다. CommonJS default export를 기대하는 legacy `minimatch 3.1.5`에는 `expand` named export도 수용하는 최소 pnpm 패치를 적용해 ESLint/glob 동작을 보존합니다. 같은 감사에서 확인된 `undici 7.28.0`의 High 1건·Moderate 4건(`GHSA-4cwx-7wf7-3272` 등)은 `jsdom 30.0.1` 및 release-age 정책을 통과하는 `undici 8.9.0`으로 갱신했습니다.
 - root·frontend Docker build의 frozen install 계층이 pnpm manifest와 함께 `frontend/patches`를 먼저 복사하도록 수정해, 이미지 검증에서도 lockfile의 patched dependency를 동일하게 재현합니다.
 - Scorecard SARIF normalizer는 고정 workspace artifact로 정규화되는 `./scorecard-results.sarif`와 절대 경로를 동일하게 허용하면서 symlink·workspace 이탈은 계속 거부합니다. 도구 실행 실패 API는 CR/LF·제어 문자를 escape하고 500자로 제한하며, 로그에는 raw 도구 코드·예외 text 대신 SHA-256 기반 코드·traceback 상관 식별자만 기록합니다.
 - 백엔드 origin 보안 경계를 `frontend/src/lib/backend-url.ts`의 단일 생성기로 통합해 API proxy·session·OIDC callback이 같은 검증을 사용합니다. UI smoke의 새 `NARUON_FULL_PRODUCT_SCREENSHOT_PROFILE` 이름은 실제 selector 의미를 드러내며, 기존 `..._SCREENSHOT_DIR`은 호환 alias로 계속 지원합니다.
diff --git a/backend/tests/test_release_governance.py b/backend/tests/test_release_governance.py
index aa43b338b..56ef2bff4 100644
--- a/backend/tests/test_release_governance.py
+++ b/backend/tests/test_release_governance.py
@@ -216,6 +216,60 @@ def pins(text: str, package: str) -> list[str]:
     assert pins(strix_hashes, "protobuf") == ["protobuf==6.33.6"]
 
 
+def test_frontend_postcss_lock_is_cve_2026_69153_fixed() -> None:
+    """Keep every manifest and lock surface on the first currently governed fix."""
+    frontend_package = json.loads(read_repo_text("frontend/package.json"))
+    frontend_workspace = yaml.safe_load(read_repo_text("frontend/pnpm-workspace.yaml"))
+    frontend_lock = yaml.safe_load(read_repo_text("frontend/pnpm-lock.yaml"))
+
+    assert frontend_package["devDependencies"]["postcss"] == "8.5.24"
+    assert frontend_package["overrides"]["postcss"] == "8.5.24"
+    assert frontend_package["resolutions"]["postcss"] == "8.5.24"
+    assert frontend_workspace["overrides"]["postcss"] == "8.5.24"
+    assert frontend_lock["overrides"]["postcss"] == "8.5.24"
+    assert frontend_lock["importers"]["."]["devDependencies"]["postcss"] == {
+        "specifier": "8.5.24",
+        "version": "8.5.24",
+    }
+
+    for section in ("packages", "snapshots"):
+        postcss_keys = [
+            package
+            for package in frontend_lock[section]
+            if package.startswith("postcss@")
+        ]
+        assert postcss_keys == ["postcss@8.5.24"]
+
+
+def test_frontend_tooling_lock_uses_current_audit_fixed_transitive_versions() -> None:
+    """Keep newly disclosed audit fixes aligned across manifest and pnpm lock."""
+    frontend_package = json.loads(read_repo_text("frontend/package.json"))
+    frontend_workspace = yaml.safe_load(read_repo_text("frontend/pnpm-workspace.yaml"))
+    frontend_lock = yaml.safe_load(read_repo_text("frontend/pnpm-lock.yaml"))
+
+    assert frontend_package["devDependencies"]["jsdom"] == "^30.0.1"
+    for dependency, expected_version in (
+        ("brace-expansion", "5.0.9"),
+        ("undici", "8.9.0"),
+    ):
+        assert frontend_package["overrides"][dependency] == expected_version
+        assert frontend_package["resolutions"][dependency] == expected_version
+        assert frontend_workspace["overrides"][dependency] == expected_version
+        assert frontend_lock["overrides"][dependency] == expected_version
+
+        for section in ("packages", "snapshots"):
+            locked_keys = [
+                package
+                for package in frontend_lock[section]
+                if package.startswith(f"{dependency}@")
+            ]
+            assert locked_keys == [f"{dependency}@{expected_version}"]
+
+    assert [
+        package for package in frontend_lock["packages"] if package.startswith("jsdom@")
+    ] == ["jsdom@30.0.1"]
+
+
 def test_changelog_follows_keep_a_changelog_for_initial_korean_release() -> None:
     changelog = read_repo_text("CHANGELOG.md")
 
