build(core): require cryptography 48

[DABH]

Description

Cryptography wheels below 48.0.1 bundle a vulnerable statically linked OpenSSL (GHSA-537c-gmf6-5ccf, high severity). Core's cryptography>=46.0.6,<47 pin makes the patched wheels unresolvable for every environment that includes the toolkit, so downstream integrations (like what I'm building right now) can't remediate the advisory.

• Require cryptography>=48.0,<49 (floor raised to the patched line per review).
• Regenerate the lock files (root + per-project, 87 total; big diff but this is a really tiny change...). They now resolve cryptography 48.0.1; oci (→ 2.183.0), langchain-litellm (→ 0.6.6), and pyopenssl (→ 26.2.0) move to the first releases permitting 48.x, since their previously locked versions also capped cryptography below 47. packages/nvidia_nat_redis/uv.lock resolves core from the registry rather than the workspace and is unaffected.

Note: authlib (core's direct cryptography consumer) declares no cryptography bound at the locked 1.7.2, so core's pin is the binding constraint (this change alone is sufficient).

No existing issue; happy to file a tracking issue if the team prefers one.

Testing

On Python 3.13.12 / uv 0.9.28 (the pinned dev version):

• uv lock re-run across all 87 projects is a strict no-op after this PR's regeneration. (Test results below were produced under the initial commit and re-verified after the floor bump: the resolved set is identical, cryptography 48.0.1 throughout.)
• Core suite under cryptography 48.0.1: pytest packages/nvidia_nat_core — 2793 passed, 54 skipped (the suite's default skips).
• Auth-touching paths: tests/nat/authentication + tests/nat/front_ends — 396 passed, 3 skipped; nvidia_nat_a2a (OAuth middleware exercises cryptography key generation and PEM serialization directly) — 63 passed.
• python ci/scripts/copyright.py --verify-apache-v2 — passed.

By Submitting this PR I confirm:

• I am familiar with the Contributing Guidelines.
• We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  • Any contribution which contains commits that are not Signed-Off will not be accepted.
• When the PR is ready for review, new or existing tests cover these changes.
• When the PR is ready for review, the documentation is up to date with these changes.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

💤 Files selected but had no reviewable changes (1)

• packages/nvidia_nat_core/pyproject.toml

⛔ Files ignored due to path filters (86)

• examples/A2A/math_assistant_a2a/uv.lock is excluded by !**/*.lock
• examples/A2A/math_assistant_a2a_protected/uv.lock is excluded by !**/*.lock
• examples/HITL/por_to_jiratickets/uv.lock is excluded by !**/*.lock
• examples/HITL/simple_calculator_hitl/uv.lock is excluded by !**/*.lock
• examples/MCP/service_account_auth_mcp/uv.lock is excluded by !**/*.lock
• examples/MCP/simple_auth_mcp/uv.lock is excluded by !**/*.lock
• examples/MCP/simple_calculator_fastmcp/uv.lock is excluded by !**/*.lock
• examples/MCP/simple_calculator_fastmcp_protected/uv.lock is excluded by !**/*.lock
• examples/MCP/simple_calculator_mcp/uv.lock is excluded by !**/*.lock
• examples/MCP/simple_calculator_mcp_protected/uv.lock is excluded by !**/*.lock
• examples/RAG/simple_rag/uv.lock is excluded by !**/*.lock
• examples/a365_example/uv.lock is excluded by !**/*.lock
• examples/advanced_agents/alert_triage_agent/uv.lock is excluded by !**/*.lock
• examples/agents/uv.lock is excluded by !**/*.lock
• examples/control_flow/hybrid_control_flow/uv.lock is excluded by !**/*.lock
• examples/control_flow/parallel_executor/uv.lock is excluded by !**/*.lock
• examples/control_flow/router_agent/uv.lock is excluded by !**/*.lock
• examples/control_flow/sequential_executor/uv.lock is excluded by !**/*.lock
• examples/custom_functions/automated_description_generation/uv.lock is excluded by !**/*.lock
• examples/custom_functions/plot_charts/uv.lock is excluded by !**/*.lock
• examples/documentation_guides/uv.lock is excluded by !**/*.lock
• examples/documentation_guides/workflows/text_file_ingest/uv.lock is excluded by !**/*.lock
• examples/dynamo_integration/latency_sensitivity_demo/uv.lock is excluded by !**/*.lock
• examples/dynamo_integration/react_benchmark_agent/uv.lock is excluded by !**/*.lock
