chore(deps): bump cryptography from 46.0.6 to 46.0.7

[dependabot]

Bumps cryptography from 46.0.6 to 46.0.7.

Changelog

Sourced from cryptography's changelog.

46.0.7 - 2026-04-07

* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
  passed to APIs that accept Python buffers, which could lead to buffer
  overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
.. _v46-0-6:

Commits

• 622d672 46.0.7 release (#14602)
• See full diff in compare view

[rtibblesbot]

Dependency Update Review

Package: cryptography 46.0.6 → 46.0.7
Semver risk: Patch
Dependency type: Production (transitive via google-auth)
CI status: Passing

Changelog Analysis

Sources consulted:

• PR body (changelog excerpt from CHANGELOG.rst)

Security fixes:

• CVE-2026-39892: Fixed buffer overflow — non-contiguous buffers could be passed to Python buffer APIs, potentially leading to a buffer overflow. Patch release specifically for this fix.

Other notable changes:

• Updated Windows, macOS, and Linux wheels compiled with OpenSSL 3.5.6.

Breaking changes: None.

Compatibility Assessment

• No API changes; patch-level security fix only
• No peer dependency changes
• No code migration required
• No prior failed attempts noted

Recommendation

APPROVE — Security patch with no breaking changes; CI passing.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Reviewed the pull request diff checking for:

• Correctness: bugs, edge cases, undocumented behavior, resource leaks, hardcoded values
• Design: unnecessary complexity, naming, readability, comment accuracy, redundant state
• Architecture: duplicated concerns, minimal interfaces, composition over inheritance
• Testing: behavior-based assertions, mocks only at hard boundaries, accurate coverage
• Completeness: missing dependencies, unupdated usages, i18n, accessibility, security
• Principles: DRY (same reason to change), SRP, Rule of Three (no premature abstraction)
• Checked CI status and linked issue acceptance criteria
• For UI changes: inspected screenshots for layout, visual completeness, and consistency

[rtibblesbot]

Prior findings

No inline findings in the prior review (clean APPROVE on 2026-04-10) — nothing to classify.

Dependency Update Review

Package: cryptography 46.0.6 → 46.0.7
Semver risk: Patch
Dependency type: Production (transitive via google-auth)
CI status: Partially passing at time of review — linting and build pass; Python unit tests in progress.

Changelog Analysis

Sources consulted:

• PR body (changelog excerpt from CHANGELOG.rst)

Security fixes:

• CVE-2026-39892: Fixed buffer overflow — non-contiguous buffers could be passed to Python buffer APIs, potentially leading to a buffer overflow.

Other notable changes:

• Updated Windows, macOS, and Linux wheels compiled with OpenSSL 3.5.6.

Breaking changes: None.

New changes since prior review

The rebased commit (2026-04-13) includes an additional lockfile change not present when the prior review was submitted: setuptools==80.9.0 is removed from requirements.txt. In the base branch (unstable), setuptools is still listed as a transitive dependency of google-api-core, google-auth, and marisa-trie. Its removal here suggests that pip's dependency resolver, when regenerating the lockfile against the updated cryptography version, no longer pulls setuptools into the graph — likely because a marker condition changed (e.g., Python 3.12+ exemption) or a transitive dep dropped its setuptools requirement. Linting and build CI both pass, indicating no runtime import issues caused by the removal.

Compatibility Assessment

• No API changes; patch-level security fix only
• setuptools removed as transitive dependency — consistent with passing build/lint CI
• No peer dependency changes introduced by the cryptography bump itself
• No code migration required

Recommendation

APPROVE — Security patch for CVE-2026-39892 with no breaking changes. The setuptools removal is an expected lockfile side-effect of the rebase; passing linting and build CI support this. Confirm Python unit tests complete successfully (were in progress at submission time).

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Compared the current PR state against findings from a prior review:

• Retrieved prior bot reviews deterministically via the GitHub API
• Classified each prior finding as RESOLVED, UNADDRESSED, ACKNOWLEDGED, or CONTESTED
• Only raised NEW findings for newly introduced code
• Reviewed the pull request diff checking for correctness, design, architecture, testing, completeness, and adherence to DRY/SRP principles
• Checked CI status and linked issue acceptance criteria