Bump cryptography from 48.0.0 to 50.0.0

[dependabot]

Bumps cryptography from 48.0.0 to 50.0.0.

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31

* **SECURITY ISSUE**:
:func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
and its PEM and S/MIME variants no longer expose distinguishable errors or
timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
A random key is now substituted on failure, as described in :rfc:`3218`.
Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
Everything FFDH is deprecated, including the types in
``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
parameters with the key loading APIs. Users should migrate to a more
modern key exchange algorithm.
* Added ``xof()`` class methods to
:class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
:class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
algorithm instances configured for use with
:class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
chunked-encryption specification
<https://c2sp.org/chunked-encryption>`_ for streaming authenticated
encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
carry trailing bytes after the list or after an individual SCT, instead of
silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
``GeneralizedTime`` that carries fractional seconds or another non-DER form,
matching the strict encoding already required for every other X.509 time
field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
:func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
or response whose ``version`` field is not ``v1``, the only version defined
by RFC 6960, matching the version validation already performed when loading
certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
when building against AWS-LC.
</tr></table> 

... (truncated)

Commits

• dcb7050 Prepare for 50.0.0 release (#15372)
• 53fccd9 Don't leak how PKCS#7 encryptedKey decryption failed (#15369)
• d472f97 Add from __future__ import annotations to all src/ Python files (#15371)
• 908773d Bump downstream dependencies in CI (#15368)
• 2cc07cc Bump BoringSSL, OpenSSL, AWS-LC in CI (#15367)
• c94ede9 chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)
• 67a8308 chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)
• 95018ff Release the GIL in one-shot AEAD encrypt/decrypt (#15361)
• 6954733 Release the GIL during DH and DSA parameter generation (#15364)
• 6893b94 Import _serialization instead of serialization in x509/extensions (#15363)
• Additional commits viewable in compare view

[dependabot]

A newer version of cryptography exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

[dependabot]

Superseded by #7.