Bump cryptography from 46.0.7 to 50.0.0 - #3253
Conversation
Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.7 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@46.0.7...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
There was a problem hiding this comment.
LGTM — routine Dependabot lockfile bump of cryptography 46.0.7 → 50.0.0.
What was reviewed:
- Lockfile-only change:
uv.lockhashes/wheels for cryptography, plus a benign re-resolve of theexceptiongroup→typing-extensionsmarker;pyproject.tomlconstraints are untouched, so published-package requirements are unchanged. - Checked SDK usage:
cryptographycomes in viapyjwt[crypto]and is imported directly only insrc/mcp/server/request_state.py(AESGCM, HKDF, SHA256, InvalidTag) — none of these APIs are affected by the 50.0.0 breaking changes (FFDH deprecation, PKCS#7 error handling, stricter X.509/DER parsing). - The release also ships the CVE-2026-69247 fix (PKCS#7 Bleichenbacher oracle); the SDK doesn't call the affected
pkcs7_decrypt_*APIs.
Extended reasoning...
Overview
This PR is a Dependabot-generated bump of the cryptography package from 46.0.7 to 50.0.0 in uv.lock only — the single changed file. The diff replaces the sdist/wheel URLs and hashes for cryptography and, as a side effect of re-resolution, drops the python_full_version < '3.13' marker on exceptiongroup's typing-extensions dependency (benign: typing-extensions is already locked for the project on all versions). No source code, no pyproject.toml constraints, and no CI configuration change.
Security risks
The bump is security-positive: 50.0.0 fixes CVE-2026-69247 (a Bleichenbacher oracle in pkcs7_decrypt_der and variants). The SDK does not use the affected PKCS#7 decryption APIs, nor FFDH (deprecated in this release). Direct usage is limited to src/mcp/server/request_state.py, which imports AESGCM, HKDF, SHA256, and InvalidTag — all stable primitives unaffected by the 50.0.0 changelog. Because only the lockfile changes, downstream users of the published mcp wheel are unaffected; this pins what CI and developers install. Per the repo's guidelines, the pyjwt[crypto]>=2.10.1 floor is correctly left untouched.
Level of scrutiny
Low. Lockfile-only dependency bumps are mechanical: the hashes come from PyPI via Dependabot, and correctness is validated by CI running the full test matrix (3.10–3.14 × platforms) against the new lock. With filterwarnings = ["error"] in pytest config, any new deprecation warning from cryptography 50 (e.g. FFDH) surfacing in the SDK's code paths would fail CI rather than slip through silently.
Other factors
The bug hunting system found no issues, and the PR timeline has no outstanding reviewer comments. There is no design decision or API surface change here. The main theoretical risk — a behavioral break in a four-major-version jump — is confined to dev/CI environments and gated by the existing 100%-coverage test suite.
Bumps cryptography from 46.0.7 to 50.0.0.
Changelog
Sourced from cryptography's changelog.
... (truncated)
Commits
dcb7050Prepare for 50.0.0 release (#15372)53fccd9Don't leak how PKCS#7 encryptedKey decryption failed (#15369)d472f97Addfrom __future__ import annotationsto all src/ Python files (#15371)908773dBump downstream dependencies in CI (#15368)2cc07ccBump BoringSSL, OpenSSL, AWS-LC in CI (#15367)c94ede9chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)67a8308chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)95018ffRelease the GIL in one-shot AEAD encrypt/decrypt (#15361)6954733Release the GIL during DH and DSA parameter generation (#15364)6893b94Import _serialization instead of serialization in x509/extensions (#15363)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.