security: require cryptography 50.0.0

[abrichr]

Summary

• require cryptography 50.0.0 or newer in the published Agent runtime contract
• refresh uv.lock from affected 49.0.0 to fixed 50.0.0
• close GHSA-g6cj-pr64-35w5 / CVE-2026-69247 for both CI and future Agent installations

Reachability

Agent and Flow do not call the affected pkcs7_decrypt_der, pkcs7_decrypt_pem, or pkcs7_decrypt_smime APIs. Cryptography is still a reachable runtime dependency through Flow encrypted bundles, AES-GCM evidence, Ed25519 qualification, and Windows TLS. A direct floor ensures that upgrading Agent repairs an existing environment whose transitive dependency would otherwise remain on 49.0.0.

Compatibility and boundary

Cryptography 50.0.0 supports the Agent Python 3.10-3.12 range. PyPI marks it as not yanked and licensed under Apache-2.0 OR BSD-3-Clause. The dependency remains external. No third-party source is vendored into the MIT package.

Verification

• uv lock --locked
• installed lock reports cryptography 50.0.0
• ruff check src tests scripts
• pytest -q: 97 passed
• uv pip check
• built wheel and source archive
• release artifact validator passed
• distribution validator passed for both archives
• source-policy validator passed against the source tree and both archives
• built wheel metadata contains Requires-Dist: cryptography>=50.0.0

Release impact

The lock update repairs development and CI immediately after merge. A new Agent release is required to make the dependency floor part of published package metadata for upgrades of existing environments.