• examples/evaluation_and_profiling/email_phishing_analyzer/uv.lock is excluded by !**/*.lock
• examples/evaluation_and_profiling/simple_calculator_eval/uv.lock is excluded by !**/*.lock
• examples/evaluation_and_profiling/simple_web_query_eval/uv.lock is excluded by !**/*.lock
• examples/experimental/claude_code_agent_adapter/uv.lock is excluded by !**/*.lock
• examples/experimental/codex_agent_adapter/uv.lock is excluded by !**/*.lock
• examples/experimental/cursor_agent_adapter/uv.lock is excluded by !**/*.lock
• examples/experimental/hermes_agent_adapter/uv.lock is excluded by !**/*.lock
• examples/experimental/openclaw_agent_adapter/uv.lock is excluded by !**/*.lock
• examples/finetuning/dpo_tic_tac_toe/uv.lock is excluded by !**/*.lock
• examples/finetuning/rl_with_openpipe_art/uv.lock is excluded by !**/*.lock
• examples/frameworks/adk_demo/uv.lock is excluded by !**/*.lock
• examples/frameworks/agno_personal_finance/uv.lock is excluded by !**/*.lock
• examples/frameworks/haystack_deep_research_agent/uv.lock is excluded by !**/*.lock
• examples/frameworks/multi_frameworks/uv.lock is excluded by !**/*.lock
• examples/frameworks/nat_autogen_demo/uv.lock is excluded by !**/*.lock
• examples/frameworks/semantic_kernel_demo/uv.lock is excluded by !**/*.lock
• examples/frameworks/strands_demo/uv.lock is excluded by !**/*.lock
• examples/front_ends/per_user_workflow/uv.lock is excluded by !**/*.lock
• examples/front_ends/simple_auth/uv.lock is excluded by !**/*.lock
• examples/front_ends/simple_calculator_custom_routes/uv.lock is excluded by !**/*.lock
• examples/getting_started/simple_calculator/uv.lock is excluded by !**/*.lock
• examples/getting_started/simple_web_query/uv.lock is excluded by !**/*.lock
• examples/memory/redis/uv.lock is excluded by !**/*.lock
• examples/notebooks/uv.lock is excluded by !**/*.lock
• examples/object_store/user_report/uv.lock is excluded by !**/*.lock
• examples/observability/simple_calculator_observability/uv.lock is excluded by !**/*.lock
• examples/prompt_from_file/uv.lock is excluded by !**/*.lock
• examples/safety_and_security/retail_agent/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_a2a/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_a365/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_adk/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_agno/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_app/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_atif/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_autogen/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_config_optimizer/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_core/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_crewai/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_data_flywheel/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_eval/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_fastmcp/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_langchain/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_llama_index/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_mcp/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_mem0ai/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_memmachine/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_mysql/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_nemo_customizer/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_openpipe_art/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_opentelemetry/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_phoenix/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_profiler/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_rag/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_ragas/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_s3/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_security/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_semantic_kernel/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_strands/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_test/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_weave/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_zep_cloud/uv.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b922f0ee-c370-47f2-bead-0c96b6b73ff6

