chore: bump cryptography dependency and remove upper bound

[mckornfield]

📋 Summary

• Move the cryptography pin to address CVEs/not set an upper bound that blocks taking new changes

🔗 Related Issue

Fixes #820

🧪 Testing

• make test passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

✅ Checklist

• Follows commit message conventions
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[greptile-apps]

Greptile Summary

This PR bumps the cryptography dependency from 46.0.7 to 48.0.1 to address CVEs and aligns the lock file accordingly. The minimum version is also raised in the e2e test constraints.

• packages/data-designer-engine/pyproject.toml: Minimum raised to 48.0.1, but the upper bound changed to <=49 (inclusive) rather than <50, which would inadvertently block 49.x patch releases — inconsistent with the PR's stated goal and with every other constraint's <N pattern in the file.
• tests_e2e/pyproject.toml: Minimum constraint updated to 48.0.1; correct and complete.
• uv.lock: Lock file regenerated to resolve cryptography 48.0.1 with verified hashes.

Confidence Score: 4/5

Safe to merge after fixing the upper bound — the <=49 inclusive comparator would silently block 49.x patch releases, undermining the security-update goal of this change.

The <=49 upper bound in packages/data-designer-engine/pyproject.toml is a logic error: PEP 440 inclusive comparisons mean 49.0.1 and 49.1.0 would be excluded because they sort above 49.0.0. The rest of the file consistently uses exclusive <N bounds, and the PR's own stated goal is to avoid blocking future updates — <50 is the correct form. The e2e constraint and lock file changes are fine.

packages/data-designer-engine/pyproject.toml — the <=49 upper bound should be <50.

Important Files Changed

Filename	Overview
packages/data-designer-engine/pyproject.toml	Bumps cryptography minimum to 48.0.1, but the new upper bound <=49 (inclusive) would block 49.x patch releases; should be <50 to match the file's convention and the PR's stated intent.
tests_e2e/pyproject.toml	Raises constraint-dependency minimum for cryptography from 46.0.7 to 48.0.1; straightforward and correct.
uv.lock	Lock file updated to resolve cryptography 48.0.1 with correct hashes; no issues.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["cryptography dependency"] --> B["data-designer-engine\npyproject.toml"]
    A --> C["tests_e2e\npyproject.toml"]
    A --> D["uv.lock"]

    B --> B1["Before: >=46.0.7,<47\nPins to 46.x only"]
    B --> B2["After: >=48.0.1,<=49\n⚠️ Blocks 49.0.1+ patch releases"]
    B2 --> B3["Intended: >=48.0.1,<50\nAllows full 49.x series"]

    C --> C1["Before: >=46.0.7\nConstraint-dependency"]
    C --> C2["After: >=48.0.1\nConstraint-dependency ✅"]

    D --> D1["Resolved: 48.0.1\nHashes verified ✅"]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["cryptography dependency"] --> B["data-designer-engine\npyproject.toml"]
    A --> C["tests_e2e\npyproject.toml"]
    A --> D["uv.lock"]

    B --> B1["Before: >=46.0.7,<47\nPins to 46.x only"]
    B --> B2["After: >=48.0.1,<=49\n⚠️ Blocks 49.0.1+ patch releases"]
    B2 --> B3["Intended: >=48.0.1,<50\nAllows full 49.x series"]

    C --> C1["Before: >=46.0.7\nConstraint-dependency"]
    C --> C2["After: >=48.0.1\nConstraint-dependency ✅"]

    D --> D1["Resolved: 48.0.1\nHashes verified ✅"]

Loading

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
packages/data-designer-engine/pyproject.toml:39
The upper bound `<=49` uses an inclusive comparison, which means any patch release of version 49 (e.g. `49.0.1`, `49.1.0`) would be excluded since those sort *greater than* `49.0.0` under PEP 440. Every other constraint in this file uses an exclusive `<N` form (e.g. `<1`, `<2`, `<6`), so the pattern here should be `<50` to allow all 49.x releases. As written, the stated goal of "not set an upper bound that blocks taking new changes" would be defeated as soon as a 49.x patch lands.

```suggestion
    "cryptography>=48.0.1,<50",
```

_{Reviews (3): Last reviewed commit: "chore: bump cryptography dependency to a..." | Re-trigger Greptile}

[github-actions]

Issue #820 has been triaged. The linked issue check is being re-evaluated.

[greptile-apps]

The upper bound <=49 uses an inclusive comparison, which means any patch release of version 49 (e.g. 49.0.1, 49.1.0) would be excluded since those sort greater than 49.0.0 under PEP 440. Every other constraint in this file uses an exclusive <N form (e.g. <1, <2, <6), so the pattern here should be <50 to allow all 49.x releases. As written, the stated goal of "not set an upper bound that blocks taking new changes" would be defeated as soon as a 49.x patch lands.

Suggested change

	"cryptography>=48.0.1,<=49",
	"cryptography>=48.0.1,<50",

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/data-designer-engine/pyproject.toml
Line: 39

Comment:
The upper bound `<=49` uses an inclusive comparison, which means any patch release of version 49 (e.g. `49.0.1`, `49.1.0`) would be excluded since those sort *greater than* `49.0.0` under PEP 440. Every other constraint in this file uses an exclusive `<N` form (e.g. `<1`, `<2`, `<6`), so the pattern here should be `<50` to allow all 49.x releases. As written, the stated goal of "not set an upper bound that blocks taking new changes" would be defeated as soon as a 49.x patch lands.

```suggestion
    "cryptography>=48.0.1,<50",
```

How can I resolve this? If you propose a fix, please make it concise.