v0.34.1 — cryptography floor past GHSA-g6cj-pr64-35w5

Security: cryptography floor raised past GHSA-g6cj-pr64-35w5

Dependency metadata only — no code change from v0.34.0.

GHSA-g6cj-pr64-35w5 is a Bleichenbacher oracle in cryptography's PKCS#7 EnvelopedData decryption, exposed through distinguishable errors and timing. It affects 44.0.0 through 49.x, and is fixed in 50.0.0.

The mtls extra floored cryptography>=41.0, so a fresh pip install vgi-rpc[mtls] could resolve anywhere into that range.

No vgi-rpc user was exposed by this. This package never decrypts PKCS#7. The entirety of its cryptography use is x509 certificate parsing and one hash, in vgi_rpc/http/_mtls.py, for the mTLS authenticator — none of it reaches the vulnerable code path. The floor moves so that a consumer's resolver cannot land in the range, not because anything here was reachable.

-mtls = ["cryptography>=41.0"]
+mtls = ["cryptography>=50.0"]

The floor goes to 50.0 rather than excluding the affected range: 41–43 are unaffected by this advisory but are old enough to carry their own, and the project requires Python 3.13+, so no consumer is stuck on them.

Upgrading: if you use the mtls extra, this pulls cryptography>=50.0. No API changes — the mTLS test suite passes unmodified against 50.0.0. Every other extra is untouched.