diff --git a/frontend/package.json b/frontend/package.json
index 8563a9c87..191b7c90b 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -41,20 +41,20 @@
     "eslint": "^9",
     "eslint-config-next": "16.2.12",
     "fast-check": "^4.9.0",
-    "jsdom": "^30.0.0",
+    "jsdom": "^30.0.1",
     "postcss": "8.5.24",
     "typescript": "^6",
     "vitest": "^4.1.10"
   },
   "overrides": {
-    "brace-expansion": "5.0.8",
+    "brace-expansion": "5.0.9",
     "postcss": "8.5.24",
-    "undici": "7.28.0",
+    "undici": "8.9.0",
     "uuid": "^14.0.0"
   },
   "resolutions": {
-    "brace-expansion": "5.0.8",
+    "brace-expansion": "5.0.9",
     "postcss": "8.5.24",
-    "undici": "7.28.0"
+    "undici": "8.9.0"
   }
 }
diff --git a/frontend/pnpm-lock.yaml b/frontend/pnpm-lock.yaml
index effc1257f..d7025ff3a 100644
--- a/frontend/pnpm-lock.yaml
+++ b/frontend/pnpm-lock.yaml
@@ -5,10 +5,10 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
-  brace-expansion: 5.0.8
-  postcss: 8.5.18
+  brace-expansion: 5.0.9
+  postcss: 8.5.24
   sharp: 0.35.0
-  undici: 7.28.0
+  undici: 8.9.0
 
 pnpmfileChecksum: sha256-RXPq3MmEdRb3xD3rhbER9kciz9nBr/i0J/uMUjql5t0=
 
@@ -90,17 +90,17 @@ importers:
         specifier: ^4.9.0
         version: 4.9.0
       jsdom:
-        specifier: ^30.0.0
-        version: 30.0.0
+        specifier: ^30.0.1
+        version: 30.0.1
       postcss:
-        specifier: 8.5.18
-        version: 8.5.18
+        specifier: 8.5.24
+        version: 8.5.24
       typescript:
         specifier: ^6
         version: 6.0.3
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@types/node@26.1.2)(@vitest/coverage-v8@4.1.10)(jsdom@30.0.0)(vite@8.1.4(@types/node@26.1.2)(jiti@2.7.0))
+        version: 4.1.10(@types/node@26.1.2)(@vitest/coverage-v8@4.1.10)(jsdom@30.0.1)(vite@8.1.4(@types/node@26.1.2)(jiti@2.7.0))
 
 packages:
 
@@ -1331,8 +1331,8 @@ packages:
   bidi-js@1.0.3:
     resolution: {integrity: sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==}
 
-  brace-expansion@5.0.8:
-    resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==}
+  brace-expansion@5.0.9:
+    resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==}
     engines: {node: 20 || >=22}
 
   braces@3.0.3:
@@ -1984,8 +1984,8 @@ packages:
     resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
     hasBin: true
 
-  jsdom@30.0.0:
-    resolution: {integrity: sha512-JQHfRGmmKmaZoUAvIgff5jjG/0SzTQlGz8c7t72KzBzo8ZULEjAjnYE0sNwBOUA4QtWwYE2xoYitg8NFsmiYxA==}
+  jsdom@30.0.1:
+    resolution: {integrity: sha512-52v7mUVUfNQVYYqE1lcdaymWL0njO7lTLUog6ZvW2U5KsbiLk/GnZlVJ+qx0xfNJZ6Gn+KSpPNE52vurbxZwrA==}
     engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0}
     peerDependencies:
       canvas: ^3.2.3
@@ -2386,8 +2386,8 @@ packages:
     resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
     engines: {node: '>= 0.4'}
 
-  postcss@8.5.18:
-    resolution: {integrity: sha512-xdB1oSLHbz1vRWgCDalrCqEFTWzFlhqFC5tIHLMOSUIjhm3XXQ1qrFy8S/ESr1JYRRXqM3c1QFiMZUJdUTqyMQ==}
+  postcss@8.5.24:
+    resolution: {integrity: sha512-8RyVklq0owXUTa4xlpzu4l9AaVKIdQvAcOHZWaMh98HgySsUtxRVf/chRe3dsSLqb6i40BzGRzEUddRaI+9TSw==}
     engines: {node: ^10 || ^12 || >=14}
 
   prelude-ls@1.2.1:
@@ -2705,9 +2705,9 @@ packages:
   undici-types@8.3.0:
     resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==}
 
