v0.31.1 — a HIGH advisory, and our own bound was blocking the patch

Security release. Upgrade if you install any face extra ([a2a], [http], [mcp-http]) or run the container image.

GHSA-g6cj-pr64-35w5 (HIGH, CVSS 8.2, published 2026-08-03) — PKCS#7 EnvelopedData decryption in cryptography exposes a Bleichenbacher oracle through distinguishable errors and timing. It affects cryptography>=44.0.0,<50.0.0 and is fixed in 50.0.0.

Proximo does not call the vulnerable surface. There is no PKCS#7, EnvelopedData or S/MIME anywhere in the reachable dependency graph — ours or transitive. cryptography is used for EC/ES256 JWS (caller badges, SIGNET card signing) and key serialization, nothing else.

The defect was what we published. 0.31.0's wheel declares cryptography<50,>=49.0.0 on the three face extras, so an adopter who installed one had no resolution path to the patched release — held inside the affected range by our own metadata. Nothing else in the graph capped it; google-auth and pyjwt both take cryptography unbounded. Separately, the image installs requirements/runtime.txt under --require-hashes, so the published container shipped the vulnerable library outright.

Fixed

• Both bounds move to cryptography>=50.0.0,<51 — the floor, not only the cap. Widening <50 to <51 alone would still permit 49.0.0, so a constrained resolve could sit on the vulnerable pin with every check in the repo green.
• The floor is now guarded. The bounds test added in 0.27.1 asks only whether some upper bound closes the next major, so a floor lowered back to >=49.0.0 — or to >=44.0.0, re-admitting the whole affected range — left it green. A named test now asserts the floor separately. Both guards were proven by mutation and are orthogonal: lower the floor and only the new one fires; remove the cap and only the old one fires.
• Deferred 0.31.0 review findings, now shipped: pve_doctor no longer tells a correctly-configured plane to configure itself (its hint keyed on "serves zero tools", which is true of every plane under the default facade by design); a pinning test asserts the silence rather than a bound; and two comments were corrected, one of which cited a pinning test that has never existed.
• Pinned GitHub Actions moved to current SHAs (CodeQL, docker/login-action, pypa/gh-action-pypi-publish, and the release/mirror/Trivy workflows).

No tool, behavior, or interface change. The tool estate is unchanged at 906.

Verifying it yourself

pip install 'proximo-proxmox[http]==0.31.1'
python -c "import cryptography; print(cryptography.__version__)"   # => 50.0.0

The bound is what does the work, so the useful check is the one that must fail:

pip install 'proximo-proxmox[http]==0.31.1' 'cryptography==49.0.0'
# => resolution error: the extras require cryptography>=50.0.0,<51

Artifact provenance, image signatures and the audit-chain walkthrough: VERIFY.md.