Bump cryptography from 45.0.7 to 46.0.7

[dependabot]

Bumps cryptography from 45.0.7 to 46.0.7.

Changelog

Sourced from cryptography's changelog.

46.0.7 - 2026-04-07

* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
  passed to APIs that accept Python buffers, which could lead to buffer
  overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
.. _v46-0-6:
46.0.6 - 2026-03-25

• SECURITY ISSUE: Fixed a bug where name constraints were not applied to peer names during verification when the leaf certificate contains a wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug, including those used by the Web PKI. Credit to Oleh Konko (1seal) for reporting the issue. CVE-2026-34073

.. _v46-0-5:

46.0.5 - 2026-02-10

* An attacker could create a malicious public key that reveals portions of your
  private key when using certain uncommon elliptic curves (binary curves).
  This version now includes additional security checks to prevent this attack.
  This issue only affects binary elliptic curves, which are rarely used in
  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and
  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.
  **CVE-2026-26007**
* Support for ``SECT*`` binary elliptic curves is deprecated and will be
  removed in the next release.
.. v46-0-4:
46.0.4 - 2026-01-27

• Dropped support for win_arm64 wheels_.
• Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.

.. _v46-0-3:

46.0.3 - 2025-10-15

* Fixed compilation when using LibreSSL 4.2.0.
.. _v46-0-2:

</tr></table>

... (truncated)

Commits

• 622d672 46.0.7 release (#14602)
• 91d7288 Cherry-pick #14542 (#14543)
• 06e120e bump version for 46.0.5 release (#14289)
• 0eebb9d EC check key on cofactor > 1 (#14287)
• bedf6e1 fix openssl version on 46 branch (#14220)
• e6f44fc bump for 46.0.4 and drop win arm64 due to CI issues (#14217)
• c0af4dd release 46.0.3 (#13681)
• 99efe5a bump version for 46.0.2 (#13531)
• e735cfc release 46.0.1 (#13450)
• 4e457ff Explicitly specify python in mac uv build invocation (#13447)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[rtibbles]

@dependabot rebase

[rtibblesbot]

Dependency conflict introduced by this bump causes the build to fail.

CI: Previous run failed (dependency conflict, see inline); new run triggered by the rebase is still in progress but the underlying code is unchanged — same outcome expected.

• blocking: cryptography 46.0.7 requires cffi>=2.0.0 (Python 3.9+, non-PyPy) but setup.py pins cffi==1.14.4 — see inline
• praise: Three high-severity CVEs patched (CVE-2026-39892, CVE-2026-34073, CVE-2026-26007); the security urgency is clear and worth resolving promptly

Dependency Update Review

Package: cryptography 45.0.7 → 46.0.7
Semver risk: Major
Dependency type: production (install_requires)
CI status: Failing — ResolutionImpossible (cffi version conflict)

Changelog Analysis

Sources consulted: PR body (truncated) — full changelog at https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst

Security fixes (all in this range):

• CVE-2026-39892: Buffer overflow via non-contiguous buffers passed to Python buffer APIs (46.0.7)
• CVE-2026-34073: Name constraints not applied to peer names when leaf cert has wildcard DNS SAN (46.0.6)
• CVE-2026-26007: Attacker-crafted public key could reveal portions of private key on binary elliptic curves (46.0.5)

Breaking changes:

• cffi>=2.0.0 is now required for Python 3.9+ (non-PyPy) — confirmed by pip resolution error in CI logs
• win_arm64 wheels dropped (46.0.4)

Deprecations:

• SECT* binary elliptic curves deprecated; removal expected in next major release (46.0.5)

Compatibility Assessment

• Project pins cffi==1.14.4 — conflicts with new cffi>=2.0.0 requirement
• Code changes required: yes — cffi pin in setup.py must be updated alongside this bump
• No other breaking API changes observed that affect this project

Recommendation

REQUEST_CHANGES — update cffi pin to a version compatible with cryptography 46.x (≥ 2.0.0) before merging. The security fixes make this worth resolving quickly.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Reviewed the pull request diff checking for:

• Correctness: bugs, edge cases, undocumented behavior, resource leaks, hardcoded values
• Design: unnecessary complexity, naming, readability, comment accuracy, redundant state
• Architecture: duplicated concerns, minimal interfaces, composition over inheritance
• Testing: behavior-based assertions, mocks only at hard boundaries, accurate coverage
• Completeness: missing dependencies, unupdated usages, i18n, accessibility, security
• Principles: DRY (same reason to change), SRP, Rule of Three (no premature abstraction)
• Checked CI status and linked issue acceptance criteria
• For UI changes: inspected screenshots for layout, visual completeness, and consistency

[rtibblesbot]

blocking: cryptography 46.0.7 now requires cffi>=2.0.0 for Python 3.9+ (non-PyPy), but this project pins cffi==1.14.4 three lines below. CI confirms this:

The conflict is caused by:
    kolibri-app 0.4.5 depends on cffi==1.14.4
    cryptography 46.0.7 depends on cffi>=2.0.0; python_full_version >= "3.9" and platform_python_implementation != "PyPy"

This PR needs to also update the cffi pin to a compatible version (≥ 2.0.0). Check whether cffi 2.x introduces any breaking changes for the project before pinning a specific version.