fix(ci): clear pip-audit --strict — click bump + cryptography ignore-vuln (run #544)

[Sbussiso]

What

Fixes the pip-audit --strict failure in CI run #544 (Test & Deploy on the dependabot/uv/backend/ruff-0.16.2 ruff bump).

The failing step reported 4 known vulnerabilities in 2 packages:

Package	Version	ID	Fix
click	8.3.1	PYSEC-2026-2132	8.3.3
cryptography	48.0.1	PYSEC-2026-3552	50.0.0
cryptography	48.0.1	PYSEC-2026-3553	49.0.0
cryptography	48.0.1	PYSEC-2026-3554	49.0.0

Root cause

New advisories landed in the PyPA Advisory DB after the last green deploy, so pip-audit --strict turned red on a no-code-change ruff bump. (The ruff bump itself is unrelated to the failure.)

Fix — two parts, matching the project's existing constraint-dependencies / --ignore-vuln pattern

1. click — real version bump

Add "click>=8.3.3" to [tool.uv] constraint-dependencies in backend/pyproject.toml. uv lock resolves click 8.3.1 -> 8.4.2, clearing PYSEC-2026-2132 (command injection in click.edit()). click is transitive via uvicorn / fastmcp-slim / mcp; we never call click.edit() (interactive $EDITOR helper, unusable from a server).

2. cryptography — cannot bump, suppress

The fixed versions (49.0.0 / 50.0.0) are not installable: clerk-backend-api 6.0.1 declares cryptography<49.0.0,>=45.0.0, capping the highest reachable version at 48.0.1 while we depend on clerk. None of the vulnerable paths are reachable from our code (no pkcs7_decrypt_*, no X.509 verification of attacker-controlled cert chains), so the three advisories are suppressed via --ignore-vuln in both CI workflows:

• .github/workflows/deploy.yml (Test & Deploy — the failing workflow)
• .github/workflows/weekly-deps-refresh.yml (parity, so the weekly refresh doesn't re-report what the deploy gate tolerates)

Revisit when clerk-backend-api ships a release allowing cryptography>=50.0.0 — then drop the constraint and the three --ignore-vuln lines.

Verification (local, fresh clone)

uv sync --extra dev
uv run pip-audit --strict \
  --ignore-vuln PYSEC-2026-3552 \
  --ignore-vuln PYSEC-2026-3553 \
  --ignore-vuln PYSEC-2026-3554
# -> No known vulnerabilities found, 3 ignored   (exit 0)
uv run ruff check       # -> All checks passed
uv run pytest -q        # -> 699 passed in 11.47s

Notes

• The dependabot/uv/backend/ruff-0.16.2 branch was already merged (PR build(deps): bump ruff from 0.16.1 to 0.16.2 in /backend #165) and deleted by the time this run reported, so this PR targets master where the failure now lives.
• This is the same root cause as open CI-fix PRs fix(deps): pin click >=8.3.3,<8.4 for PYSEC-2026-2132 (CI #534) #156 / fix(deps): pin click >=8.3.3,<8.4 for PYSEC-2026-2132 (CI #535) #154 / fix(deps): override clerk-backend-api cap to clear cryptography CVEs (CI run #13) #159 (click / cryptography); this one is scoped to the run #544 failure and verified end-to-end (pip-audit + ruff + pytest all green).

Draft until CI on this branch confirms the gate is green.