-  undici@7.28.0:
-    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
-    engines: {node: '>=20.18.1'}
+  undici@8.9.0:
+    resolution: {integrity: sha512-aWZpUj7XoGonMClx4gdDRfgBjqeA+F473aDmROQQbM9n6PRfK/u1q/a0X4wMTgcHfT8H6fpbt98PFuDUwFg2YA==}
+    engines: {node: '>=22.19.0'}
 
   unrs-resolver@1.12.2:
     resolution: {integrity: sha512-dmlRxBJJayXjqTwC+JtF1HhJmgf3ftQ3YejFcZrf4+KKtJv0qDsK1pjqaaVjG7wJ5NJ6UVP1OqRMQ71Z4C3rxQ==}
@@ -3654,7 +3654,7 @@ snapshots:
       '@alloc/quick-lru': 5.2.0
       '@tailwindcss/node': 4.3.3
       '@tailwindcss/oxide': 4.3.3
-      postcss: 8.5.18
+      postcss: 8.5.24
       tailwindcss: 4.3.3
 
   '@tybys/wasm-util@0.10.3':
@@ -3862,7 +3862,7 @@ snapshots:
       obug: 2.1.3
       std-env: 4.2.0
       tinyrainbow: 3.1.0
-      vitest: 4.1.10(@types/node@26.1.2)(@vitest/coverage-v8@4.1.10)(jsdom@30.0.0)(vite@8.1.4(@types/node@26.1.2)(jiti@2.7.0))
+      vitest: 4.1.10(@types/node@26.1.2)(@vitest/coverage-v8@4.1.10)(jsdom@30.0.1)(vite@8.1.4(@types/node@26.1.2)(jiti@2.7.0))
 
   '@vitest/expect@4.1.10':
     dependencies:
@@ -4021,7 +4021,7 @@ snapshots:
     dependencies:
       require-from-string: 2.0.2
 
-  brace-expansion@5.0.8:
+  brace-expansion@5.0.9:
     dependencies:
       balanced-match: 4.0.4
 
@@ -4292,7 +4292,7 @@ snapshots:
       '@next/eslint-plugin-next': 16.2.12
       eslint: 9.39.5(jiti@2.7.0)
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@9.39.5(jiti@2.7.0))
+      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.65.0(eslint@9.39.5(jiti@2.7.0))(typescript@6.0.3))(eslint@9.39.5(jiti@2.7.0)))(eslint@9.39.5(jiti@2.7.0))
       eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.65.0(eslint@9.39.5(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.5(jiti@2.7.0))
       eslint-plugin-jsx-a11y: 6.10.2(eslint@9.39.5(jiti@2.7.0))
       eslint-plugin-react: 7.37.5(eslint@9.39.5(jiti@2.7.0))
@@ -4315,7 +4315,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0)(eslint@9.39.5(jiti@2.7.0)):
+  eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.65.0(eslint@9.39.5(jiti@2.7.0))(typescript@6.0.3))(eslint@9.39.5(jiti@2.7.0)))(eslint@9.39.5(jiti@2.7.0)):
     dependencies:
       '@nolyfill/is-core-module': 1.0.39
       debug: 4.4.3
@@ -4330,14 +4330,14 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.14.0(@typescript-eslint/parser@8.65.0(eslint@9.39.5(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.5(jiti@2.7.0)):
+  eslint-module-utils@2.14.0(@typescript-eslint/parser@8.65.0(eslint@9.39.5(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.65.0(eslint@9.39.5(jiti@2.7.0))(typescript@6.0.3))(eslint@9.39.5(jiti@2.7.0)))(eslint@9.39.5(jiti@2.7.0)))(eslint@9.39.5(jiti@2.7.0)):
     dependencies:
       debug: 3.2.7
     optionalDependencies:
       '@typescript-eslint/parser': 8.65.0(eslint@9.39.5(jiti@2.7.0))(typescript@6.0.3)
       eslint: 9.39.5(jiti@2.7.0)
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@9.39.5(jiti@2.7.0))
+      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.65.0(eslint@9.39.5(jiti@2.7.0))(typescript@6.0.3))(eslint@9.39.5(jiti@2.7.0)))(eslint@9.39.5(jiti@2.7.0))
     transitivePeerDependencies:
       - supports-color
 
