fix(deps): override clerk-backend-api cap to clear cryptography CVEs (CI run #13)

[Sbussiso]

Root cause

Weekly dependency refresh run #13 (31367891577) failed at the pip-audit --strict gate:

Found 3 known vulnerabilities in 1 package
Name         Version ID              Fix Versions
------------ ------- --------------- ------------
cryptography 48.0.1  PYSEC-2026-3552 50.0.0
cryptography 48.0.1  PYSEC-2026-3553 49.0.0
cryptography 48.0.1  PYSEC-2026-3554 49.0.0

Three CVEs in cryptography 48.0.1, all disclosed since the last green refresh:

ID	CVE	Summary	Fixed in
PYSEC-2026-3552	CVE-2026-69247	PKCS#7 EnvelopedData Bleichenbacher oracle (distinguishable errors/timing)	50.0.0
PYSEC-2026-3553	CVE-2026-69249	Duplicate self-signed intermediates → exponential path-building (DoS)	49.0.0
PYSEC-2026-3554	CVE-2026-69248	Verifier accepts wildcard DNS names escaping permittedSubtrees	49.0.0

Why a plain lock refresh could not fix it

The existing constraint cryptography>=48.0.1 is a floor, not a cap, so uv lock --upgrade should have pulled a newer version — but it stayed pinned at 48.0.1. Root cause: clerk-backend-api 6.0.1 (the latest release on PyPI) declares cryptography<49.0.0,>=45.0.0, and uv respects that transitive upper bound. There is no newer clerk-backend-api release. So the fix versions (49.0.0 / 50.0.0) are unreachable through normal resolution.

Fix

Add a tool.uv.override-dependencies entry forcing cryptography>=50.0.0 past clerk-backend-api's cap. uv's override mechanism is the sanctioned way to ignore a transitive constraint that blocks a security fix.

cryptography is purely transitive in this backend — there are no direct cryptography imports. The backend uses PyJWT + clerk-backend-api for JWT/JWS verification, not the x509/PKCS#7 or certificate-path-building code paths these CVEs target, so the override carries no behavioral risk.

Verification (parity with the weekly workflow's gates)

Ran locally against the patched lock:

Gate	Result
uv lock --upgrade	cryptography → 50.0.0
uv run ruff check	✅ All checks passed
uv run pip-audit --strict	✅ No known vulnerabilities found
uv run pytest -q	✅ 699 passed

Cleanup note

Remove the override-dependencies block and the cryptography>=48.0.1 constraint floor once clerk-backend-api ships a release that allows cryptography>=49.0.0. Both are documented inline in backend/pyproject.toml.

Draft until CI on this branch confirms the fix reproduces green in GitHub Actions.