chore(deps): update locked cryptography, django, pyjwt and sqlparse for published advisories

[doublewhy]

Summary

Updates four uv.lock entries to releases that fix every advisory CI's audit job reports on dev. With this lock, CI's audit command finds no known vulnerabilities. Lock only: pyproject.toml constraints are unchanged and no other package moves.

Requirement UIDs

• None. This is dependency maintenance.

Related Issues

Closes #76

ADR Impact

• None.

Changes

uv.lock only (+64/−51). Each package's version, sdist and wheels entries change; no package is added or removed and no dependency list changes:

Package	Locked before → after	Arrives via	Advisories fixed (as reported by pip-audit)
cryptography	49.0.0 → 50.0.2	aces-sdl, asyncssh, pyjwt[crypto]	PYSEC-2026-3552
django	5.2.16 → 5.2.18	direct (Django>=5.1,<6)	PYSEC-2026-3717, PYSEC-2026-4035
pyjwt	2.13.0 → 2.15.1	mcp (as pyjwt[crypto]) via aces-sdl	PYSEC-2026-4140 to PYSEC-2026-4152, PYSEC-2026-4183
sqlparse	0.5.5 → 0.6.0	django	PYSEC-2026-3696 to PYSEC-2026-3699, PYSEC-2026-3923

pip-audit shows no fix version for PYSEC-2026-4146 (GHSA-gvp8-978c-rx2q): the advisory lists no patched version (last_affected 2.13.0). Its fix, pyjwt commit 0c87c8c, is in 2.14.0 and later.

The lock was produced with uv lock --upgrade-package cryptography --upgrade-package pyjwt --upgrade-package sqlparse --upgrade-package django (uv 0.12.1).

cryptography 49 → 50 is a major release and sqlparse 0.5 → 0.6 is a 0.x minor. Nothing in src/ or tests/ imports cryptography, jwt or sqlparse directly, and git grep finds no tracked file other than uv.lock that names them. The dependents' declared ranges all admit the new versions, and none has an upper bound: cryptography>=46.0.7 (aces-sdl 0.23.1), cryptography>=48.0.1 (asyncssh 2.24.0), cryptography>=3.4.0 (pyjwt 2.15.1, crypto extra), pyjwt[crypto]>=2.10.1 (mcp 1.28.1) and sqlparse>=0.3.1 (django 5.2.18). uv.lock records which packages depend on which but not these ranges, so the ranges come from the Requires-Dist metadata of the locked distributions that uv sync --frozen installed.

Neither the published package nor the container image reads uv.lock: wheel metadata carries the pyproject.toml ranges (release-please.yml runs uv build), and the Dockerfile runs pip install ".[server,postgres]". The lock governs the development and CI environments and the GitHub Pages docs build (docs.yml runs uv run --group docs mkdocs build --strict on pushes to main). The audit job checks only the runtime dependencies and the postgres and server extras: --no-dev drops the dev group, and docs is not a default group, so neither group is audited. None of the four version changes reaches the wheel metadata, the image or the built site, so the type is chore: it is the commit prefix .github/dependabot.yml sets for dependency updates, and CONTRIBUTING.md lists it among the types that do not cut a release.

Out of scope: the unaudited docs group still locks mkdocs-material 9.7.6 (PYSEC-2026-3864, CVE-2026-73295: DOM XSS in the search.suggest feature, which mkdocs.yml enables; fixed in 9.7.7) and urllib3 2.7.0 (PYSEC-2026-4175 to PYSEC-2026-4177, fixed in 2.8.0; installed only with the docs group, through mkdocs-material and requests). pip-audit --strict --no-deps --disable-pip over uv export --frozen --all-groups --all-extras --no-emit-project --no-hashes at 6ee2564 reports these four and nothing else ("Found 4 known vulnerabilities in 2 packages"). The live site's generator tag reports mkdocs-material 9.7.6; docs run 30174482318 last deployed it, from main. This PR leaves both packages unchanged (tracked in #79).

Open Dependabot PR #63 widens the Django range to <7. That is a separate concern; this PR keeps every range as it is.

Merge order: #71, #72 and #73 are now stacked on this branch. Each carries this PR's commit 6ee2564 under its own commits, so their audit passes, and this PR merges first. #73 (#61) also edits uv.lock, adding pytest-xdist and execnet. The two sets of packages do not overlap: the rebase merged the two lock diffs without a conflict, and uv lock --check on #73's head 8f90950 resolves 95 packages.