@@ -4352,7 +4352,7 @@ snapshots:
       doctrine: 2.1.0
       eslint: 9.39.5(jiti@2.7.0)
       eslint-import-resolver-node: 0.3.10
-      eslint-module-utils: 2.14.0(@typescript-eslint/parser@8.65.0(eslint@9.39.5(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.5(jiti@2.7.0))
+      eslint-module-utils: 2.14.0(@typescript-eslint/parser@8.65.0(eslint@9.39.5(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.65.0(eslint@9.39.5(jiti@2.7.0))(typescript@6.0.3))(eslint@9.39.5(jiti@2.7.0)))(eslint@9.39.5(jiti@2.7.0)))(eslint@9.39.5(jiti@2.7.0))
       hasown: 2.0.4
       is-core-module: 2.16.2
       is-glob: 4.0.3
@@ -4830,7 +4830,7 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
-  jsdom@30.0.0:
+  jsdom@30.0.1:
     dependencies:
       '@asamuzakjp/css-color': 6.0.5
       '@asamuzakjp/dom-selector': 8.3.0
@@ -4847,7 +4847,7 @@ snapshots:
       saxes: 6.0.0
       symbol-tree: 3.2.4
       tough-cookie: 6.0.2
-      undici: 7.28.0
+      undici: 8.9.0
       w3c-xmlserializer: 5.0.0
       webidl-conversions: 8.0.1
       whatwg-mimetype: 5.0.0
@@ -5039,11 +5039,11 @@ snapshots:
 
   minimatch@10.2.6:
     dependencies:
-      brace-expansion: 5.0.8
+      brace-expansion: 5.0.9
 
   minimatch@3.1.5(patch_hash=5f38b9c5382c1163b0389810f5e4e867519096f3c11a6df0a51d7cafbdfa93e2):
     dependencies:
-      brace-expansion: 5.0.8
+      brace-expansion: 5.0.9
 
   minimist@1.2.8: {}
 
@@ -5061,7 +5061,7 @@ snapshots:
       '@swc/helpers': 0.5.15
       baseline-browser-mapping: 2.11.5
       caniuse-lite: 1.0.30001806
-      postcss: 8.5.18
+      postcss: 8.5.24
       react: 19.2.8
       react-dom: 19.2.8(react@19.2.8)
       styled-jsx: 5.1.6(@babel/core@7.29.7)(react@19.2.8)
@@ -5189,7 +5189,7 @@ snapshots:
 
   possible-typed-array-names@1.1.0: {}
 
-  postcss@8.5.18:
+  postcss@8.5.24:
     dependencies:
       nanoid: 3.3.16
       picocolors: 1.1.1
@@ -5599,7 +5599,7 @@ snapshots:
 
   undici-types@8.3.0: {}
 
-  undici@7.28.0: {}
+  undici@8.9.0: {}
 
   unrs-resolver@1.12.2:
     dependencies:
@@ -5667,7 +5667,7 @@ snapshots:
     dependencies:
       lightningcss: 1.33.0
       picomatch: 4.0.5
-      postcss: 8.5.18
+      postcss: 8.5.24
       rolldown: 1.1.5
       tinyglobby: 0.2.17
     optionalDependencies:
@@ -5675,7 +5675,7 @@ snapshots:
       fsevents: 2.3.3
       jiti: 2.7.0
 
-  vitest@4.1.10(@types/node@26.1.2)(@vitest/coverage-v8@4.1.10)(jsdom@30.0.0)(vite@8.1.4(@types/node@26.1.2)(jiti@2.7.0)):
+  vitest@4.1.10(@types/node@26.1.2)(@vitest/coverage-v8@4.1.10)(jsdom@30.0.1)(vite@8.1.4(@types/node@26.1.2)(jiti@2.7.0)):
     dependencies:
       '@vitest/expect': 4.1.10
       '@vitest/mocker': 4.1.10(vite@8.1.4(@types/node@26.1.2)(jiti@2.7.0))
@@ -5700,7 +5700,7 @@ snapshots:
     optionalDependencies:
       '@types/node': 26.1.2
       '@vitest/coverage-v8': 4.1.10(vitest@4.1.10)
-      jsdom: 30.0.0
+      jsdom: 30.0.1
     transitivePeerDependencies:
       - msw
 
diff --git a/frontend/pnpm-workspace.yaml b/frontend/pnpm-workspace.yaml
index 369e792d6..d028031d2 100644
--- a/frontend/pnpm-workspace.yaml
+++ b/frontend/pnpm-workspace.yaml
@@ -14,10 +14,10 @@ supportedArchitectures:
     - glibc
 
 overrides:
-  brace-expansion: "5.0.8"
-  postcss: "8.5.18"
+  brace-expansion: "5.0.9"
+  postcss: "8.5.24"
   sharp: "0.35.0"
-  undici: 7.28.0
+  undici: 8.9.0
 
 patchedDependencies:
   minimatch@3.1.5: patches/minimatch@3.1.5.patch