2 Commits

Include renames

Author	SHA1	Message	Date
peter	b1832afd18	style: apply ruff format across backend + scripts (line-length 100) ... Mechanical, whole-tree `ruff format` pass — no behaviour change. Recorded in .git-blame-ignore-revs (next commit) so git blame skips it.	2026-08-23 07:43:06 +02:00
peter	8ffa65a9da	fix(security): bump cryptography 46.0.7 -> 50.0.0 to clear 4 CVEs ... The pip-audit step added in E1 S4 flagged cryptography 46.0.7 for PYSEC-2026-3552 /3553/3554 and GHSA-537c-gmf6-5ccf; all are fixed by 50.0.0. The requirements.txt ceiling `<47` was blocking the upgrade — relaxed to `>=50.0.0,<51`. The lock is a surgical bump (only the cryptography line changed; cffi 2.1.1 already satisfies it, no other package moved). pip-audit -r requirements.lock is now clean. Add tests/test_security.py (there was none for the crypto primitives): the Fernet encrypt/decrypt round-trip, decrypt_optional degrading on garbage and on a key mismatch (the B-core-2 path), and the argon2 password hash/verify round-trip — so a future crypto-lib bump can't silently break the token-at-rest path. Gate green: 330 pytest.	2026-08-18 02:47:05 +02:00