From 347ad492152a835014be6a37c323e1b7ceb341a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=98yvind=20D=C3=B8skeland?= <odosk@vespa.ai>
Date: Thu, 6 Aug 2026 10:11:59 +0200
Subject: [PATCH] chore: bump cryptography 50.0.0 + aiohttp 3.14.3 in
 visual-retrieval-colpali

Clears 3 Mend HIGH CVEs in src/legacy-requirements.txt:
  CVE-2026-69247, CVE-2026-69249 (cryptography 48.0.1)
  CVE-2026-69244            (aiohttp 3.14.1)

Both are pinned only by lower-bound constraints upstream
(pyvespa: cryptography>=48.0.1; fsspec/datasets: aiohttp!=4.0.0a*),
so the bumps stay within every declared range.
---
 visual-retrieval-colpali/src/legacy-requirements.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/visual-retrieval-colpali/src/legacy-requirements.txt b/visual-retrieval-colpali/src/legacy-requirements.txt
index a5f0d87ea..a8fd60f72 100644
--- a/visual-retrieval-colpali/src/legacy-requirements.txt
+++ b/visual-retrieval-colpali/src/legacy-requirements.txt
@@ -4,7 +4,7 @@ accelerate==1.13.0
     # via peft
 aiohappyeyeballs==2.6.2
     # via aiohttp
-aiohttp==3.14.1
+aiohttp==3.14.3
     # via
     #   datasets
     #   fsspec
@@ -62,7 +62,7 @@ confection==1.3.3
     #   weasel
 contourpy==1.3.3
     # via matplotlib
-cryptography==48.0.1
+cryptography==50.0.0
     # via pyvespa
 cycler==0.12.1
     # via matplotlib