Bump cryptogrpahy

[ayushdg]

Description

Bumps cryptography constraint dependency. Also adds a min version to uv to prevent users with older version committing the lock file that ends up changing revisions to older versions.

Usage

# Add snippet demonstrating usage

Checklist

• I am familiar with the Contributing Guide.
• New or Existing tests cover these changes.
• The documentation is up to date with these changes.

[greptile-apps]

Greptile Summary

This PR bumps the cryptography constraint dependency from >=46.0.5 to >=46.0.6 to address CVE GHSA-m959-cc7f-wv43, and adds a required-version = ">=0.7.0" floor for uv to prevent contributors with older tooling from inadvertently downgrading the lock file format.

• pyproject.toml: cryptography constraint raised to >=46.0.6; CVE comment updated to reference the new advisory; required-version = \">=0.7.0\" added to [tool.uv].
• uv.lock: Cryptography resolved version updated to 46.0.6; lock file revision advanced from 1 → 3, with upload-time metadata fields added to every package entry (a non-functional format change from the newer uv release).
• The large lock file diff (~2.1 MB) is expected and solely attributable to the new upload-time field emitted by the upgraded uv version — no package dependency graph changes were made beyond the cryptography bump itself.

Confidence Score: 5/5

Safe to merge — minimal, targeted security bump with no behavioral changes.

Only two files are changed: a one-line version bump and CVE comment update in pyproject.toml, and the corresponding lock file regeneration. The lock file bulk diff is a benign format-field addition from the newer uv version. The sole open finding is a P2 style suggestion to preserve the original CVE reference in the comment, which does not affect correctness or security.

No files require special attention.

Important Files Changed

Filename	Overview
pyproject.toml	Adds required-version = ">=0.7.0" to [tool.uv] and bumps the cryptography constraint from >=46.0.5 to >=46.0.6 to address CVE GHSA-m959-cc7f-wv43; all other entries are unchanged.
uv.lock	Lock file revision bumped from 1 to 3; cryptography pinned at 46.0.6; the bulk of the diff (2.1 MB) is the addition of upload-time metadata fields to every package entry, which is a non-functional format change introduced by the newer uv version.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["CVE GHSA-m959-cc7f-wv43\nidentified in cryptography"] --> B["Raise constraint\ncryptography >=46.0.5 → >=46.0.6"]
    B --> C["Add uv required-version >=0.7.0\nto prevent lock file regression"]
    C --> D["Regenerate uv.lock\nwith uv >=0.7.0"]
    D --> E["Lock revision 1 → 3\nupload-time fields added to all packages"]
    E --> F["cryptography resolved\n46.0.5 → 46.0.6"]

Loading

_{Reviews (1): Last reviewed commit: "Merge branch 'main' into cve-cryptogrpah..." | Re-trigger Greptile}

[greptile-apps]

Consider preserving both CVE references in the comment

The comment was updated from # Address CVE GHSA-r6ph-v2qm-q3c2 to # Address CVE GHSA-m959-cc7f-wv43, which drops the original CVE that motivated the >=46.0.5 floor. Since >=46.0.6 still satisfies the original constraint, both CVEs remain addressed, and preserving both makes the audit trail clearer for anyone revisiting this line later.

Suggested change

	"cryptography>=46.0.6", # Address CVE GHSA-m959-cc7f-wv43
	"cryptography>=46.0.6", # Address CVE GHSA-r6ph-v2qm-q3c2, GHSA-m959-cc7f-wv43

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}