Test Plan

• audit before and after, using CI's exact export: uv export --frozen --no-dev --all-extras --no-emit-project --no-hashes --format requirements-txt, then pip-audit --strict --no-deps (pip-audit 2.10.1).
  • Locally, pip-audit could not create its temporary virtual environment (ensurepip dies with SIGABRT under the local CPython 3.14.4 free-threaded interpreter), so I added --disable-pip, which pip-audit accepts with --no-deps on a fully pinned list.
  • On dev's lock: "Found 27 known vulnerabilities in 4 packages", exit 1 (27 rows, 22 distinct IDs: pip-audit lists PYSEC-2026-3552 and PYSEC-2026-3696 to PYSEC-2026-3699 twice).
  • On this lock: "No known vulnerabilities found", exit 0.
• uv lock --check: "Resolved 93 packages", consistent with pyproject.toml. A tomllib comparison of the two lock files shows no package added or removed, and only version, sdist and wheels changing for the four packages above.
• Targeted tests on the updated environment: uv sync --frozen, then uv run pytest tests/test_auth.py tests/test_hardening.py tests/test_accounts.py tests/test_ingest.py tests/test_cli.py tests/test_spa_api.py -q -p no:cacheprovider --no-cov. That covers Django auth and hardening, aces-sdl ingest, the CLI and the API: 78 passed.
• Full suite, uv run pytest -q -p no:cacheprovider on the updated environment: "148 passed in 10.94s", with TOTAL 1958 statements, 83 missed, 96%, the same coverage as on dev (dev baseline: push run 34800652984 at b923768, 148 passed, TOTAL 1958/83/96%). Local interpreter: CPython 3.14.4 free-threaded build (3.14t); CI uses CPython 3.12.3.
• ACES_WORKBENCH_DEBUG=true uv run aces-workbench manage makemigrations --check --dry-run: "No changes detected". manage check: "System check identified no issues (0 silenced)." The Django patch update needs no migration.
• uvx pre-commit run --files uv.lock (pre-commit 4.6.2): every hook passed or was skipped.
• Re-run at 6ee2564, whose amend adds the distinct-advisory count to the commit message: uv run --frozen ruff check . ("All checks passed!"), uv run --frozen ruff format --check . ("47 files already formatted"), uv lock --check ("Resolved 93 packages"), the targeted tests above under uv run --frozen (78 passed), uvx pre-commit run --files uv.lock (every hook passed or was skipped) and the audit above on CI's export ("No known vulnerabilities found", exit 0). Every amend since the first push changed only the commit message: 9bc47fd, 9bde5d4, 04bc55a and 6ee2564 share tree d7f84fd, so the earlier local results apply to this head.
• At 6ee2564: CI run 38074964015 (audit and test pass; sonar below), PR Title run 38074964003, CodeQL run 38074961466 and GitGuardian pass. In CI run 38074964015, audit logged "No known vulnerabilities found" and test logged "148 passed" with TOTAL 1958/83/96%.
• sonar is the only red check, and no code change can fix it: it stops before analysis because SonarCloud rejects the repository SONAR_TOKEN ("HTTP 403 Forbidden" in CI run 38074964015). Only the maintainer can replace the secret; tracked in ci: SonarCloud rejects the repository SONAR_TOKEN #75. ci: add an OpenSSF Scorecard workflow and README badge #71, chore: use one pre-push Codex review and disable automatic review disposition #72 and ci: run lint as its own job and spread pytest over the runner's CPUs #73 fail the same way.

Ground Control Checks

• No Ground Control MCP gate (gc_evaluate_quality_gates, gc_run_sweep) was run from this environment, and the repository has no make policy target.

Traceability

• IMPLEMENTS: Issue chore(deps): upgrade cryptography, django, pyjwt and sqlparse for published advisories #76 ← uv.lock
• TESTS: none added. The evidence is the audit and the targeted test runs above.

Checklist

• Lock-only change within existing constraints; no other package moves (tomllib comparison above)
• No CHANGELOG.md or version edits
• FM: not applicable, no semantic change. No executable or runtime adoption is claimed.

Documentation

Verified unchanged: no documentation pins these versions.