fix(deps): bump cryptography to 50.0.0 and constrain aiohttp >=3.14.3 in strix CI lock

[seonghobae]

What

Two advisory-driven changes to the same hash-pinned lock, kept in one PR because
they regenerate the same file.

• requirements-strix-ci.txt:
  • cryptography==49.0.0 → ==50.0.0
  • new floor aiohttp>=3.14.3 (transitive via strix-agent, so it needs an explicit
    constraint line; a floor rather than a pin so Dependabot can keep moving it)
• requirements-strix-ci-hashes.txt: regenerated with the exact command recorded in the
  file header (uv pip compile --generate-hashes --python-version 3.13 --python-platform x86_64-manylinux_2_28 …).
  Transitive movement is pyopenssl 26.3.0 → 26.4.0 and aiohttp 3.14.1 → 3.14.3;
  everything else is hash-block churn for those packages.

Why

cryptography — CVE-2026-69247 / GHSA-g6cj-pr64-35w5
(PKCS#7 decrypt Bleichenbacher oracle in cryptography ≥44 <50) hard-fails both org-wide
gates on every PR in this repo: pip-audit (Python dependency audit) ("Found 1 known
vulnerability" in requirements-strix-ci.txt) and dependency-review.

aiohttp — three advisories published 2026-08-03 against the pinned aiohttp==3.14.1:

Advisory	Severity	Issue	Fixed in
GHSA-cq5v-8q36-5273	HIGH	out-of-bounds heap read in the C HTTP response parser error path (≤ 3.14.2)	3.14.3
GHSA-mq44-7p77-q5h7	MEDIUM	WebSocket client accepts compressed frames without negotiated permessage-deflate (≤ 3.14.1)	3.14.2
GHSA-mfx4-hv73-q22v	MEDIUM	HTTP request smuggling via WebSocket upgrade (≤ 3.14.1)	3.14.2

All three are cleared by 3.14.3. They fail the REQUIRED dependency-review check
(fail-on-severity: moderate, .github/workflows/security-scan.yml) — confirmed on
#734
(run 30891619577, job 91934771440) and
#733 — and would have failed
this PR too, since the cryptography-only revision left aiohttp at 3.14.1.

Merging this unblocks the queue; affected PRs then need a check rerun / sweep retry.

Verification

• Lock regenerated via the recorded command with uv==0.11.25 (the version this repo
  pins in requirements-opencode-review-ci.txt), not hand-edited, per the hash-pinned
  requirements discipline in CLAUDE.md.
• Diff scope confirmed against the previous revision: the aiohttp revision touches
  exactly one hunk — the aiohttp version + hash block, plus the # via list gaining
  -r requirements-strix-ci.txt now that it is a direct constraint. No other package
  moved. Resolution succeeded (106 packages), so strix-agent==1.0.4 accepts 3.14.3.
• CI's own pip-audit / dependency-review on this PR are the authoritative check.

Related

dependency-review currently re-flags pre-existing vulnerabilities on every PR
because .github/workflows/sbom-generation.yml has no push: trigger, so main never
gets a dependency snapshot ("The number of snapshots compared for the base SHA (0) and
the head SHA (1) do not match"). That root cause is fixed separately in
#736; this PR is still needed
because these advisories are genuinely present in the lock.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 48 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e86aff82-38a2-4b31-9421-e97d624f0b91

📥 Commits

Reviewing files that changed from the base of the PR and between 3f65dbe and 5b7551e.

📒 Files selected for processing (2)

• requirements-strix-ci-hashes.txt
• requirements-strix-ci.txt

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Closing as folded into the atomic central baseline PR #731. Exact blob reuse moved both the reviewed aiohttp>=3.14.3 direct constraint and its uv-generated hash lock onto #731 head 880486bb80676da2c4c9344f293a7727afe07d6b, alongside the CodeQL consistency and stale-base-lock deadlock repairs. Keeping this dependency-only PR open would duplicate the same hard-gate checks.