chore(deps): pin pyasn1 >=0.6.4 and cryptography >=50.0.0 to fix high-severity Dependabot alerts

[devin-ai-integration]

Summary

Clears all four open high-severity Dependabot alerts in this repo. Both packages are transitive-only and there is no lock file, so the fix follows the existing idna precedent: explicit floors on the transitive dependency in pyproject.toml.

 idna = ">=3.15,<4"  # transitive dependency via requests, pinned to address CVE-2025-46816
+pyasn1 = ">=0.6.4,<0.7"       # via google-auth/pyasn1-modules
+cryptography = ">=50.0.0,<51" # via google-auth/azure-storage-blob

• pyasn1 (3 alerts): BER/CER/DER decoder DoS via unbounded long-form tag IDs, quadratic complexity in OBJECT IDENTIFIER / RELATIVE-OID processing, uncontrolled resource consumption converting decoded REAL values. Upper bound <0.7 because pyasn1-modules pins pyasn1 <0.7.
• cryptography (1 alert, CVE-2026-69247 / GHSA-g6cj-pr64-35w5, vulnerable >=44.0.0,<50.0.0): PKCS#7 EnvelopedData Bleichenbacher oracle. No dependent caps cryptography (google-auth >=38.0.3, azure-storage-blob >=2.1.4, snowflake-connector-python >=46.0.5), so the floor resolves cleanly — verified with a scratch poetry lock (Poetry 1.8.5, matching the repo) over the full dependency set including the warehouse extras.

Link to Devin session: https://app.devin.ai/sessions/9b1b941648704776a28d6b134f3a667e

Summary by CodeRabbit

• Chores
  • Updated underlying runtime components with bounded version support to incorporate security patches and improve compatibility.
  • No changes to user-facing features, workflows, or public interfaces.
  • These updates are transparent during normal application use and do not require changes to existing configurations.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 @devin-ai-integration[bot]
Thank you for raising your pull request.
Please make sure to add tests and document all user-facing changes.
You can do this by editing the docs files in this pull request.

[coderabbitai]

📝 Walkthrough

Walkthrough

The project metadata adds bounded runtime dependencies for pyasn1 and cryptography. The declarations include security advisory notes.

Changes

Runtime dependency updates

Layer / File(s)	Summary
Declare bounded runtime dependencies pyproject.toml	Adds bounded pyasn1 and cryptography dependencies with security advisory notes.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• elementary-data/elementary#2314: Both changes update pyproject.toml with a bounded pyasn1 dependency for transitive security vulnerabilities.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the dependency updates and their purpose, matching the main changes described in the pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch devin/dependabot-pyasn1-1785639935

---

_{Comment @coderabbitai help to get the list of available commands.}