📥 Commits

Reviewing files that changed from the base of the PR and between c10dc4d and 075dae2.

⛔ Files ignored due to path filters (86)

• examples/A2A/math_assistant_a2a/uv.lock is excluded by !**/*.lock
• examples/A2A/math_assistant_a2a_protected/uv.lock is excluded by !**/*.lock
• examples/HITL/por_to_jiratickets/uv.lock is excluded by !**/*.lock
• examples/HITL/simple_calculator_hitl/uv.lock is excluded by !**/*.lock
• examples/MCP/service_account_auth_mcp/uv.lock is excluded by !**/*.lock
• examples/MCP/simple_auth_mcp/uv.lock is excluded by !**/*.lock
• examples/MCP/simple_calculator_fastmcp/uv.lock is excluded by !**/*.lock
• examples/MCP/simple_calculator_fastmcp_protected/uv.lock is excluded by !**/*.lock
• examples/MCP/simple_calculator_mcp/uv.lock is excluded by !**/*.lock
• examples/MCP/simple_calculator_mcp_protected/uv.lock is excluded by !**/*.lock
• examples/RAG/simple_rag/uv.lock is excluded by !**/*.lock
• examples/a365_example/uv.lock is excluded by !**/*.lock
• examples/advanced_agents/alert_triage_agent/uv.lock is excluded by !**/*.lock
• examples/agents/uv.lock is excluded by !**/*.lock
• examples/control_flow/hybrid_control_flow/uv.lock is excluded by !**/*.lock
• examples/control_flow/parallel_executor/uv.lock is excluded by !**/*.lock
• examples/control_flow/router_agent/uv.lock is excluded by !**/*.lock
• examples/control_flow/sequential_executor/uv.lock is excluded by !**/*.lock
• examples/custom_functions/automated_description_generation/uv.lock is excluded by !**/*.lock
• examples/custom_functions/plot_charts/uv.lock is excluded by !**/*.lock
• examples/documentation_guides/uv.lock is excluded by !**/*.lock
• examples/documentation_guides/workflows/text_file_ingest/uv.lock is excluded by !**/*.lock
• examples/dynamo_integration/latency_sensitivity_demo/uv.lock is excluded by !**/*.lock
• examples/dynamo_integration/react_benchmark_agent/uv.lock is excluded by !**/*.lock
• examples/evaluation_and_profiling/email_phishing_analyzer/uv.lock is excluded by !**/*.lock
• examples/evaluation_and_profiling/simple_calculator_eval/uv.lock is excluded by !**/*.lock
• examples/evaluation_and_profiling/simple_web_query_eval/uv.lock is excluded by !**/*.lock
• examples/experimental/claude_code_agent_adapter/uv.lock is excluded by !**/*.lock
• examples/experimental/codex_agent_adapter/uv.lock is excluded by !**/*.lock
• examples/experimental/cursor_agent_adapter/uv.lock is excluded by !**/*.lock
• examples/experimental/hermes_agent_adapter/uv.lock is excluded by !**/*.lock
• examples/experimental/openclaw_agent_adapter/uv.lock is excluded by !**/*.lock
• examples/finetuning/dpo_tic_tac_toe/uv.lock is excluded by !**/*.lock
• examples/finetuning/rl_with_openpipe_art/uv.lock is excluded by !**/*.lock
• examples/frameworks/adk_demo/uv.lock is excluded by !**/*.lock
• examples/frameworks/agno_personal_finance/uv.lock is excluded by !**/*.lock
• examples/frameworks/haystack_deep_research_agent/uv.lock is excluded by !**/*.lock
• examples/frameworks/multi_frameworks/uv.lock is excluded by !**/*.lock
• examples/frameworks/nat_autogen_demo/uv.lock is excluded by !**/*.lock
• examples/frameworks/semantic_kernel_demo/uv.lock is excluded by !**/*.lock
• examples/frameworks/strands_demo/uv.lock is excluded by !**/*.lock
• examples/front_ends/per_user_workflow/uv.lock is excluded by !**/*.lock
• examples/front_ends/simple_auth/uv.lock is excluded by !**/*.lock
• examples/front_ends/simple_calculator_custom_routes/uv.lock is excluded by !**/*.lock
• examples/getting_started/simple_calculator/uv.lock is excluded by !**/*.lock
• examples/getting_started/simple_web_query/uv.lock is excluded by !**/*.lock
• examples/memory/redis/uv.lock is excluded by !**/*.lock
• examples/notebooks/uv.lock is excluded by !**/*.lock
• examples/object_store/user_report/uv.lock is excluded by !**/*.lock
• examples/observability/simple_calculator_observability/uv.lock is excluded by !**/*.lock
• examples/prompt_from_file/uv.lock is excluded by !**/*.lock
• examples/safety_and_security/retail_agent/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_a2a/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_a365/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_adk/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_agno/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_app/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_atif/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_autogen/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_config_optimizer/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_core/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_crewai/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_data_flywheel/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_eval/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_fastmcp/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_langchain/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_llama_index/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_mcp/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_mem0ai/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_memmachine/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_mysql/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_nemo_customizer/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_openpipe_art/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_opentelemetry/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_phoenix/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_profiler/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_rag/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_ragas/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_s3/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_security/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_semantic_kernel/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_strands/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_test/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_weave/uv.lock is excluded by !**/*.lock
• packages/nvidia_nat_zep_cloud/uv.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• packages/nvidia_nat_core/pyproject.toml

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[willkill07]

/ok to test 6bdf25c

[willkill07]

/ok to test bc55721

[willkill07]

@Salonijain27 Output of ./ci/scripts/license_diff.py:

Added packages:
- crc32c 2.8 LGPL-2.1-or-later
Changed packages:
- cryptography 46.0.7 -> 48.0.1
- langchain-litellm 0.6.5 -> 0.6.6
- oci 2.171.0 -> 2.183.0

[DABH]

Rebuilt on current develop and regenerated the locks against it — the uv-lock-all-pyprojects failure came from lock changes that landed on develop after this branch was cut (the openclaw example adapter's lock). Collapsed to a single commit matching the final state (cryptography>=48.0,<49, resolving 48.0.1 throughout). Ready for another CI trigger when convenient.

[willkill07]

/ok to test 9b769a1

[DABH]

Sorry, I missed a file 🤦‍♂️ Apologies for the noise. Pushed one more time...

[willkill07]

@DABH so we don't waste another cycle...

Please invoke and share the output of:

pre-commit run uv-lock-all-pyprojects

[DABH]

$ pre-commit run uv-lock-all-pyprojects            
Ensure `uv lock` is run for all pyproject.toml files...(no files to check)Skipped

Also ran

pre-commit run uv-lock-all-pyprojects --all-files
git status

and looks clean...

[willkill07]

Thank you!

[willkill07]

/ok to test 11c683b

[Salonijain27]

Approved from a dependency point of view

[willkill07]

@DABH pre-commit checks are still failing

[DABH]

@willkill07 Yep I realized the issue - work laptop had a secret filter going on that was (silently) preventing interactions with files named openclaw. Go figure. Going to update the PR on my home machine and should be good then. Apologies for all the hassle on what should have been a trivial PR!...

[DABH]

@willkill07 , ok, 87 files not 86 changed now, I see openclaw package's uv lock was successfully regenerated. Should be good to go now. Thank you again!

[willkill07]

/ok to test 075dae2