fix(deps): bump aiohttp and cryptography to resolve six GHSA advisories

[Vidit-Ostwal]

Summary

• Bump aiohttp override from >=3.14.0 to >=3.14.3 to clear GHSA-mq44-7p77-q5h7, GHSA-mfx4-hv73-q22v, and GHSA-cq5v-8q36-5273
• Bump cryptography override from >=46.0.7 to >=50.0.0 to clear GHSA-m2h6-j472-rp4c, GHSA-g6cj-pr64-35w5, and GHSA-jwv3-5hgf-82ww
• Regenerate uv.lock (aiohttp 3.14.1→3.14.3, cryptography 48.0.1→50.0.0)

Validation

• uv lock resolves cleanly (476 packages)
• uv sync --all-groups --all-extras succeeds
• pip-audit reports no known vulnerabilities (target GHSAs cleared)
• Token manager tests pass (36/36) — direct cryptography usage

Test plan

• CI vulnerability scan (pip-audit) passes
• Full CI test suite passes with updated lockfile

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9d583b99-e450-444d-a0b9-d36de207819a

📥 Commits

Reviewing files that changed from the base of the PR and between 98668c6 and e593f40.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• pyproject.toml

---

📝 Walkthrough

Walkthrough

This PR updates pyproject.toml with security advisory comments for cryptography and aiohttp packages. It raises the UV override constraint for cryptography from >=46.0.7 to >=50.0.0, and for aiohttp from >=3.14.0 to >=3.14.3.

Changes

Dependency security updates

Layer / File(s)	Summary
Cryptography advisory and override pyproject.toml	Adds advisory comments for cryptography versions through 48.0.x and below 50.0.0. Raises the UV override constraint to >=50.0.0.
aiohttp advisory and override pyproject.toml	Adds advisory comments for aiohttp versions through 3.14.2. Raises the UV override constraint to >=3.14.3.

Suggested reviewers: joaomdmoura, lorenzejay

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states that aiohttp and cryptography dependency versions are being raised to resolve security advisories.
Description check	✅ Passed	The description directly explains the dependency updates, addressed advisories, lockfile changes, and validation results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}