fix(deps): bump cryptography to 49.0.0 for VULN-88802

[shuningc]

Summary

• Remediate VULN-88802: EC public-key loaders didn't verify the point is in the expected prime-order subgroup (small-subgroup attack on ECDSA/ECDH for SECT curves). Fixed in cryptography 46.0.5.
• poetry.lock bumps cryptography 45.0.6 → 49.0.0 (transitive; no pyproject.toml change, content-hash unchanged).

Notes

• Resolved to latest 49.0.0; satisfies all active constraints. openai-agents' <46 cap is only in its (inactive) encrypt extra.
• No example pins reference cryptography.

Test plan

• poetry check
• Installed cryptography 49.0.0, poetry run pytest tests/ (1988 passed, 10 skipped)

Jira

VULN-88802

[etserend]

Code Review — AI-Assisted Feedback

Reviewed by Claude Code (Claude Opus), automated review to assist human reviewers.

Verdict: Approve with comments

Minimal, lock-only security bump. One transitive side-effect worth noting below.

---

P3 — Transitive cffi 1.17.1 → 2.1.0 not mentioned in PR description (Claude Code)

File/Section: poetry.lock (cffi package section)
Issue: cryptography 49.x requires cffi>=2.0.0 (previously >=1.14), so this PR implicitly promotes cffi from 1.17.1 to 2.1.0. cffi 2.x is a major-version bump that drops Python <3.10 support and removes some deprecated APIs. The PR description only mentions cryptography.
Evidence: New lock entry shows cffi = {version = ">=2.0.0", ...} alongside the new cffi 2.1.0 block.
Recommended fix: Confirmed non-blocking — project requires python = "^3.11,<3.15" which satisfies cffi 2.x's >=3.10 floor. Consider noting the transitive cffi bump in the PR description for reviewer transparency.

---

Reviewer	Model	Key Contribution
Claude Code	Claude Opus	Identified undocumented transitive cffi major-version bump