From cce794a124accb354c0a7b758467830dc7881d4c Mon Sep 17 00:00:00 2001 From: Zheng Feng Date: Sat, 20 Jun 2026 18:36:52 +0800 Subject: [PATCH] fix(deps): bump cryptography constraint to >=48.0.1 to match lockfile (#3666) Dependabot security update #3620 bumped cryptography to 48.0.1 in uv.lock but left the harness manifest at >=43.0.0, since the dependency lives in the workspace member packages/harness, not backend/pyproject.toml. The drift caused 'uv lock' to keep rewriting the recorded specifier. Align the source constraint with the locked version. --- backend/packages/harness/pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/packages/harness/pyproject.toml b/backend/packages/harness/pyproject.toml index 026e11bea..ffffa3050 100644 --- a/backend/packages/harness/pyproject.toml +++ b/backend/packages/harness/pyproject.toml @@ -36,7 +36,7 @@ dependencies = [ "sqlalchemy[asyncio]>=2.0,<3.0", "aiosqlite>=0.19", "alembic>=1.13", - "cryptography>=43.0.0", + "cryptography>=48.0.1", ] [project.optional-dependencies]