chore(deps): update dependency cryptography to v46 [security]

[renovatebotcpg]

This PR contains the following updates:

Package	Type	Update	Change
cryptography (changelog)	project.dependencies	major	44.0.1 → 46.0.5

---

cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

CVE-2026-26007 / GHSA-r6ph-v2qm-q3c2

More information

Details

Vulnerability Summary

The public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve.

This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup.

Only SECT curves are impacted by this.

Credit

This vulnerability was discovered by:

• XlabAI Team of Tencent Xuanwu Lab
• Atuin Automated Vulnerability Discovery Engine

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

• https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2
• https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c
• https://github.com/pyca/cryptography/releases/tag/46.0.5
• https://nvd.nist.gov/vuln/detail/CVE-2026-26007
• http://www.openwall.com/lists/oss-security/2026/02/10/4
• https://github.com/advisories/GHSA-r6ph-v2qm-q3c2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

pyca/cryptography (cryptography)

v46.0.5

Compare Source

v46.0.4

Compare Source

v46.0.3

Compare Source

v46.0.2

Compare Source

v46.0.1

Compare Source

v46.0.0

Compare Source

v45.0.7

Compare Source

v45.0.6

Compare Source

v45.0.5

Compare Source

v45.0.4

Compare Source

v45.0.3

Compare Source

v45.0.2

Compare Source

v45.0.1

Compare Source

v45.0.0

Compare Source

v44.0.3

Compare Source

v44.0.2

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[github-actions]

PR Checklist ✅

Have you checked the following?

• Changes do not contain the names of any sensitive CPG projects
• Tests cover any newly added code
• There aren't any unnecessary autoformatting changes
• Pull request description is appropriate for use as a commit message for squash commit

Check all boxes before merging.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.21%. Comparing base (5640c89) to head (79cad62).

Additional details and impacted files

@@           Coverage Diff           @@
##              dev    #1215   +/-   ##
=======================================
  Coverage   83.21%   83.21%           
=======================================
  Files         216      216           
  Lines       18949    18949           
=======================================
  Hits        15768    15768           
  Misses       3181     3181           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[violetbrina]

I don't think this issue relates to us but it's worth keeping an eye on since we've also moved to Python 3.14.

Currently passing our unittests so I think it's fine but probably should wait to merge until after the postgres-migration containing the 3.14 change.

@dancoates since you're often working on metamist I'm assuming you'd like eyes on the chore PRs as well? Or are you ok with anyone from ST merging in upgrading dependency PRs?