Bump locked aiohttp and cryptography for HIGH severity CVEs

[masenf]

Dependabot flagged two transitive dependencies in uv.lock:

aiohttp 3.14.1 -> 3.14.3 (GHSA-cq5v-8q36-5273 / CVE-2026-69244)
cryptography 49.0.0 -> 50.0.0 (GHSA-g6cj-pr64-35w5 / CVE-2026-69247)

Both reach the lock only through the docs app: reflex-enterprise pulls
asgiproxy (-> aiohttp) and joserfc (-> cryptography). Neither is a
dependency of the published reflex package, so this is a lockfile-only
fix with no impact on installs of reflex itself.

aiohttp 3.14.3 published outside the 7 day exclude-newer window and
resolves on its own. cryptography 50.0.0 published inside it, so add an
exclude-newer exemption alongside the existing starlette one. Since
cryptography is transitive there is no version floor to pin, and the
exemption keeps future security releases resolvable immediately rather
than aging out of the window first.

Verified the patched versions against their consumers: joserfc 1.7.1
round-trips a JWT on cryptography 50.0.0, and asgiproxy 0.2.0 imports
cleanly on aiohttp 3.14.3.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01ULSRWe743saVEBbvBxuL9D

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[codspeed-hq]

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 8 skipped benchmarks¹

---

_{Comparing claude/sec-alerts-aiohttp-cryptography-ypb8ve (1c95997) with main (a348aea)}

Footnotes

1. 8 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[greptile-apps]

Greptile Summary

Updates the docs workspace’s locked transitive dependencies to patched releases and exempts cryptography from the repository’s package-age restriction so security releases can resolve immediately.

• Locks aiohttp 3.14.3 and cryptography 50.0.0 with regenerated distribution metadata.
• Adds the cryptography exclude-newer exemption in project and lock configuration.
• Adds a security-update news fragment and corrects an existing fragment’s Towncrier type.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified in the dependency configuration, generated lockfile, or news fragments.

The patched transitive dependencies remain resolvable for the docs workspace’s supported environment, the resolver exemption is represented consistently in project and lock configuration, and the fragment rename aligns with the configured changelog types.

Important Files Changed

Filename	Overview
pyproject.toml	Adds a documented cryptography exemption to the existing uv exclude-newer package table; no actionable issue found.
uv.lock	Regenerates the workspace lock for patched aiohttp and cryptography releases with consistent dependency and artifact metadata.
news/6837.misc.md	Adds a correctly named miscellaneous news fragment describing the transitive security dependency updates.
news/6836.misc.md	Renames an existing fragment from the unsupported chore type to the configured misc type.

_{Reviews (1): Last reviewed commit: "Name the dependency-bump news fragment a..." | Re-trigger Greptile}